Getty / South_Agency
It started out like any other online loan.
Notre Dame Federal Credit Union reviewed the application. It did the necessary background checks, and authenticated the applicant’s credit score and background. But it wasn’t until a group of borrowers in Missouri abruptly stopped making payments that the South Bend, Indiana-based lender smelled trouble.
“These looked like bona fide real people — but when you pulled all of them together, especially out of the specific geographic area, red flags and alarm bells started going off,” said Brian Vitale, chief risk and compliance officer at Notre Dame Federal Credit Union. “We finally identified that these people didn’t exist. Unfortunately by that time, we were out $200,000.”
What the firm learned in hindsight was that the “people” applying for loans never existed. The credit union was a victim of “synthetic identity fraud.” Instead of stealing another person’s identity, a fraudster invents an entirely new, fake person and applies for anything from auto loans to credit cards.
The Indiana credit union is not the only victim. Boston-based Aite Group estimates this type of fraud costs U.S. lenders between $10,000 to $15,000 per incident. One estimate from Auriemma Insights puts the losses at $6 billion annually. This is the fastest-growing financial crime, according to the Federal Reserve, driven in part by lending moving online.
The rise of “Frankenstein” fraud
To fool lenders, fraudsters pick a random social security number, or buy one on the dark web. They will often look for one that was issued to someone younger than 18 years old — ensuring that person doesn’t have credit history. They then link a fake name, date of birth, and in some cases social media accounts. They start applying for credit and building up a FICO score, which in some cases takes years.
“It’s a really long con and an expensive one,” Naftali Harris, co-founder and CEO of San Francisco-based start-up SentiLink, told CNBC. “But once you have this fake person who has an 800 credit score, you can then use that to get multiple high limit credit cards and unsecured loans from banks.”
Credit bureaus link FICO scores to multiple factors — address, name, date of birth — as well as social security number. Harris said it’s common for a social security number to be linked to multiple names, because of human error or a name change. As a result, banks often ignore the “flag” that goes up.
SentiLink uses data to help customers, including three of the top ten U.S. banks, to determine if a borrower is real or using a fake identity. Harris was a data scientist at Affirm, which was started by PayPal founder Max Levchin. Levchin is now backing the company