May 2023 Summaries

Discussions at the Marketplace Risk Management conference highlighted that emerging marketplace businesses often face difficulties obtaining insurance because of risks involving contractors, merchants, sellers, and customers, although insurers and brokers are increasingly developing specialized coverage. A central concern was the widespread assumption that KYC checks prevent fraud, despite their primary role in validating identity details rather than detecting fraud risk. An interactive synthetic-identity demonstration showed how fraudsters can combine manipulated personal data, credit history, addresses, contact information, and forged documents to evade common identity, document, and background checks; separate tests suggested that well-developed synthetic identities can also pass online criminal-background screenings that rely on credit-header and public data. Synthetic identities can enable policy abuse, repeat access after platform bans, fake reviews, money laundering, and concealment of disqualifying criminal histories. The account argues that marketplaces need fraud-specific analytics, robust document validation, and ongoing monitoring of changing identity attributes, both to limit losses and to improve their broader risk-management and insurance prospects.

Government agencies face growing challenges in verifying citizens’ identities online while preventing sophisticated fraud, as fragmented systems, widespread exposure of personal data, and legacy knowledge-based verification methods have contributed to major losses in programs such as pandemic relief and unemployment assistance. Webinar speakers Deborah Snyder, Jeremy Grant, and Matt Thompson characterized digital identity as essential public infrastructure, distinguishing initial identity proofing from later authentication and arguing that fraud networks and hostile actors now routinely defeat outdated verification approaches. They emphasized that agencies should combine identity proofing with continuously evolving fraud detection, shared risk signals across organizations, and layered verification tools that use data, document checks, AI, and machine learning. The discussion also stressed that stronger security must not create excessive barriers for legitimate applicants, highlighting an example involving Florida’s housing assistance program, where passive risk-based methods reportedly verified most applicants in under a second and document verification helped resolve remaining cases in under three minutes.

A potential shift in liability for consumer losses from romance, imposter, and other social-engineering scams could place greater financial responsibility on banks and fintechs, particularly institutions holding receiving accounts for P2P transfers. Policymakers and the CFPB have advocated such changes since 2022, while Zelle and its bank owners have begun developing reimbursement practices for certain scam payments, a move that could influence other payment networks. Financial institutions report growing concern about fraud involving receiving accounts, first- and second-party fraud, and synthetic identities used as money mules, with Socure estimating that 1% to more than 4% of active deposit accounts at some institutions may involve synthetic identities. The company argues that institutions should prepare through stronger identity verification at account opening, portfolio reviews to identify compromised or fraudulent accounts, updated customer data and KYC checks, and real-time assessment of P2P credentials such as email addresses and phone numbers. Socure presents its fraud scoring, portfolio-scrubbing, and credential-risk tools as methods to reduce exposure to money mule activity and emerging counterparty risk as liability rules evolve.

Socure reports a rising fraud pattern, termed Clean True Name ID Theft, in which criminals use stolen but authentic personal information to open accounts that pass standard onboarding checks, then quickly alter contact details such as phone numbers, email addresses, or addresses through the least restrictive channel. Although these cases can resemble account takeover because changes occur after account opening, Socure argues they should be distinguished to avoid weakening fraud models and misclassifying risk. Indicators include replacement of legitimate phone numbers with VoIP numbers, distant IP geolocation, and subtly altered email addresses, while changes often occur within days but may be delayed for months. Socure recommends that banks apply risk assessments and ownership verification to non-monetary account changes, including validation of email, phone, and address updates, using predictive signals and stronger post-origination controls to reduce financial losses and consumer harm.

Socure announced that Matt Thompson, its SVP and GM of Public Sector, has been named to the StateScoop 50 for Industry Leadership, an annual recognition for contributions to public good through government IT. Over the past 18 months, Thompson has supported Socure’s expansion in the public sector by promoting identity verification and fraud prevention systems intended to improve equitable access to government services. A decorated Army Special Operations veteran with experience at organizations including McKinsey, Goldman Sachs, Capital One, and IDEMIA, Thompson also leads the board of the Kantara Initiative, which advances standards for trustworthy digital identity and personal data use. Socure says its predictive analytics platform, previously adopted by major banks and fintechs, now provides identity verification services to state agencies in California, New York, and Florida, with additional state and federal agency work anticipated.