ID Analytics Inc. wants to make sure banks know when a fraudster has taken over an account and is trying to go wild with card payments or money transfers.
"Instead of focusing on a particular point of attack, we look at the overall picture of the account activity," says Garient Evans, director of identity solutions for the San Diego, Calif.-based consumer risk assessment company.
ID Analytics' recently upgraded account takeover software, called ID Score Account ATO, hooks into the company's real-time cross-industry identity network. The software allows ID Analytics to spot a problem even if it first appears as a routine change of address request from a customer.
"If a fraudster pretending to be an account holder changes his address from Chicago to San Diego, we may find that there are 50 different people at that address, and it has been associated with fraud in the past," Evans says.
"We know the bad addresses, Social Security numbers and phone numbers," he adds.
ID Analytics helps banks and other institutions determine if account activity could potentially be fraudulent by monitoring names, addresses, Social Security numbers, e-mails and other differentiators.
"We look at a sequence of events and screen for patterns that we know to be suspicious," Evans says.
The process is particularly effective in sniffing out family or friendly fraud, such as when a child logs into a parent's account with the intent to steal money or use payment cards to make purchases, Evans says.
The child could request that no more paper statements be sent to the home and request only electronic statements, but change the e-mail address to his own, Evans says. In this way, a child could steal $10,000 without his parents knowing it.
"There is no malware or man-in-the-middle in a case like that, but the activity in the account needs to be scrutinized for suspicious patterns," Evans adds.
Banks appreciate any service that helps detect friendly fraud, says Julie Conroy, senior analyst and fraud expert with Boston-based Aite Group.
"ID Analytics has the ability to really draw connections on the potential for fraud, and that's a hard thing for the banks to do on their own," Conroy says.
Banks realize friendly fraud is a major issue, but have a hard time quantifying it because the activity looks like the real account holder performing the tasks, Conroy says.
"A lot of those instances end up as charge-offs," she adds.
Account takeover detection most often starts with a customer complaint to the bank, but in some cases banks alert the customer first by sending texts or e-mails to confirm requests taking place for changes to the account, Evans says.
Fraudsters committing "recreational" fraud, or the type that occurs because of opportunity or certain circumstances, are fairly easy to catch, Evans says. But it takes more effort and technology to weed out professional fraudsters using more sophisticated methods by creating fake social media identities, or using advanced technology to constantly change addresses and other identifiable records, he says.
"Usually, the professionals can change many elements, but they ask that the banks use one identity for verification purposes," Evans says. "We are pretty good at figuring that out."
Banks use a Web interface to send account activity information as XML-coded requests to ID Analytics either in real time or in nightly batches. ID Analytics then sends risk assessment scores to the client through the same Web interface, Evans says.
Time frames for sniffing out account takeovers that affect payment cards vary by the type of issuer, Evans says.
Real-time detection is critical for retail payment card settings because a fraudster can add an authorized user name to a card right in the store, Evans says. Then, 10 minutes later, that newly authorized person comes into a store and buys an expensive new TV, Evans says.
However, when a bank is issuing its branded card, it may have a lag time of several days before mailing the new card, Evans says. "If some activity is suspicious in the account, they can review that over a period of time," he adds.
ID Analytics benefits from having data to compare from financial services, telecommunications, e-commerce, government and other industries, Aite's Conroy says.