Synthetic identity fraud has been a growing a problem for years. IBM Red Cell has been writing about this threat and its implications for the last 18 months.

Cybercrime Enters the Auto Industry

Organized crime groups (OCGs) leverage synthetic identities to commit various fraud schemes. Vehicle buy-and-ship schemes use synthetic identities to finance purchases from new and used car dealers, which allows OCGs to reap huge financial gains with little to no risk. The Wall Street Journal proclaimed synthetic identities as one of the top three risks facing financial institutions in 2016.

Auto finance fraud is not a new phenomenon; OCGs have successfully stolen vehicles using straw buyers and identity theft for years. In the past, OCGs would target individuals to lend their Social Security numbers and credit ratings to act as straw buyers for new and used cars. Often, the straw buyer would claim identity theft for the purchase of the vehicle after it was shipped out of the country.

From the criminal’s point of view, a straw buyer leaves a potential trace or connection. The beauty of synthetic identities is that there is no one behind that identity to question or to track — the synthetic identity is a ghost. In essence, OCGs are able to eliminate the middleman and interact with the dealer directly.

The Auto Fraud Process

Identity Procurement

Synthetic identities are created using real and fictitious data to form an identity that, for all intents and purposes, looks legitimate. Synthetic identities can be created by the OCG or purchased in Dark Web marketplaces. IBM Red Cell has written extensively about how synthetic identities are created and co-wrote a white paper with Turnkey Risk Solutions concerning the evolution and implications associated with them.

Vehicle Purchase

OCGs are able to exploit weaknesses in credit reporting to use a synthetic ID to acquire financing for the purchase of vehicles at multiple dealers throughout the same day. A fraudster using a synthetic ID can go from dealer to dealer in one day and apply for credit without each dealer knowing about previous or same-day inquiries.

Often, communication with the dealer and the purchase of the vehicle will take place over the Internet. Fraudsters commonly exploit technology and conveniences designed to enhance the customer experience to further their criminal schemes. An increasingly large percentage of consumers prefer to shop for vehicles via the Internet to avoid the unpleasantness of interacting with the dealer in person. This newer and acceptable way of buying autos makes it easier for fraudsters to successfully carry out the scheme.

Upon purchase completion, the fraudster will often have the vehicle shipped to a location, sometimes directly to a port, where the vehicle will be signed for. While some dealerships now require the buyer to take possession of the car in person at the dealership, this is a small hurdle that can be easily overcome with fraudulent identification documents.

Vehicle Shipment

Vehicles are shipped overseas to various countries, with China being a popular destination; certain autos can fetch a price that is three times the value of the car in the U.S. The shipment expense is paid for with a credit card tied to the synthetic ID. Thus, an OCG is able to obtain a vehicle (often a luxury car or SUV) with little or no cost involved.

Identifying Fraud and Synthetic Identities

Auto manufacturers and dealers across the U.S. have begun to recognize synthetic identities as a substantial threat. They realize that a significant portion of their credit losses may come from fraud schemes.

While they recognize this as a problem, they are struggling to identify an effective solution. Because synthetic identities look and act like any other customer, identification is extremely challenging.

Many people point to national credit bureaus to solve the problem, but they, too, have been struggling with the synthetic ID issue. It is important to understand that credit bureaus are data aggregators, not data validators. However, credit bureaus may be a key factor in solving or reducing the problem because of the vast amount of data they hold.

Additionally, there are controls that may be added to the underwriting and financing process to limit the issue. Those controls would likely come at the expense of the customer experience, which could potentially hurt sales overall. The ultimate answer will come from input and potential changes to the process in addition to technology solutions.

More from Fraud Protection

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Remote access detection in 2023: Unmasking invisible fraud

3 min read - In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud. Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat. Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis. A rising threat As Fraud detection methods become more and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today