New Articles

SentiLink Shares What Businesses Should Know About Synthetic Fraud in Exclusive Q&A

synthetic fraud

SentiLink Shares What Businesses Should Know About Synthetic Fraud in Exclusive Q&A

In the following Q&A, we learn all things synthetic fraud, from risk mitigation to what businesses can do now to effectively combat this new challenge for global businesses.

What is synthetic fraud and how does it differ from fraud?

Synthetic fraud is a type of fraud where a falsified or manipulated identity is used to open consumer and business financial services accounts. It’s very different from ID theft because there’s no victim that comes forward to claim their identity has been stolen. As a result, synthetic identities go undetected for years. So, not only does synthetic fraud cost banks and lenders billions of dollars a year in losses, but these identities facilitate all sorts of criminal activities.

How is Sentilink revealing the risks of synthetic fraud (Through a report, through research, through other means)?

SentiLink offers several solutions that credit unions prevent synthetic fraud.

Synthetic Scores: SentiLink’s Synthetic Scores product indicates the likelihood that an identity is synthetic. Synthetic Scores are made available to clients via API or a user-friendly Dashboard.

Manifest – Manifest is the identity data leveraged by the machine learning algorithm that generates SentiLink’s Synthetic Scores. This dataset includes information from the credit bureau, utility records, the death master file, as well as phone and email data.  SentiLink enriches this identity data and makes it available in the Manifest product via API and the Dashboard. Clients can incorporate Manifest in their proprietary models or utilize the data to investigate individual cases via the Dashboard.

eCBSV – For the first time ever, it’s possible to validate Social Security numbers with the Social Security Administration’s database of SSNs in real-time using eCBSV. With applicant consent, financial institutions can send their applicants’ names, dates of birth, and SSNs to SentiLink via API and receive a match or no-match response within milliseconds. This service enables lenders who have historically required SSA-89 forms, such as mortgage lenders, to shave days off the loan origination process.

Why is synthetic fraud more of a risk to credit unions rather than to other establishments? 

To be clear, synthetic fraud is a risk to all financial institutions. But, some credit unions may think that the membership requirements to join are a deterrent to synthetic fraud. But, we’ve seen that fraudsters are able to become members and get loans from credit unions.

What could credit unions be doing that would help them lessen the risk of synthetic fraud?

There are several things credit unions can do:

Education is the first step. The Federal Reserve wrote 3 white papers on synthetic fraud that are very informative.

Pay special attention to the Social Security number of applicants applying. If the SSN was issued in a state where the applicant doesn’t have address history, this is a potential red flag. If the SSN was issued in a year that’s different than the date of birth, this is a potential red flag. It doesn’t necessarily mean a synthetic identity is being used to apply, but these are scenarios that potentially warrant additional verification. Validating the SSN using an SSA-89 form or eCBSV is a smart approach.

Labeling losses according to the type of fraud is also important. Knowing whether a loss was due to ID theft, synthetic fraud, and other types of fraud will enable a credit union to measure losses due to each type of fraud and learn how to recognize similar identities when they apply.

What are the 7 synthetic identities and how does it work/identify?

Perhaps I should clarify the statement, “1 in 7 synthetic identities has a credit line from a credit union.” SentiLink has tagged over 100,000 synthetic identities. We have a subset of these identities where we can see what financial institutions gave these fake consumers a loan. Our analysis showed that 1 in 7 of these synthetic identities had a loan from a credit union. The point we were trying to make is that credit unions are at risk for synthetic fraud just like other banks, fintechs, and lenders.

What do you mean by “tradeline from a credit union with balances 2/5X higher?

We looked at the loan size that credit unions issued to these synthetic identities and compared them to the loan size that they gave to non-synthetic identities and found that the balances issued to synthetic identities were significantly higher. So, the credit unions lost a lot more money when issuing loans to synthetic identities. This is another reason why credit unions should work to identify synthetic identities before they become members, so they don’t experience these losses.

What are the risks to a credit union in regard to synthetic fraud?

The risks are losses and compliance. As mentioned above, synthetic identities cause significant losses to financial institutions. But, there is also the regulatory requirement to Know Your Customer. KYC solutions can’t detect synthetic identities, and as regulators become more aware of this issue, their expectations around what constitutes appropriate KYC measures is likely to change. If credit unions are issuing loans to synthetic identities, they aren’t conducting appropriate due diligence to know their customer. Their ability to comply with KYC requirements will suffer if they don’t address synthetic fraud.

What are the warning signs that credit unions should pay attention to?

Certainly, upticks in losses can be a sign of increased synthetic fraud. But, also things like the same address being used frequently to apply for loans can be a sign that a group of fraudsters is attacking a credit union.

What do you see as the future of credit unions in relation to this type of fraud?

Synthetic fraud is going to be an issue for credit unions for the foreseeable future. Unlike id theft where fraudsters steal an identity and have to quickly take out a loan, take the money and move on, synthetic identities can be used over and over again for a very long period of time. And, synthetic identities are easy to create so it’s something credit unions are going to have to learn about in order to detect and stop them from impacting their business.

__________________________________________________________________

Sarah Hoisington is head of Marketing at SentiLink, a fraud protection tech firm helping financial institutions and government agencies.

PPP

Synthetic Identity Fraud in PPP Loans

Most banks and lenders are well aware of how synthetic identities can be used to fraudulently open a bank account and secure a credit card or other type of loan. According to McKinsey, synthetic identity theft is the fastest-growing type of financial crime in the U.S., accounting for 10–15% charge offs in a typical unsecured lending portfolio.

The U.S. government now has synthetic identities on their radar thanks to the Paycheck Protection Program (PPP). Many manipulated and fabricated identities were used to apply for these government loans in 2020.

The amount of fraud executed through the PPP program is still being tallied but there have been notable pending cases that show synthetic identities were used.

There are many factors that enabled fraudsters to take advantage of PPP loans including the speed of issuance, loosened credit criteria, and financial rewards for all involved with little downside risk. Below is a discussion of the evolution of the PPP and the elements that contributed to fraud.

PPP — How Did We Get Here?

When the U.S. economy largely shut down as a result of responses to COVID-19, the government put programs in place to help small businesses weather a major turndown. Nearly half of the U.S. workforce is employed by a small business. Helping these companies continue to pay workers was critical to maintaining a viable economy.

The Coronavirus Aid, Relief, and Economic Security (CARES) Act was passed on March 27th, 2020. This over $2 trillion economic relief package was intended to protect Americans from the public health and economic impacts of COVID-19.

The PPP was established by the CARES Act and was implemented by the Small Business Administration with support from the Department of the Treasury. This program provided small businesses with funds to pay up to 8 weeks of payroll costs. Funds could also be used to pay interest on mortgages, rent, and utilities. The PPP, specifically, was authorized to fund up to $659 billion of these small business expenses.

Faced with having to distribute over half a trillion dollars within a few short months, the SBA enlisted the help of banks and lenders. The private sector was also tasked with the vetting and funding of applications, a process which the Treasury Department encouraged lenders to complete in as little as a day.

Getting money into the hands of small businesses quickly was vitally important. Claims for unemployment benefits catapulted to over 3 million the week of March 21st from a weekly average of 200,000 for months prior.

To facilitate rapid distribution, the stringent requirements to qualify for funding established at the beginning of the program were relaxed over time. For example, the need to verify an applicant’s tax records and payroll documentation was eliminated.

The huge loan sizes (up to $10M per loan) combined with urgency and relaxed standards drew the attention of fraudsters. “Any time you have large amounts of federal aid available, it’s going to bring out all the bad guys,” said Kathryn Petralia, co-founder and the president of Kabbage, an online lender that handled 297,000 loans for the program.

The PPP ended August 8th and by then, $525B had been distributed to over 5M businesses by nearly 5500 banks and lenders.

PPP — Revenue Boost For Banks & Lenders

Those who were approved by the SBA to administer funds were well rewarded, and there was no penalty for issuing loans to fraudulent entities. Banks and lenders were paid fees for each loan issued plus 1% interest on PPP loans they held that weren’t forgiven. Many banks could earn as much from the PPP loans as they reported in net revenue for all of 2019, according to analysis from S&P Global Market Intelligence.

Below is a sampling of the fees estimated to be earned by some of the largest banks involved in issuing PPP loans.

In pursuit of these fees, lenders were incentivized to fund as many loans as possible. Given the competition for funding loans, those that had the least friction got most of the applications — and likely most of the fraud.

PPP and Fraud—Stay Tuned

While millions of small businesses were helped by the PPP program, work is ongoing to figure out how much money may have been disbursed to fraudulent accounts.

Anecdotal evidence suggests a significant amount of money was issued to illegitimate applicants:

-The Small Business Administration’s fraud hotline, which received fewer than 800 calls last year, has already had 42,000 reports about coronavirus-related fraud.

-The Justice Department has made at least 41 criminal complaints in federal court against nearly 60 people, who collectively took $62 million from PPP by using what law enforcement officials said were forged documents, stolen identities, and false certifications.

-The Treasury Secretary, Steven Mnuchin, said the Treasury Department would review every loan over $2MM to determine if funds were disbursed fraudulently.

While the work above addresses funds already disbursed, the real story will likely emerge as small businesses apply for forgiveness. In order to get PPP loans forgiven, small business owners have to show proof that at least 60% of the money was used for payroll and the rest for other permitted expenses. Falsifying these records will result in hefty penalties. However, fraudsters with malicious intent have presumably already taken their PPP money, and are unlikely to apply for forgiveness, leaving the SBA responsible for reimbursing banks.

To be clear, a wide variety of fraud schemes were likely pursued to secure PPP funding. The most grievous method was to create fictitious businesses, proprietors, and employees to effectively steal U.S. taxpayer money. The less black and white forms of fraud include companies that spent the funds on non-compliant expenses and companies that leveraged organizational structures to obtain more funding.

The fact that synthetic identities were created to steal PPP dollars demonstrates the pervasiveness of this type of fraud. Synthetic identities have infiltrated financial services and are clearly being used to take advantage of government programs. This type of fraud is not bound by any vertical or medium. Any product or service that requires identity verification is potentially susceptible to synthetic identity fraud.

______________________________________________________________

Sarah Hoisington is head of Marketing at SentiLink, a fraud protection tech firm helping financial institutions and government agencies.

pandemic

Small Business Optimism Persists, Despite the Pandemic

Businesses and consumers alike are finding ways to adapt and stay resilient during these unprecedented times. Though recovery may take time, a new report confirms the strength of entrepreneurialism and grit of small business owners, who remain optimistic that their businesses will overcome any present and future obstacle with the right resources and preparedness.

In the inaugural American Express Entrepreneurial Spirit Trendex, the study, which polled 1,000 small and mid-sized businesses, revealed notable insights about the entrepreneurial spirit in the United States. Even amidst the pandemic, the survey showed 75% of small business owners are optimistic about their business’s recovery and 82% feel that they are better prepared to handle a future crisis.

They continue to believe in their business and pursuing what they love. Of those surveyed, 81% believe the benefits of owning their own business outweigh the challenges, including financial stability, being their own boss, turning their passion project into a business, and flexibility to set their own hours. The study uncovered more insights showing the current mindset of small businesses.

Small Businesses are Actively Seeking Advice

In order to successfully navigate these unprecedented times, business owners are searching for resources that can properly aid them. Businesses are actively seeking virtual business conferences and webinars (47%), virtual networking events (44%), advice and resources about leading through a crisis (44%) and learning ways to de-stress and stay mindful (42%).

Cash Flow is Top of Mind

No surprise during an economic crisis, over 81% of business owners are prioritizing cash flow management and are identifying ways to cut back spending and increase sales, namely by moving services online. The survey found the top activities are:

-Increasing marketing efforts (41%)

-Increasing products/services online (40%)

-Cutting expenses (36%)

-Diversifying revenue streams (35%)

Pivot, then Repeat

It would be difficult to find a small business that didn’t need to adapt its operations in some form due to the pandemic. It was the year of pivots for so many, and the survey finds the trend will continue into next year. According to the data, 76% of business owners have pivoted or are in the process of pivoting their business model to maintain revenue, and among those that already pivoted, 73% expect to pivot again in the next year. Staying nimble to meet the demand of new market needs and demands is crucial to maintaining the health of your business, whether there is a pandemic or not.

This year has undoubtedly taken a toll on so many small businesses, yet the data shows the entrepreneurial spirit remains strong with a drive to push onward, improve, and succeed. The full report from American Express is available here as well as more ways we can support small businesses this holiday season and into next year.

 ________________________________________________________________

Kathryn Petralia is the President and Co-Founder of Kabbage, an American Express Company providing small businesses cash flow solutions.

safe harbor

SBA Extends Safe Harbor Deadline to May 14, 2020 and Confirms that Foreign Affiliate Employees Must be Counted for Size Purposes

Late on May 5, 2020 the Small Business Administration (SBA) issued another round of Frequently Asked Questions (FAQs) that extended the Safe Harbor Deadline to return Paycheck Protection Program (PPP) loan funds from May 7, 2020 to May 14, 2020. Significantly, the SBA also confirmed that its rules regarding foreign affiliates are applied to PPP applicants in the same manner as its other programs. Loan applicants should closely review the most updated version of the SBA’s FAQs and talk to their counsel about the best way to proceed.

Safe Harbor Extended from May 7, 2020 to May 14, 2020

As discussed in a previously, on April 23, 2020 (20 days after applications could first be submitted for PPP loans), the SBA issued FAQ 31 that significantly increased the requirements surrounding an applicant’s certification that “current economic uncertainty makes this loan request necessary to support the ongoing operations of the Applicant.” In the strongly worded FAQ 31, the SBA stated that “[b]orrowers must make this certification in good
faith, taking into account their current business activity and their ability to access other sources of liquidity sufficient to support their ongoing operations in a manner that is not significantly detrimental to the business.” Unfortunately, as of the date of this alert, neither the Department of Treasury (Treasury) nor the SBA have issued any further guidance beyond the above sentence to confirm how applicants actually make this determination. On April 28, 2020, the SBA also confirmed that FAQ 31 equally applies to both public and private companies.

In addition to issuing FAQ 31, the SBA also issued an initial Safe Harbor Deadline of May 7, 2020 to return PPP loans. This May 7, 2020 Safe Harbor Deadline has now been extended to May 14, 2020. Under FAQ 43 that was issued on May 5, the SBA and Treasury are allowing borrowers to return PPP loan funds by May 14, 2020. For those borrowers that return funds by May 14, the SBA and Treasury have confirmed that they will deem the certification regarding “need” to have been made in good faith. The SBA also has confirmed that it intends to issue additional guidance on how it will review the “need” certification before May 14, 2020.

While the SBA’s recent guidance does not specifically reference any eligibility certifications outside of the “necessity” for the loan, a borrower knowing that it has a separate eligibility issue should seek counsel about addressing that issue before the extended deadline of May 14, 2020.

Frustration and confusion abound since the issuance of FAQ 31 and FAQ 37. There are several questions that Treasury has not adequately answered. Until further guidance is issued, applicants are faced with a difficult choice of keeping funds with the risk that the government may later hold the unclear guidance against them, or refuse the funds and accept the impacts that go along with that, including a possible reduction of employees.

Applicants across the country have been raising these complaints, and Treasury has at least initially responded by extending the deadline to May 14, 2020. We hope that Treasury will also soon issue additional FAQs or rules to confirm the parameters for which businesses can in good faith certify the need for a PPP loan.

Borrowers Must Count Employees of Foreign Affiliates When Determining Eligibility for a PPP Loan

The SBA also issued FAQ 44 on May 5, which confirms that borrowers must count both foreign and domestic affiliates when determining eligibility for PPP loans. FAQ 44 has significant impacts on businesses which applied for PPP loans without counting the employees of foreign affiliates.

As a reminder, SBA’s regulations confirm that “[c]oncerns and entities are affiliates of each other when one controls or has the power to control the other, or a third party or parties controls or has the power to control both.” 13 C.F.R. § 121.301(f) (February 5, 2020). The PPP Loan Affiliation Rules describe how the SBA determines affiliation for PPP loans.

SBA’s rules for determining size have long required participants in SBA’s programs to count both foreign and domestic affiliates. See 13 CFR §§ 121.103(a)(6), 104(a), 106(b)(1), and 301(f)(6) (confirming that both foreign and domestic affiliates should be considered for size purposes).

However, when the SBA issued the PPP Loan Affiliation Rules, it did not include the pre-March 11, 2020 version of 13 C.F.R. § 121.301(f)(6)1, which confirms that foreign affiliates should be counted. The PPP Loan Affiliation Rules do not reference Section (f)(6). The Interim Final Rule first issued on April 2, 2020 and SBA’s FAQ 3 also states that borrowers are eligible for a PPP loan “if the business has 500 or fewer employees whose principal place of residence is in the United States,” or meets other criteria.

The use of the term “principal place of residence in the United States” in the Interim Final Rule and SBA’s FAQs created confusion about whether employees of foreign affiliates actually needed to be counted for PPP loan eligibility. For those who have long worked with SBA’s rules, it seemed that not counting foreign affiliates would be a significant change from SBA’s past implementation of its regulations, but the clear language in the above sources made it reasonable to openly consider that question to determine if the SBA was handling the PPP loan program differently.

On May 5, the SBA confirmed that PPP loans are consistent with its other programs and borrowers must count foreign affiliates when considering size:

For purposes of the PPP’s 500 or fewer employee size standard, an applicant must count all of its employees and the employees of its U.S. and foreign affiliates, absent a waiver of or an exception to the
affiliation rules. 13 C.F.R. 121.301(f)(6). Business concerns seeking to qualify as a “small business concern” under section 3 of the Small Business Act (15 U.S.C. 632) on the basis of the employee-based size standard must do the same.

See FAQ 44.

Businesses which have already applied and know that foreign affiliates would cause them to exceed the relevant size standard should discuss this with their counsel to closely evaluate next steps on how to proceed. It would be wise to consider and address this before the May 14, 2020 Safe Harbor Deadline.

For specific guidance on this issue, please contact Josh Mullen, John  Scannapieco, or Jeff Wagner. For more information and general guidance on how to address other legal issues related to COVID-19, please visit the Coronavirus (COVID-19): What You Need to Know information page on our website.