All posts by Guest Contributor
By: Kari Michel Lending institutions are more challenged today than ever before when assessing credit risk to find creditworthy consumers. Since 2006, the start of the housing bust and recession, consumer’s overall creditworthiness has deteriorated, especially those consumers who once had a high score (low risk). “For example, a study earlier this year by VantageScore found that the probability of serious delinquency, defined as nonpayment for 90 days or more, had increased by 417 percent among “super prime” borrowers between June 2007 and June 2009. Default risk during the same period rose by 406 percent for the second-highest rated category of “prime” consumers, and nearly doubled for those at the “near prime” scoring level.”* VantageScore is one example of a credit risk model that was recently redeveloped to capture the changing consumer behavior of repayment. The development data set included 45 million consumer credit profiles for the time period of 2006 to 2009. VantageScore 2.0 will be released for lenders use January 2011. *Source: The Washington Post, “Walk-aways leading to big changes for all borrower’s credit score, November 5, 2010 Link for article: http://www.washingtonpost.com/wp-dyn/content/article/2010/11/05/AR2010110502133.html
By: Kristan Frend According to the 2011 Identity Theft Assistance Center Outlook (ITAC), new forms of small business identity theft are emerging. This shouldn’t be a surprise that criminals view small business accounts as a lucrative funding source. What is surprising is that the ‘new’ form of small business identity theft consists of the U.S. Postal Inspection Service reporting a surge in criminal rings using small business information from stolen mail, check writing software and other tactics to counterfeit checks. That’s the new wave of small business identity theft??? I consider this one of the least sophisticated types of fraud that can easily be eliminated by small business owners not leaving mail unattended. Reading this report makes me realize that we have a long way to go in identifying and reporting the more sophisticated types of small business fraud. As I’ve mentioned before, the industry has come a long way in advancing consumer fraud solutions. Yet, as fraud has migrated into business accounts, we as an industry still have a ways to go in reporting the latest business fraud trends and tracking statistics. I’m adding this to my wish list for 2011… What’s on your wish list? On a side note, I’ve noticed nearly all of the articles posted in our blog include no reader comments. I’d like to think that this means our readers are too busy to add comments and/or our articles are so well-written that they answer all of your questions. One can dream right? Seriously though, as we approach 2011 and plan our topics, we’d love to hear from you- if you can think of any topic you’d like us to cover more in depth, please let us know.
By: Kristan Frend As my colleague Margarita Lim discussed in her December 3rd article, the SSA announced that it will change how social security numbers (SSNs) will be issued, with a move toward a random method of assigning SSNs. For organizations that currently incorporate the validation of an applicant’s SSN issue date and state as a part of their risk-based decisioning, they will lose this piece of applicant authentication post-randomization. But there is some good news - first, this validation piece won’t be entirely terminated on day one of the SSN randomization for organizations. All the change means is that the newly issued SSNs will be randomized. In other words, the only SSNs that the issue data and state won’t be validated on day one are the SSNs that have just been issued to the recently born or immigrants. Given that its likely newborns won’t be applying for credit for another 18 years, the bulk of the newly issued SSNs that organizations will see for a while are those belonging to adults who were recently issued a SSN…A growing number of applicants, but not the majority of applicants. The other bit of good news is this may actually be a good thing for all of us in the long run. While we’ll end up losing the ability to validate an applicant’s SSN issue data and state, the criminals will be at an even greater disadvantage. Consider this- Last year researchers* were able to “identify all nine digits for 8.5 percent of people born after 1988 in fewer than 1,000 attempts. For people born recently in smaller states, researchers sometimes needed just 10 or fewer attempts to predict all nine digits.” I don’t expect this change to drastically reduce third party fraud rates but over time it should eliminate one component of identity theft and ultimately benefit an organization’s Customer Information Program. *The National Science Foundation, the U.S. Army Research Office, Carnegie Melon Cylab, and the Berkman Faculty Development Fund provided support for the research. To view the entire study, please visit http://www.pnas.org/content/106/27/10975.full.pdf+html.
By: Ken Pruett The majority of the customers I meet with use some sort of Velocity Checks to assist with their Fraud and Compliance process. However, there are still quite a few that do not, especially when opening up New Business Accounts. Historical data checks have proven to be an effective form of identity theft prevention for both Consumer fraud and Commercial Fraud. We see scenarios where a perpetrator will have one successful penetration of a business and opens up a fraudulent account. They then try and replicate this against the same business. All of the information may be different, with the exception of one element, often the phone number. Without velocity checks, this may not be identified at the time the account is being opened. More sophisticated rings try to be more creative in their fraudulent attempts. They may gain access to a consumers information and then go and apply at a variety of entities. They are more careful, so they never attempt to target the same business twice. They are aware that many companies have velocity checks, so they do not want to take a chance of having their information questioned. At a minimum, the use of in-house velocity checks should be a standard process for you fraud detection measures. Typical data elements to check against are; name (business or consumer), address, phone number, and Social Security Number. A fraud best practice would be to use a tool that provides velocity checks and incorporates the information into a fraud prevention tool. There are tools that provide checks across multiple businesses and this typically provides the best level of protection. By looking at inquiry information across multiple businesses, you are able to help prevent being a victim of some of the more sophisticated rings. Don’t find yourself being the easiest target. Once you get hit, it could snowball and you may be victimized multiple times. We all know there is no way to stop all of the fraud, but let’s not make it too easy on the perpetrators. Try and find a way to use some sort of velocity checks in your process to at least minimize your fraud risk.
By: Andrew Gulledge Bridgekeeper: “What is the air-speed velocity of an unladen swallow?” King Arthur: “What do you mean? An African or European swallow?” Here are some additional reasons why the concept of an “average fraud rate” is too complex to be meaningful. Different levels of authentication strength Even if you have two companies from the same industry, with the same customer base, the same fraudsters, the same natural fraud rate, counting fraud the same way, using the same basic authentication strategies, they still might have vastly different fraud rates. Let’s say Company A has a knowledge-based authentication strategy configured to give them a 95% pass rate, while Company B is set up to get a 70% pass rate. All else being equal, we would expect Company A to have a higher fraud rate, by virtue of having a less stringent fraud prevention strategy. If you lower the bar you’ll definitely have fewer false positives, but you’ll also have more frauds getting through. An “average fraud rate” is therefore highly dependent on the specific configuration of your fraud prevention tools. Natural instability of fraud behavior Fraud behavior can be volatile. For openers, one fraudster seldom equals one fraud attempt. Fraudsters often use the same techniques to defraud multiple consumers and companies, sometimes generating multiple transactions for each. You might have, for example, a hundred fraud attempts from the same computer-tanned jackass. Whatever the true ratio of fraud attempts to fraudsters is, you can be confident that your total number of frauds is unlikely to be representative of an equal number of unique fraudsters. What this means is that the fraud behavior is even more volatile than your general consumer behavior, including general fraud trends such as seasonality. This volatility, in and of itself, correlates to a greater degree of variance in fraud rates, further depleting the value of an “average fraud rate” metric. Limited fraud data It’s also worth noting that we only know which of our authentication transactions end up being frauds when our clients tell us after the fact. While plenty of folks do send us known fraud data (thus opening up the possibility of invaluable analysis and consulting), many of our clients do not. Therefore even if all of the aforementioned complexity were not the case, we would still be limited in our ability to provide global benchmarks such as an “average fraud rate.” Therefore, what? This is not to say that there is no such thing as a true average fraud rate, particularly at the industry level. But you should take any claims of an authoritative average with a grain of salt. At the very least, fraud rates are a volatile thing with a great deal of variance from one case to the next. It is much more important to know YOUR average fraud rate, than THE average fraud rate. You can estimate your natural fraud rate through a champion/challenger process, or even by letting the floodgates open for a few days (or however long it takes to gather a meaningful sample of known frauds), then letting the frauds bake out over time. You can compare the strategy fraud rates and false positive ratios of two (or more) competing fraud prevention strategies. You can track your own fraud rates and fraud trends over time. There are plenty of things you can do to create standardize metrics of fraud incidence, but good heavens for the next person to ask me what our average fraud rate is, the answer is “No.”
By: Andrew Gulledge I hate this question. There are several reasons why the concept of an “average fraud rate” is elusive at best, and meaningless or misleading at worst. Natural fraud rate versus strategy fraud rate The natural fraud rate is the number of fraudulent attempts divided by overall attempts in a given period. Many companies don’t know their natural fraud rate, simply because in order to measure it accurately, you need to let every single customer pass authentication regardless of fraud risk. And most folks aren’t willing to take that kind of fraud exposure for the sake of empirical purity. What most people do see, however, is their strategy fraud rate—that is, the fraud rate of approved customers after using some fraud prevention strategy. Obviously, if your fraud model offers any fraud detection at all, then your strategy fraud rate will be somewhat lower than your natural fraud rate. And since there are as many fraud prevention strategies as the day is long, the concept of an “average fraud rate” breaks down somewhat. How do you count frauds? You can count frauds in terms of dollar loss or raw units. A dollar-based approach might be more appropriate when estimating the ROI of your overall authentication strategy. A unit-based approach might be more appropriate when considering the impact on victimized consumers, and the subsequent impact on your brand. If using the unit-based approach, you can count frauds in terms of raw transactions or unique consumers. If one fraudster is able to get through your risk management strategy by coming through the system five times, then the consumer-based fraud rate might be more appropriate. In this example a transaction-based fraud rate would overrepresent this fraudster by a factor of five. Any fraud models based on solely transactional fraud tags would thus be biased towards the fraudsters that game the system through repeat usage. Clearly, however, different folks count frauds differently. Therefore, the concept of an “average fraud rate” breaks down further, simply based on what makes up the numerator and the denominator. Different industries. Different populations. Different uses. Our authentication tools are used by companies from various industries. Would you expect the fraud rate of a utility company to be comparable to that of a money transfer business? What about online lending versus DDA account opening? Furthermore, different companies use different fraud prevention strategies with different risk buckets within their own portfolios. One company might put every customer at account opening through a knowledge based authentication session, while another might only bother asking the riskier customers a set of out of wallet questions. Some companies use authentication tools in the middle of the customer lifecycle, while others employ fraud detection strategies at account opening only. All of these permutations further complicate the notion of an “average fraud rate.” Different decisioning strategies Companies use an array of basic strategies governing their overall approach to fraud prevention. Some people hard decline while others refer to a manual review queue. Some people use a behind-the-scenes fraud risk score; others use knowledge based authentication questions; plenty of people use both. Some people use decision overrides that will auto-fail a transaction when certain conditions are met. Some people use question weighting, use limits, and session timeout thresholds. Some people use all of the out of wallet questions; others use only a handful. There is a near infinite possibility of configuration settings even for the same authentication tools from the same vendors, which further muddies the waters in regards to an “average fraud rate.” My next post will beat this thing to death a bit more.
By: Margarita Lim It’s the holiday season and a festive time of year. Colorful Christmas lights and decorations, holiday songs, all of these things contribute to the celebratory atmosphere which causes many people to let their guards down. Unfortunately, fraudsters and other criminals take advantage of the prevailing goodwill and can help make one of the busiest shopping times of the year, a miserable one for their victims. It’s not a surprise that articles and news stories are released advising shoppers on how to continue enjoying their holiday season by not being victims of identity theft or other known fraud activities. Consumers can get tips from the Federal Trade Commission and other websites to prevent or minimize exposure to identity theft but I think key ones include: • If using credit cards for purchases, write ‘Check Photo ID’ on the back of your credit card. • Be very protective about disclosing personal information, especially Social Security Numbers. Did you know that it only takes one piece of personal information about you for a thief to steal your identity? • If shopping online, only make purchases from recognizable online retailers and websites. Many fraudsters will create fake websites that offer goods for sale in order to collect personal and credit information that can then be used to make fraudulent purchases. If consumers need to be careful this holiday season, businesses should also be vigilant. Fraudsters cause businesses like banks, retailers and credit card companies to lose millions of dollars that ultimately get passed on to their customers. Companies need to make sure they have tools in place to minimize these fraud losses. I’ve mentioned this in a previous post but Experian supports Identity Theft Prevention Programs by offering highly accurate consumer identity verification services. Our consumer authentication and fraud prevention product, Precise ID, and our knowledge based authentication product, Knowledge IQ, are highly respected in the marketplace for their reliability, quality and accuracy. Implementing either of these products would go a long way in preventing fraud this holiday season.
By: Staci Baker Top five things to know about the Risk-Based Pricing Rule As many of you are preparing for the new Risk-Based Pricing Rule to take effect on January 1, 2011, I want to give you an overview of the top five things you need to know to ensure your business is compliant. 1. Applicability: Any company that uses a credit report or score in connection with a credit decision will be required to comply with the Risk-Based Pricing Rule. 2. Obligation: A lender is obligated to send a notice to a consumer when they use a credit report or score in connection with a credit transaction. When the lender provides credit to the consumer on material terms* that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that lender (any consumer who does not receive the lender’s best rate) based on the credit report or score, the lender is required to take action. 3. Compliancy: Lenders will be required to provide applicable consumers with the following: • A Risk-Based Pricing Notice, or • A Credit Score Disclosure Exception Notice • Model forms are available in the final ruling issued by the Federal Reserve Board and Federal Trade Commission 4. Exceptions to the Rule: There are several exceptions to the Rule, including: • When a lender is making a pre-screened offer or providing an adverse action notice, or • When a consumer applies for specific credit terms or business credit (all credit that is not for personal, family or household use is excluded from the rule.) 5. Exclusions to the Rule: Any lender who does not use a credit report or score in connection with a credit decision is excluded from the ruling. The ruling does not apply to small business lenders also. These top five key components of the Rule should get you on the way to compliancy by the beginning of the year. A pre-recorded webinar is available to give you additional information on compliancy and requirements of the Risk-based Pricing Rule. The Federal Reserve, http://www.federalreserve.gov/reportforms/formsreview/RegV_20100115_ffr.pdf * “Material terms” in most cases of the Rule are defined as the APR of the loan
By: Margarita Lim Recently, the Social Security Administration (SSA) announced that it will change how Social Security numbers (SSN) will be issued, with a move toward a random method of assigning SSNs. Social Security numbers are historically 9 digits in length, and are comprised of a three-digit number that represents a geographic area, a two-digit number referred to as a Group number and a four digit serial number.You can go to http://www.ssa.gov/employer/randomization.html to learn more about this procedural change, but in summary, the random assignment of SSNs will affect: • The geographic significance of the first three digits of the SSN because it will no longer uniquely represent specific states • The correlation of the Group number (the fourth and fifth digits of the SSN) to an issuance date range. What does this mean? It means that if you’re a business or agency that uses any type of authentication product in order to minimize fraud losses, one of the components used to verify a consumer’s identity – Social Security number, will no longer be validated with respect to state and date. However, one of the main advantages of utilizing a risk-based approach to authentication is the reduction in over-reliance on one identity element validation result. Validation of SSN issuance date and state, while useful in determining certain levels of risk, is but one of many attributes and conditions utilized in detailed results, robust analytics, and risk-based decisioning. It can also be argued that the randomization of SSN issuance, while somewhat impacting the intelligence we can glean from a specific number, may also prove to be beneficial to consumer protection and the overall confidence in the SSN issuance process.
By: Kari Michel As consumers and businesses continue to experience financial hardship, the likelihood of continued bankruptcy filings is fairly strong. Data from the Administrative Office of the U.S. Courts show there were 1,222,589 filings through September, versus 1,100,035 in the first nine months of 2009. According to American Bankruptcy Institute executive director Samuel J. Gerdano, \"As the economy looks to climb out of the recent recession, businesses and consumers continue to file for bankruptcy to regain their financial footing. With unemployment hovering near 10% and access to credit remaining tight, total filings in 2010 will likely exceed 1.6 million.\" Given the bankruptcy trends, what can lenders do to protect themselves from acquiring consumers that are at risk for filing for bankruptcy? Bankruptcy scores are available, such as Bankruptcy PLUS, and are developed to accurately identify characteristics specific to a consumer filing for bankruptcy. Bankruptcy scores are typically used in conjunction with risk scores to set effective acquisition strategies. _________________ Source: http://www.collectionscreditrisk.com/news/bankruptcy-filings-up-3003998-1.html
By: Staci Baker As we approach the end of the year, and the beginning of holiday spending, consumers are looking at their budgets to determine what level of spending they can do this holiday season, or if they will need additional credit for those much wanted gifts. With that in mind, it is a great time for lenders to evaluate their portfolios to determine which consumers are the best credit risks. According to the National Retail Federation, consumer spending will be up 2.1% for the 2010 holiday season. Although still at pre-recession levels, consumer confidence is starting to re-bound. But, with an increase in consumer confidence, how will lenders meet the demand for credit, and determine the credit worthiness of potential applicants? Since the beginning of the recession there has been a demand for tools that will assist lenders in managing credit risk. One such tool is the tri-bureau VantageScore, a scoring model that is highly accurate, offers greater predictiveness, and is able to score more people. Scoring models allow lenders to predict the likelihood a consumer will default on a loan. Determining who is a qualified candidate through scoring models is only part of the equation. Each lender needs to determine what level of risk to take, and what is the cost of the credit per applicant. By assessing credit risk, having a good plan in place and knowing who the target customer is, lenders will be more prepared for the holiday season. ___________________ National Retail Federation, http://www.nrf.com/modules.php?name=News&op=viewlive&sp_id=1016
By: Wendy Greenawalt Large financial institutions have acknowledged for some time that taking a more consumer-centric versus product-centric approach can be a successful strategy for an organization. However, implementing such a strategy can be difficult, because inherently organizations want to promote a specific product for one reason or another. With the current economic unrest, organizations are looking for ways to improve customer loyalty with their most profitable and lowest risk customers. They are also looking for ways to improve offers to consumers to provide segment of one decisioning, while satisfying organizational goals. Customer management, and specifically cross-sell or up-sell strategies, are a great example of where organizations can implement what I call “segment of one decisioning”. In essence, this refers to identifying the best possible decision or outcome for a specific consumer when given multiple offers, scenarios and objectives. Marketers strive to identify the best strategies to maximize decision-making, while minimizing costs. For many, this takes the form of models and complex strategy trees or spreadsheets to identify the ideal offering for a segment of consumers. While this approach is effective, algorithm-based decisioning processes exist that can help organizations identify the optimal decisioning strategies, while considering all possible options at a consumers level. By leveraging an optimization tool, organizations can expand the decision process by considering all variables and all alternatives to find the most cost effective, most-likely-to-be-successful strategies. By optimizing decisions, marketers can determine the ideal offer, while quantifying the ROI and adhering to budgetary or other campaign constraints. Many organizations are once again focusing on account growth and building strategies to implement in the near future. With the limited pool of qualified candidates and increased competition, it is more important than ever that each consumer offer be the best to increase response rates, achieve portfolio growth goals and build a profitable portfolio.
By: Kennis Wong In the last entry, I mentioned that consumers’ participation in protecting their own identity information is an important aspect of an identity theft prevention program to minimize fraud loss. Large financial institutions are starting to take charge in educating their customers, but others are having a hard time investing in such initiatives. I do understand that it is difficult to establish a direct linkage of revenue and positive return on investment for this type of activities. Business may view customer education of identity protection as a public service but not a necessity. After all, if my customer loses his identity information, it doesn’t necessarily mean that identity fraud will happen to my very own organization. But educating customers about identity protection and fraud trends can be a marketing tool and can increase customer loyalty, in additions to actual fraud prevention. Although consumers may not be aware of all the precautions they can take to protect their identity, undoubtedly identity theft is a hot topic in the media today. If there are two banks providing about the same service, but one of them goes an extra mile to provide me education on preventing identity theft, I would go with that bank. Also, as a financial institution, if my customers understand identity protection more, they would understand why I am putting some procedure in place and would be glad to comply with them. For example, they would be more patient when spending another minute in answering knowledge-based authentication questions, so that for their own protection, the bank can assure they are the true identity owners. Consumers can also actively monitor their credit report, whether through the bank or through other third party vendors. When consumers receive fraud alert from activities that could be a result of identity theft, they can actively contact the financial institutions about the situation. The sooner the identity fraud is discovered, the better off for both the consumers and the businesses.
By: Kari Michel How are your generic or custom models performing? As a result of the volatile economy, consumer behavior has changed significantly over the last several years and may have impacted the predictiveness of your models. Credit models need to monitored regularly and updated periodically in order to remain predictive. Let’s take a look at VantageScore, it was recently redeveloped using consumer behavioral data reflecting the volatile economic environment of the last few years. The development sample was compiled using two performance timeframes: 2006 – 2008, and 2007 – 2009, with each contributing 50% of the development sample. This is a unique approach and is unlike traditional score development methodology, which typically uses a single, two year time window. Developing models with data over an extended window reduces algorithm sensitivity to highly volatile behavior in a single timeframe. Additionally, the model is more stable as the development is built on a broader range of consumer behaviors. The validation results show VantageScore 2.0 outperforms VantageScore 1.0 by 3% for new accounts and 2% for existing accounts overall. To illustrate the differences that were seen in consumer behavior, the following chart and table show the consumer characteristics that contribute to a consumer’s score and compare the characteristic contributions of VantageScore 2.0 vs VantageScore 1.0. Payment History Utilization Balances Length of Credit Recent Credit Available Credit Vantage Score 2.0 28% 23% 9% 8% 30% 1% Vantage Score 1.0 32% 23% 15% 13% 10% 7% As we expect ‘payment history’ is a large portion driving the score, 28% for VantageScore 2.0 and 32% for VantageScore 1.0. What is interesting to see is the ‘recent credit’ contribution has increased significantly to 30% from 10%. There also is a shift with lower emphases on balances, 9% versus 15% as well as ‘length of credit’, 8% versus 13%. As you can see, consumer behavior changes over time and it is imperative to monitor and validate your scorecards in order to assess if they are producing the results you expect. If they are not, you may need to redevelop or switch to a newer version of a generic model.
By: Kennis Wong As a fraud management professional, naturally I am surrounded by fraud prevention topics and other professionals in the field all the time. Financial, ecommerce, retail, telecommunication, government and other organizations are used to talking about performance, scoring models, ROI, false-positives, operational efficiency, customer satisfaction trade-off, loss provisioning, decisioning strategy or any other sophisticated measures when it comes to fraud management. But when I bring up the topic of fraud outside of this circle, I am always surprised to see how little educated the general public is about an issue that is so critical to their financial health. I met a woman in an event several weeks ago. After learning about my occupation, she told me her story about someone from XYZ credit card company calling her and asking for her Social Security number, date of birth and other personal identifying information. Only days after she gave out the information that she realized things didn’t seem right. She called the credit card company and got her credit card re-issued. But at the time I talked to her, she still didn’t know enough to realize that the fraudster could now use her identity to start any new financial relationship under her name. As long as consumers are ignorant about protecting their identity information, businesses’ identity theft prevention program will not be complete and identity fraud will occur as a result of this weak link. To address this vulnerability and minimize fraud, consumers need to be educated.
Learn More Image
