New Account Fraud: Trends, Red Flags, Prevention Tactics

The aim is to make the fraudster's identity and responsibility harder to detect. The Federal Trade Commission data shows consumers reported losing over $5.8 billion to fraud in 2021.

New account fraud can occur when a fraudster successfully onboards with a financial institution using their own, stolen, or synthetic identity. The account appears legitimate. However, it is opened only for fraudulent activities.

For example, applying for credit cards and committing related fraud. It is distinct from application fraud. Application fraud happens before the account is opened. It involves attempting to pass as a legitimate customer.

New Account Fraud Types

New account fraud can manifest in various types, each characterized by distinct methods and objectives. Some common types include:

1. Identity Theft: Fraudsters use stolen personal information to create a new account in someone else's name. This can involve obtaining Social Security numbers, addresses, and other sensitive data.

2. Synthetic Identity Fraud: In this type, fraudsters create entirely new identities by combining real and fake information. They may use legitimate elements like a real Social Security number with a fabricated name and address.

3. Account Takeover (ATO): Account takeover fraud occurs when fraudsters gain unauthorized access to existing accounts instead of creating a new account. They may use stolen login credentials to take control of accounts, posing as legitimate users.

4. First-Party Fraud: In first-party fraud, individuals intentionally provide false information when applying for an account to commit fraud later. This may involve inflating income or providing inaccurate financial details.

5. Third-Party Fraud: A fraudster, often a "money mule," successfully applies for an account using stolen or synthetic identity information. The account is then used to conduct fraudulent activities, such as money laundering or unauthorized purchases.

6. Application Fraud: Application fraud occurs when a fraudster applies for an account using fabricated or stolen identity information. The focus is on successfully passing through the application process without raising suspicion.

7. Phantom Employee Fraud: In business, fraudsters may create fake employee accounts to siphon off funds or take advantage of employee benefits.

8. Credit Card Fraud: Fraudsters may use stolen or synthetic identities to apply for credit cards, often to make unauthorized purchases or obtain cash advances.

9. Loan Fraud: Fraudsters apply for loans using false information, and once approved, they may disappear without repaying the borrowed amount. This is one way to perform loan fraud. 

10. Promotional Abuse: Fraudsters create new accounts to take advantage of promotional offers, discounts, or incentives offered to new customers, with no intention of genuine engagement with the service.

11. Account Creation for Illegal Activities: Fraudsters may open new accounts to engage in illegal activities, such as money laundering, facilitating transactions on the black market, or conducting other illicit financial transactions. This is also known as new account opening fraud.

Businesses and financial institutions must understand different new account fraud types. This is crucial to implement effective prevention measures. It also helps protect against potential financial losses and reputational damage.

How Does New Account Fraud Work?

New Account Fraud operates when fraudsters sign up for services using false identities. This makes detection challenging. It involves three main approaches:

1. Invented Information: Fraudsters create fictional identities with imaginary details, including names and addresses. They may also generate fake email addresses if required for verification.

2. Synthetic Information: This method involves stealing real documents, like IDs, to pass account checks. A fraudster combines a genuine ID with a fake email address. This constitutes synthetic ID fraud, a growing financial crime.

3. Stolen Identity: Fraudsters use another person's identity, gathering information to create a fake identity and open an account. This is common in financial services for unauthorized purchases or loan applications.

Fraudsters attempt to commit new account fraud using various techniques, leveraging similarities between attempts. The success of such fraud depends on financial institutions lacking robust identity verification processes. Once a fraudulent account is established, the fraudster may secure payment cards, often through phishing or dark web purchases. They may then engage in online shopping.

Fraudsters aim to exploit credit accounts and disappear before detection, usually within the first 90 days. The scale of new account fraud has grown significantly, leading to substantial financial losses. Automation, facilitated by bots, is a common strategy for mass account creation. However, human involvement, especially in microwork, adds subtlety and refinement to the fraud. This makes it harder to detect.

Exploring the Step-by-Step Framework of an Account Attack

An account origin attack involves a fraudster signing up for an account belonging to another person. This could be an account at a bank or for a credit card. The step-by-step process includes:

1. Gathering Information: The attacker collects data about the target. They acquire details to create a fake identity.

2. Creating a Fake Identity: Using the gathered information, the fraudster builds a fake identity involving complete identity theft or synthetic identity fraud, where only a portion of the data is used.

3. Finding a Financial Institute: The attacker identifies a financial institution and utilizes the falsified identity to set up a fraudulent account, aiming to verify and activate it.

4. Exploiting the Account: Once the fraudulent account is active, the fraudster exploits its benefits, engaging in malicious activities such as applying for fraudulent loans or making unauthorized purchases.

The financial institution involved is typically legitimate. However, it may collaborate with fraudsters. The attack may employ automated scripts, botnets, or human click farms for mass account creation. Bots enable quick and large-scale account creation, suitable for phishing or content scraping. Human click farms are hired for nuanced tasks like writing fake reviews or testing stolen credit card credentials.

Additional tactics include activating dormant accounts for coordinated attacks like distributed denial-of-service (DDoS) attacks. An account origination attack aims to gain unauthorized access to systems, services, or benefits. 

These are usually offered to legitimate users. New account fraud involves creating an account from scratch. In contrast, account origination involves gathering victim information to build a fake identity for account setup and subsequent criminal activities.

Factors Behind the Surge in New Account Fraud

New account fraud is rising due to the accessibility and affordability of stolen personal data. Tools exist for creating fake accounts in large numbers, and the enterprise can be profitable for fraudsters even if success rates are low. 

For instance, automated bots can generate numerous accounts on social media platforms. They use these accounts to send phishing messages. It can be lucrative if only a few succeed in tricking users into divulging personal information. Fraudulent accounts are also used to scrape personal details from social networks. This can happen for resale or to launch targeted spear-phishing attacks.

Moreover, new account fraud serves various purposes. For example, it takes advantage of promotional items for new customers and entices them to sign up for services. Additionally, it facilitates the application for loans and credit cards. There is no intention of repayment. Fraudulent account registrations come in many forms. These different types of fraud make it hard for companies to fight.

New Account Fraud Prevention: Key Strategies

New account fraud prevention is a proactive approach for banks and financial institutions. It involves thorough identity verification processes and continuous monitoring.

1. Identity Verification Process

Banks employ document checks, KYC, and fraud detection methods during the application process, cross-checking information such as utility bills with a person's driving license. Biometric technologies, like Face ID scans, are increasingly used for added security, as facial details are harder to falsify than traditional documentation.

2. Behavior Monitoring

‍Continuous monitoring of a person's behavior, especially in the initial 30 days of a new account, is crucial. An anti-fraud system can detect and prevent fraud during onboarding by examining factors such as mobile device registration, checking for stolen or previously used devices, and identifying fraud indicators, such as multiple new accounts associated with the same device.

3. Risk-Based Anti-Fraud System

‍Implementing a risk-based anti-fraud system that considers monetary and non-monetary actions, such as changes to an account owner's profile, beneficiary or payee additions, login times, and device registrations across all channels. The system should compare new account holder behavior against a representative pool of customers, analyzing spending patterns, payee profiles, sequences of actions, navigation data, and account owner relations.

4. Comprehensive Data Analysis

‍The risk engine should collect and score data across all digital channels, including user, account, location, device, session, and payee information. Analyzing changes in account holders' personal information and flagging suspicious activity for review allows for active monitoring and investigation when necessary.

5. Close Monitoring of New Users

‍Newly registered users should be closely monitored until a reliable profile and trust level are established. A risk-based fraud detection system can identify unusual changes in user behavior and inactive accounts attempting high-risk transactions. Additionally, the system should analyze each payee and detect potential mule accounts.

6. Utilization of Anti-Fraud Solutions

‍Digital businesses can deploy anti-fraud solutions during customer onboarding to detect and prevent new account fraud. Rigorous monitoring and targeted friction provide long-term protection against fraudulent activities.

By adopting these preventive measures, banks and businesses can enhance their ability to detect and thwart new and bank account fraud. This safeguards their institutions and legitimate customers.

Main Challenges in New Account Fraud Prevention

Preventing new account fraud poses significant challenges. The main challenges revolve around customer friction, exploitability, and operational obstacles.

1. Customer Friction: Implementing rigorous security checks for new customers can create friction, leading to disinterest or abandonment of the application process.
   Reluctance to provide accurate personal identity information hampers building a reliable knowledge base for fraud prevention.

2. Exploitability: Fraudsters often exploit identity theft, relying on stolen legitimate ID documents to bypass security checks. Many fraud prevention methods, particularly those dependent solely on personal identity information (PII), can result in false negatives during onboarding.

3. Operational Obstacles: The methods involved in new account fraud prevention are costly, time-consuming, and challenging to manage. Examples include contracting a fraud management service, implementing and maintaining multi factor authentication (MFA) software, staff training, identity checks on every account assignee, and continuous monitoring for signs of account takeover (ATO).
   This comprehensive framework significantly strains organizational resources, challenging the implementation of fraud prevention tactics.

Top 7 Red Flags of New Account Fraud

New account fraud red flags indicators include the following:

1. Temporary/Disposable Email Addresses: The use of temporary or disposable email addresses, though sometimes used for privacy, is favored by fraudsters and cybercriminals.

2. Virtual SIM/Invalid Phone Number: Invalid or virtual SIM phone numbers can indicate fraud, especially as phone verification becomes more prevalent.

3. Absence of Social Media Profiles: Despite data enrichment possibilities, a lack of social media presence can raise suspicion as legitimate users often have online profiles associated with their phone numbers or email addresses.

4. Suspicious IP Address: Suspicious IP addresses, such as those associated with Tor usage, low-reputation ISPs, or blacklisted IPs, can signal potential fraud.

5. Non-Matching Data: Inconsistencies like a name on a credit card not matching a full name or conflicting information regarding location can be red flags.

6. Emulator/Virtual Machine Usage: Fraudsters use emulators or virtual machines to multiply attempts during new account opening fraud.

7. Previously Seen Device Data: Identical device fingerprints indicating that someone else has already signed up with the same configuration, signaling potential fraud.

Red Flags for New Account Fraud in Financial Institutions

AML Red flags can vary by industry; for example, iGaming operators may scrutinize customer age, e-commerce platforms may verify shipping addresses, and financial institutions may focus on document verification. Below are the top 5 red flags for new account fraud in financial institutions:

1. Inconsistencies in Address Information: There is a mismatch between the address on the application and the address on the provided ID documents, indicating potential fraud.

2. Suspicious Email Addresses: Verification of email information, looking for unconfirmed addresses or identical addresses across multiple new account requests.

3. Older Individuals Without Financial Records: Older individuals initiating account openings without associated financial history, suggesting potential fraud.

4. Deposits of Fraudulent Checks: Scammers artificially boost account balances by depositing fake checks, often followed by quick withdrawals before the fraud is detected.

5. Deposits Before Holidays: Fraudsters strategically time deposits before holidays to extend the window for exploiting fraudulent deposits, necessitating scrutiny around holiday-related transactions.

Most Affected Industries by New Account Fraud

New account fraud can impact various industries. Specific sectors experience a higher prevalence due to the nature of their services and the value associated with customer accounts. Some of the industries most affected by new account fraud include:

1. Financial Services: Financial institutions such as banks and credit unions are prime targets for new account fraud, given the potential for monetary gains through unauthorized transactions, loans, or credit card applications.
   

2. Ecommerce (Online Retailers): Fraudsters may create fake accounts to exploit promotional offers, make unauthorized purchases, or engage in account takeover to access stored payment information.
   

3. Telecommunications and Mobile Service Providers: Fraudsters may open new accounts to obtain mobile devices or services, often using stolen identities.
   

4. Online Gaming and Gambling: The gaming industry faces risks from individuals creating fraudulent accounts to exploit promotions, engage in money laundering, or participate in other illicit activities.
   

5. Healthcare System and Health Insurance Providers: Fraudsters may attempt to open new accounts to fraudulently access healthcare services, prescription drugs, or medical equipment.
   

6. Social Media Platforms: Fraudulent account creation is common for various purposes, including spreading misinformation, engaging in cyberbullying or conducting scams.
   

7. Government Services and Agencies: Fraudsters may attempt to create fake identities for illegal activities, including tax evasion, benefit fraud, or other crimes.

8. Energy and Utility Providers: Fraudulent account creation can occur to exploit services or even facilitate activities like illegal cannabis cultivation or cryptocurrency mining.

9. Insurance Companies:  Fraudsters may open new accounts to submit false insurance claims, engage in premium fraud, or access insurance services illegally.
   

10. Travel and Hospitality: Fraudsters may exploit new accounts for booking services, accumulating loyalty points, or engaging in travel-related fraud.

These industries are especially vulnerable to new account fraud. This is because of the potential financial gains, valuable services offered, and the digital nature of their operations. Organizations in these sectors must implement robust identity verification and fraud prevention measures. It is crucial to mitigate the risks associated with fraudulent account creation.

How FOCAL Helps Combat New Account Fraud

New Account Fraud is increasing. Businesses must adopt proactive measures to safeguard against financial losses and reputational damage. Robust identity verification, continuous monitoring, and anti-fraud technology such as FOCAL Fraud Prevention Platform are essential. This comprehensive approach ensures a resilient defense against the evolving landscape of fraudulent activities in the digital age.

FOCAL enables you to:

1. Proactively identify fraud in real-time using powerful AI and automatically approve, review, or reject events to protect customers.

2. Prevent fraud by automatically verifying the sender's beneficiary information with recipient details in receiving bank records

Conclusion

In conclusion, the fight against new account fraud is a shared responsibility that transcends mere defense – it's a call for collective resilience. This commitment demands not only continuous improvement and innovation but a shared ethos that prioritizes adaptability. By following best practices, businesses and financial institutions can detect and prevent new account fraud, chargeback fraud, bank account fraud, and checking account fraud. 

Embracing technological advancements that automate processes is crucial, but equally vital is fostering a culture of awareness and collaboration. As industries evolve, so must our strategies, forming a united front against the ever-evolving tactics of fraudsters. It's not just about thwarting attacks; it's about creating a fortified digital ecosystem where trust and security prevail. In this ongoing journey, our shared efforts become the cornerstone of a resilient and trustworthy digital landscape.