Digital-first non-bank financial services offer a more agile, flexible alternative to legacy banks. They hold out the promise of greater convenience, faster onboarding, and streamlined customer experiences, and a willingness to engage with consumers who might not be able to secure credit through the conventional financial system.
While that’s great news for underserved demographics, it also creates opportunities for fraud. Because legacy KYC processes were designed for a more static financial environment, they may not capture some modern fraud patterns on their own. This leaves non-bank financial institutions grasping for new KYC verification and investigation processes that meet their needs for agility and real-time results.
So what can these businesses do to protect themselves? Here, we share a few solutions.
Why Legacy KYC Solutions Are No Longer Adequate
Traditional KYC begins at onboarding with the initial risk assessment of a potential client. Successful applicants are sorted into separate groups based on the level of risk they’re perceived to represent. Those designated at the highest risk level might be reviewed annually, while those at the lowest risk level might go multiple years without being actively reviewed.
Automatically allocating new accounts an entire year without further scrutiny — especially those deemed high-risk — represents a significant vulnerability. Many institutions compound the problem by reviewing all clients at a given risk level at a given interval, whether they have or have not shown signs of problematic behavior. This slows the process and consumes human and IT resources that might better be allocated to other tasks. Additionally, the systems and personnel responsible for KYC at the onboarding phase may be siloed from those used for ongoing KYC (which we’ll explore further down below).
This relatively rigid structure, centered around scheduled reviews at lengthy intervals, is not well-suited to a non-bank financial institution’s operations in the age of generative AI and organized crime rings. As long as a fraudulent account profile can withstand that initial scrutiny, it offers criminals an opportunity to profit by exploiting those structural KYC limitations.
Synthetic Identities Are Crafted to Defeat Conventional KYC Protocols
“Synthetic” identities are created by criminals from a combination of core private information from real people (SSN, driver’s license), combined with other seemingly corroborating details (address, email addresses, phone numbers, social accounts) that are entirely fabricated. The legitimate pieces of personally identifying information (PII) can be purchased through online black markets or stolen directly through hacks or targeted scams. SSNs belonging to young children are prized, for example, because they can go undetected until the victim reaches the age of majority and begins to establish credit.
These identities, or personas, are crafted for the specific purpose of standing up to the kind of initial scrutiny they’ll meet in conventional KYC processes. The stolen PII looks legitimate because it is legitimate. Secondary forms of corroboration, such as utility bills, leases, and even social media accounts, are simple to fabricate using modern AI tools. Even advanced verification techniques are susceptible to AI: AI-generated images can easily pass for a selfie taken during the loan application process, and AI video and chat capabilities are capable enough to simulate a conversation with a real human if necessary.
It’s trivially easy for a well-funded crime ring to generate these synthetic identities at scale using new AI tools. They have the luxury of flooding financial institutions’ digital application systems with multiple differentiated personas and monitoring the end results. This yields the real-world data they need to fine-tune their synthetic identities for success, and also demonstrates which institutions’ application processes are easiest to dupe.
The Need for Perpetual KYC Processes
The lack of near-term follow-up on new accounts, once they’ve made it through the initial KYC process, provides the fake identities’ handlers with ample opportunity to exploit the targeted institution. The only remaining question is whether the criminals responsible for the account choose to settle for a lower dollar amount but a faster return, or continue to build credit over a longer term in exchange for a larger return.
The relatively static traditional system of periodic reviews is ill-suited for the task of recognizing red flags associated with these fraudulent accounts. A more flexible, proactive approach, typically described as perpetual KYC (pKYC), aims instead to flag accounts in real time if and when they show signs of inconsistency — such as unusual account activity in the months immediately after onboarding — that might indicate impending fraud.
Many of the tools already present in an institution’s software stack can be adapted to use in a pKYC setting, such as machine-learning algorithms that flag risky transactions or unusual activity. Creating a fully functioning pKYC stack requires complementing those existing tools with powerful new products capable of providing the rich, real-time data required for reliable customer validation.
New Tools to Empower Investigative Teams
When your traditional KYC or pKYC system flags an account or a transaction, your investigative team faces two often-conflicting priorities…
- Assess whether the account or transaction warrants further investigation.
- Do so without adding friction to the process for legitimate users.
The key to doing so is a fast, powerful search tool that can assemble the pertinent data and then make it available seamlessly to the rest of your software stack for analysis and (where appropriate) human review.
Spokeo for Business is precisely this type of tool. Spokeo aggregates data from a wide range of public record and commercially sourced datasets — regulated data, open-source intelligence, social media intelligence, and proprietary public information from a number of select partners — that can help you review inconsistencies in the data associated with an account of the persona you’ve searched for. That data can then be reviewed by humans on the investigative team, or shared digitally with the rest of your software stack through Spokeo’s powerful Application Programming Interface (API) for automated analysis.
Spokeo’s access to data from outside of the traditional financial system is especially important for non-bank financial institutions, which specifically court the significant minority of Americans who are unbanked or underbanked. That demographic is poorly represented in legacy data products, precisely because they face difficulty in accessing traditional banking and credit services.
The Role of Enhanced People Data in KYC Investigations
Enhanced people data can bridge the gaps in existing KYC and pKYC systems, making investigations faster and more efficient for non-bank financial institutions. Here are a few examples of how it can empower teams.
Delaminating Synthetic Identities
Synthetic identities, as explained earlier, are crafted by combining legitimate but stolen PII with wholly fabricated details. Enhanced people data can enable flagging stolen data by revealing the actual name with which the stolen PII is associated. Similarly, searches of fabricated data (email addresses, physical addresses, phone numbers) can cast doubt on a client’s identity if they prove invalid or show no associations with the name on the account.
Uncovering Changes in PII
Changes in a client’s PII can and do happen legitimately as those clients move, marry, or otherwise experience life events. Yet they may also be an indication of a malicious account takeover, identity theft, or purposeful misrepresentation. An enhanced people data tool can furnish your investigations with the data they need to differentiate between legitimate changes to PII and those made for the purposes of fraud.
Validating New Users or Beneficial Owners of An Account
Similarly, the addition of a new user to an account or a change to its beneficial ownership may be flagged by your existing tools. Here again, enhanced people data can help teams differentiate between innocuous changes made due to life events and those in which the identity of the new owner or their connection to the original owner is flimsy enough to raise doubts about their legitimacy.
Gaining an Edge Over Fraud
Adding additional contextual data sources to your fraud investigation workflows is an important step in reducing exposure to fraud through synthetic identities, in addition to more traditional threats.
Spokeo for Business can help non-bank financial institutions review additional contextual data when investigating potentially fraudulent accounts, supporting faster resolution and empowering a more robust KYC process.
Reach out to explore our solutions and learn how Spokeo for Business can support your KYC and fraud investigation teams.
Spokeo for Business provides access to public record and commercially sourced data that may support fraud investigation and account review workflows. It is not a consumer reporting agency as defined by the Fair Credit Reporting Act (FCRA) and does not provide consumer reports. Customers are responsible for ensuring their use of the data complies with all applicable laws and regulations.
Sources
The Federal Reserve FedPayments Improvement: Synthetic Identity Fraud Defined
The Federal Reserve FedPayments Improvement: Generative Artificial Intelligence Increases Synthetic Identity Fraud Threats
FDIC: 2023 FDIC National Survey of Unbanked and Underbanked Households