Brian Stone 0:03
Hello and welcome to The Buzz, a Bank Automation News podcast. My name is Brian stone, and I’m the Associate Editor at Bank automation news. Joining me today is Mike Cook, Vice President of fraud solutions at Socure. Mike discusses the challenges banks face, we’re dealing with synthetic accounts, what a money mule is, and how large of an issue synthetic identities are for financial institutions.Mike Cook 0:28
And, you know, for a little historical historical perspective, it hasn’t been a big issue, right? I mean, synthetic fraud really was attacking cards, phones, right doing bust out doing trend right up to the credit limit, did a lot of different things. Right. But what we’ve seen we did a report recently, in the since COVID, especially synthetic fraudsters has have been attacking DDA accounts. So deposit accounts, savings investments, bank accounts, right. And today, when we do analysis, we do proof of concepts. We do quarterly business reviews, we’re looking always looking at retail banking, we’re looking at FinTech accounts, right. And we’re seeing that one in three accounts are synthetic fraud, right. And that depends, it depends on if the bank or the FinTech is really focused on shutting the front door and keeping synthetics out, then they generally have about 1% synthetics that are live and operating in their accounts, right, performing money, mule activities, doing you know p2p scams, doing money laundering, right, so. So it’s at least 1%. I did see one analysis the other day we did it was about point 8%. So a little bit less, I have seen higher than 3%. of open Active Accounts. So synthetic fraud in deposit accounts now for fintechs. And banks is at its highest is ever been and the ground is really shifted since COVID. Quite a bit.Brian Stone 1:55
So I have a question on something you just mentioned. And I just wanted to give you no context to it. Can you explain what the concept of money mules are and what it is they’re doing? Exactly? Yeah, money.Mike Cook 2:07
Mules are basically you know, a lot of people don’t understand money mules and the money. Mules are simply an account where you can send you know, ill gotten gains, right, and you can send money laundering funds through that account. And then maybe that money will go to another account, maybe go internationally used to go to crypto quite a bit right has this kind of dropped down a little bit. But a money mule is basically an account that is that’s fueling fraudulent money movement, and money. Mules can be synthetic synthetics is a big chunk of that, right? Because in the past, money mules used to be real people. And then they still are. But if you think about it, would you rather manage a person and make sure they do what they’re supposed to do? And maybe give them a skim of the transaction? Or would you rather set up a synthetic identity? If it’s really if it’s pretty easy, right? A lot of you know, banks, fintechs aren’t aren’t protected front door. So if you can set up a synthetic identity to do it that way. It’s easier. So money mules are basically just, you know, an account that set up that you can do some pretty nasty things through and it’s synthetic, it’s account takeover, it’s first party fraud, where the consumer is aware and they’re participating. It’s first its victims. It’s third party fraud. So a lot of times people think money, mules are a certain type of fraud. They’re all kinds of fraud. And it’s just a way to move money through an account.

Brian Stone 3:30
When it comes to synthetic people or synthetic accounts. What are some of the largest challenges banks are facing on their side of things with these synthetic people or accounts?

Mike Cook 3:41
I mean, I think, you know, there’s two answers to that. Right. The first thing here is, is education. And that’s, that’s a big part of it, right? Because I think a lot of banks and fintechs who have deposit accounts, right? They have to do CIP they have to know who their consumer is, right? So they think, Well, if I know who the customer is, I have to be real. Right? And the issue there is they’re not right, so they’re using CIP, right solutions that say, Hey, since name and address from an authoritative source, right? And authoritative source is a lot of times the credit bureau header data, right. And the issue there is, if you want to establish a synthetic account, you establish it at the Bureau. And it’s really easy to do, right. I don’t want to give the recipe for how it’s done. But I mean, it’s very easy. It’s out on the internet. Right. So the biggest issue, I think, is is education. And so the second is ROI. And you know, I work at secure we did a wrote a just a quick blog. I think I put it out about two weeks ago, right? It talks about the math, right? The math behind buying a synthetic fraud solution, and it doesn’t work, right because the issue with a synthetic fraud at a bank. If you’re a good synthetic identity than you’re at a bank or FinTech, you gotta pause recount. You don’t ever want to go bad, you know, quote unquote, he wants to sit there and you want to fly beneath the radar, you want to launder money, right? You want to, you want to do p2p scams, right? Because you don’t want that to tie back to you. But you want that transactional dollars through you. So it’s it’s interesting, right? It’s it’s a it’s a, it’s, it’s, it’s bad math, because when you do the ROI of an ounce of trying to bring on a solution, your average loss is about 250 $300. Right, lifetime loss in the DDA. And so the false positive rate has to be so low, less than one to one, right? That when a bank does their analysis, they generally will come back to you and say, Well, I don’t have the synthetic fraud problem, because it doesn’t look like you can you can solve for it. Right? Because because of the ROI. Now that the CFPB is pushing for banks to own the p2p laws from consumers. And now that the banks and big banks, right if said, we’re going to self regulate and take that p2p loss ourselves, and they’re going to use it as a competitive advantage, rather than saying your average loss is 250. It’s at least 1250. And the reason for that is, you know, you assume one synthetic account does one synthetic activity a year right one p2p scan, that’s $1,000 loss from federal trades numbers from traffic conditions, numbers, right. And so what we’re going to see really quickly is the losses from synthetic fraud double in the period of potentially a year, right, especially if the CFPB, you know, regulates this year or if the bank self regulate. And so a lot of fraud managers, a lot of compliance managers, I want them to wake up in the middle of the night realize, I am not ready for this 2023. Right, because, because if that changes rapidly, you know, fraud losses are going to double within 2023. And I think it’s going to be a huge eye awakening for a lot of people.

Brian Stone 7:13
This is something you sort of mentioned in the last answer. Why is it so hard for banks to identify these synthetic accounts? What makes it so difficult?

Mike Cook 7:26
You know, it’s not it is not difficult to identify it. Right? So, it so so here’s a solution provider, we’re in our third version of the model, right? It took us three versions really to get it right. And so once you do get it right, you understand synthetics, right, you look at how do you create an identity, and you have a huge amount of data like, like secure as right and other other providers. You have the ability to see synthetics pretty pretty easily. And you can stop, right? The issue is I think banks on their own, or fintechs on their own cannot do this on their own their own right, and they rely on their CIP programs. CIP does not stop synthetic fraud. So it really is, I think, I think 2023 is going to be the year where if you do have deposit accounts, and you assume that synthetic didn’t attack you, I think 2023 is going to be the year where they wake up. They say, my CIP solution isn’t solving for this, I cannot solve for this on my own. And I need to go out, test different providers, and pick a synth synthetic solution provider at point of origination and stop it there. And then the next step, and this is something we’ve only been recently pushing when we realized what the CFPB was doing, what the banks might self regulate, how many synthetics are out there, and how they changed the behavior. You know, we realized that a lot of banks should probably do these, what we call portfolio scrubs, and basically say, let’s pull these things out of the financial system, right? Because even if you put something in today, right, you’ll start stopping a good chunk of synthetics the front door, but man, you still got one to 3% or more operating in your system today.

Brian Stone 9:12
What large scale changes need to happen for banks to more frequently, I guess, identified these synthetic accounts and get rid of them. So

Mike Cook 9:21
yeah, so specifically at account origination, you know, they they’re calling out today to the Bureau’s I wouldn’t use a bureau solution for synthetic it’s just, they’re not the best. But they’re they’re calling out today through their API’s. They’re calling out through Pfizer FIS to call on through, you know, they’re large enough, right? Big fintechs big banks are going direct, right? All they need to do is add, you know, if they have a provider, then most of the providers will give it in the same API call. Right? So all you have to do is test contract, start to call, find a threshold that works for you. And put those guys through additional validation at point of Origination. What’s really, really key is that there are two real to two synthetic broad types, right? So it’s not enough to know what synthetic, you need to know it synthetic, fabricated, or synthetic, manipulated, right? And what I mean by that is there, if you’re fabricated, synthetic, it’s, it’s completely made up, right? So she didn’t belong to the name, they end up on a birth, it’s, it’s completely fake, right? Fabricated synthetics in a deposit account are the worst, because those and that’s generally the ones that are attacking the most, because there’s no reason to make up a fabricated synthetic, right? Into DDA. Now, the other kind is synthetic, manipulated, and that’s a consumer who has changed their identity, or maybe an undocumented worker who doesn’t have a social who’s using a randomly selected social or another social, they may have been given, right? So not by the SSA, and they’ll use that so and they’ll establish, you know, a credit report, and then they’ll get through and open up a manipulated, synthetic identity. So, so the bank needs to the simplest thing is that origination call out, pull in the score, find your threshold, if it’s manipulated, you know, get something with a social security number to validate them. If it’s fabricated, and you want to automate it, you can automate it through like a secure doc B solution or another document validation solution where you’re looking at driver’s license, generally, you’ll cast the fabricated that person that way. And then one of the things that we’ve been pushing not just for deposit accounts, but also card and others is, you know, no model is perfect. There’s going to be a marginal score threshold, with that marginal score threshold, take those signals, signals that you acquire at point of origination from your third party solution provider, push those in your account management, and then apply that into your account management because you know, we all know account management scores, high false positive rates, right. This is one way to lower your false positive rates by looking at what did they look at like at origination? Because synthetic is is is unique, right? If it’s synthetic and origination, guess what, 10 years later, it’s still synthetic. So those signals will help you so if you can push those signals forward on the marginal guys, and then integrate that into your account management, analytics that will help you out a bit a lot.

Brian Stone 12:34
You’ve been listening to the buzz, a bank automation news podcast. Please follow us on Twitter and LinkedIn. And as a reminder, you can rate this podcast on your platform of choice, be sure to visit us at Bank automation news.com

Brian Stone 0:03
Hello and welcome to The Buzz, a Bank Automation News podcast. My name is Brian stone, and I’m the Associate Editor at Bank automation news. Joining me today is Mike Cook, Vice President of fraud solutions at Socure. Mike discusses the challenges banks face, we’re dealing with synthetic accounts, what a money mule is, and how large of an issue synthetic identities are for financial institutions.Mike Cook 0:28
And, you know, for a little historical historical perspective, it hasn’t been a big issue, right? I mean, synthetic fraud really was attacking cards, phones, right doing bust out doing trend right up to the credit limit, did a lot of different things. Right. But what we’ve seen we did a report recently, in the since COVID, especially synthetic fraudsters has have been attacking DDA accounts. So deposit accounts, savings investments, bank accounts, right. And today, when we do analysis, we do proof of concepts. We do quarterly business reviews, we’re looking always looking at retail banking, we’re looking at FinTech accounts, right. And we’re seeing that one in three accounts are synthetic fraud, right. And that depends, it depends on if the bank or the FinTech is really focused on shutting the front door and keeping synthetics out, then they generally have about 1% synthetics that are live and operating in their accounts, right, performing money, mule activities, doing you know p2p scams, doing money laundering, right, so. So it’s at least 1%. I did see one analysis the other day we did it was about point 8%. So a little bit less, I have seen higher than 3%. of open Active Accounts. So synthetic fraud in deposit accounts now for fintechs. And banks is at its highest is ever been and the ground is really shifted since COVID. Quite a bit.Brian Stone 1:55
So I have a question on something you just mentioned. And I just wanted to give you no context to it. Can you explain what the concept of money mules are and what it is they’re doing? Exactly? Yeah, money.Mike Cook 2:07
Mules are basically you know, a lot of people don’t understand money mules and the money. Mules are simply an account where you can send you know, ill gotten gains, right, and you can send money laundering funds through that account. And then maybe that money will go to another account, maybe go internationally used to go to crypto quite a bit right has this kind of dropped down a little bit. But a money mule is basically an account that is that’s fueling fraudulent money movement, and money. Mules can be synthetic synthetics is a big chunk of that, right? Because in the past, money mules used to be real people. And then they still are. But if you think about it, would you rather manage a person and make sure they do what they’re supposed to do? And maybe give them a skim of the transaction? Or would you rather set up a synthetic identity? If it’s really if it’s pretty easy, right? A lot of you know, banks, fintechs aren’t aren’t protected front door. So if you can set up a synthetic identity to do it that way. It’s easier. So money mules are basically just, you know, an account that set up that you can do some pretty nasty things through and it’s synthetic, it’s account takeover, it’s first party fraud, where the consumer is aware and they’re participating. It’s first its victims. It’s third party fraud. So a lot of times people think money, mules are a certain type of fraud. They’re all kinds of fraud. And it’s just a way to move money through an account.

Brian Stone 3:30
When it comes to synthetic people or synthetic accounts. What are some of the largest challenges banks are facing on their side of things with these synthetic people or accounts?

Mike Cook 3:41
I mean, I think, you know, there’s two answers to that. Right. The first thing here is, is education. And that’s, that’s a big part of it, right? Because I think a lot of banks and fintechs who have deposit accounts, right? They have to do CIP they have to know who their consumer is, right? So they think, Well, if I know who the customer is, I have to be real. Right? And the issue there is they’re not right, so they’re using CIP, right solutions that say, Hey, since name and address from an authoritative source, right? And authoritative source is a lot of times the credit bureau header data, right. And the issue there is, if you want to establish a synthetic account, you establish it at the Bureau. And it’s really easy to do, right. I don’t want to give the recipe for how it’s done. But I mean, it’s very easy. It’s out on the internet. Right. So the biggest issue, I think, is is education. And so the second is ROI. And you know, I work at secure we did a wrote a just a quick blog. I think I put it out about two weeks ago, right? It talks about the math, right? The math behind buying a synthetic fraud solution, and it doesn’t work, right because the issue with a synthetic fraud at a bank. If you’re a good synthetic identity than you’re at a bank or FinTech, you gotta pause recount. You don’t ever want to go bad, you know, quote unquote, he wants to sit there and you want to fly beneath the radar, you want to launder money, right? You want to, you want to do p2p scams, right? Because you don’t want that to tie back to you. But you want that transactional dollars through you. So it’s it’s interesting, right? It’s it’s a it’s a, it’s, it’s, it’s bad math, because when you do the ROI of an ounce of trying to bring on a solution, your average loss is about 250 $300. Right, lifetime loss in the DDA. And so the false positive rate has to be so low, less than one to one, right? That when a bank does their analysis, they generally will come back to you and say, Well, I don’t have the synthetic fraud problem, because it doesn’t look like you can you can solve for it. Right? Because because of the ROI. Now that the CFPB is pushing for banks to own the p2p laws from consumers. And now that the banks and big banks, right if said, we’re going to self regulate and take that p2p loss ourselves, and they’re going to use it as a competitive advantage, rather than saying your average loss is 250. It’s at least 1250. And the reason for that is, you know, you assume one synthetic account does one synthetic activity a year right one p2p scan, that’s $1,000 loss from federal trades numbers from traffic conditions, numbers, right. And so what we’re going to see really quickly is the losses from synthetic fraud double in the period of potentially a year, right, especially if the CFPB, you know, regulates this year or if the bank self regulate. And so a lot of fraud managers, a lot of compliance managers, I want them to wake up in the middle of the night realize, I am not ready for this 2023. Right, because, because if that changes rapidly, you know, fraud losses are going to double within 2023. And I think it’s going to be a huge eye awakening for a lot of people.

Brian Stone 7:13
This is something you sort of mentioned in the last answer. Why is it so hard for banks to identify these synthetic accounts? What makes it so difficult?

Mike Cook 7:26
You know, it’s not it is not difficult to identify it. Right? So, it so so here’s a solution provider, we’re in our third version of the model, right? It took us three versions really to get it right. And so once you do get it right, you understand synthetics, right, you look at how do you create an identity, and you have a huge amount of data like, like secure as right and other other providers. You have the ability to see synthetics pretty pretty easily. And you can stop, right? The issue is I think banks on their own, or fintechs on their own cannot do this on their own their own right, and they rely on their CIP programs. CIP does not stop synthetic fraud. So it really is, I think, I think 2023 is going to be the year where if you do have deposit accounts, and you assume that synthetic didn’t attack you, I think 2023 is going to be the year where they wake up. They say, my CIP solution isn’t solving for this, I cannot solve for this on my own. And I need to go out, test different providers, and pick a synth synthetic solution provider at point of origination and stop it there. And then the next step, and this is something we’ve only been recently pushing when we realized what the CFPB was doing, what the banks might self regulate, how many synthetics are out there, and how they changed the behavior. You know, we realized that a lot of banks should probably do these, what we call portfolio scrubs, and basically say, let’s pull these things out of the financial system, right? Because even if you put something in today, right, you’ll start stopping a good chunk of synthetics the front door, but man, you still got one to 3% or more operating in your system today.

Brian Stone 9:12
What large scale changes need to happen for banks to more frequently, I guess, identified these synthetic accounts and get rid of them. So

Mike Cook 9:21
yeah, so specifically at account origination, you know, they they’re calling out today to the Bureau’s I wouldn’t use a bureau solution for synthetic it’s just, they’re not the best. But they’re they’re calling out today through their API’s. They’re calling out through Pfizer FIS to call on through, you know, they’re large enough, right? Big fintechs big banks are going direct, right? All they need to do is add, you know, if they have a provider, then most of the providers will give it in the same API call. Right? So all you have to do is test contract, start to call, find a threshold that works for you. And put those guys through additional validation at point of Origination. What’s really, really key is that there are two real to two synthetic broad types, right? So it’s not enough to know what synthetic, you need to know it synthetic, fabricated, or synthetic, manipulated, right? And what I mean by that is there, if you’re fabricated, synthetic, it’s, it’s completely made up, right? So she didn’t belong to the name, they end up on a birth, it’s, it’s completely fake, right? Fabricated synthetics in a deposit account are the worst, because those and that’s generally the ones that are attacking the most, because there’s no reason to make up a fabricated synthetic, right? Into DDA. Now, the other kind is synthetic, manipulated, and that’s a consumer who has changed their identity, or maybe an undocumented worker who doesn’t have a social who’s using a randomly selected social or another social, they may have been given, right? So not by the SSA, and they’ll use that so and they’ll establish, you know, a credit report, and then they’ll get through and open up a manipulated, synthetic identity. So, so the bank needs to the simplest thing is that origination call out, pull in the score, find your threshold, if it’s manipulated, you know, get something with a social security number to validate them. If it’s fabricated, and you want to automate it, you can automate it through like a secure doc B solution or another document validation solution where you’re looking at driver’s license, generally, you’ll cast the fabricated that person that way. And then one of the things that we’ve been pushing not just for deposit accounts, but also card and others is, you know, no model is perfect. There’s going to be a marginal score threshold, with that marginal score threshold, take those signals, signals that you acquire at point of origination from your third party solution provider, push those in your account management, and then apply that into your account management because you know, we all know account management scores, high false positive rates, right. This is one way to lower your false positive rates by looking at what did they look at like at origination? Because synthetic is is is unique, right? If it’s synthetic and origination, guess what, 10 years later, it’s still synthetic. So those signals will help you so if you can push those signals forward on the marginal guys, and then integrate that into your account management, analytics that will help you out a bit a lot.

Brian Stone 12:34
You’ve been listening to the buzz, a bank automation news podcast. Please follow us on Twitter and LinkedIn. And as a reminder, you can rate this podcast on your platform of choice, be sure to visit us at Bank automation news.com