Today’s digital identity crisis

Introduction

In the digital age, cybercrime has evolved to exploit gaps in enterprise data security and disrupt identity theft in the process. Specifically, economic digitization has spawned a parallel black market on the Dark Web, where criminals transact in bitcoin to anonymously trade stolen data, minting hundreds of billions in annual and often untraceable proceeds for sellers.¹ With cybersecurity firm FireEye exposing hacker syndicate Fin6 as the operator of one Dark Web forum that was soliciting 20 million credit card numbers – the spoils of a single data breach² – it seems the ID theft ecosystem has never been more amenable or accessible to the criminal class. In fact, Javelin Strategy & Research’s 2017 Identity Fraud Study said ID theft hit a record high in 2016, victimizing some 15.4 million people, or roughly two million more victims than the previous year.³ ID theft is generally a precursor to credit card fraud, which a 2016 Nilson Report newsletter attributed to worldwide losses of $21.84 billion in 2016.⁴

What’s more, card issuers such as banks and credit card companies incurred 72 percent, or $15.72 billion, of those losses last year. Assuming constancy in Nilson’s issuer-loss rate, card fraud will siphon a grand total of $88.87 billion out of the global financial system over the next four years. Further, a 2016 credit card fraud survey⁵ led by payment research firm Aite found that the confluence of surging data theft and issuers’ shift towards EMV chip card products has reduced counterfeit-card fraud at the point of sale (POS), but caused a massive spike in card-not-present (CNP) fraud. In fact, Javelin’s report pegged the year-over-year growth of CNP fraud theft at 40 percent last year. The Aite study queried 16 of the largest credit and debit card issuers in the U.S. that collectively represent over two-thirds of the nation’s cardholders. By 2020, Aite said that CNP fraud losses will reach a record high of $7.2 billion, punctuating a total CNP loss in the U.S. of $25.9 billion over the next four years.

Learn how CLEAR ID Confirm can provide data-driven KYC solutions

Beyond standard ID theft, synthetic identity fraud (SIF) schemes, where criminals use stolen data to create fictitious, but bankable, identities, are also hitting lenders hard.⁶ ID theft and SIF schemes are increasingly enabling new account fraud (NAF), which can derail money laundering inquiries and is integral to the furtherance of application fraud. The latter entails the use of stolen or synthetic credentials to open fraudulent accounts, which the scammer exploits to build a credit history and then, once the limit is desirable enough, obtain a large personal loan that they will never repay. The Aite report pegged 2015 U.S. loan application fraud losses at $966 million, a theft deficit projected to reach roughly $1.37 billion in 2017 and another $2.1 billion in 2020.

In addition to application fraud, the emergence of NAF-enabled crime complicates anti-money-laundering (AML) investigations by adding more hidden layers to transaction structuring for scammers and criminal organizations. This threat landscape constitutes a digital identity crisis for financial institutions (FIs) and demands industry-wide action to improve outdated know-your-customer (KYC) processes. But if FIs are to safeguard their KYC systems in the golden age of ID theft and Dark Web data trafficking, they must build a new customer authentication model informed by the following three principles: understanding the Dark Web, recognizing the growing threat of SIF schemes, and exploring new regulatory technology solutions (regtech). The following report will create a conceptual framework through which banks and fintech providers can address and resolve the deepening digital identity crisis.

Dark Webnomics 101

Understanding the vast supply-and-demand mechanism of the Dark Web economy is integral to KYC strategy for banks. The Center for Strategic and International Studies pegs the worldwide cost of cybercrime at $445 billion a year.⁷ According to the Ponemon Institute’s 2016 Cost of Cybercrime Study, data breaches, cyber-fraud, and related disruptions impact U.S. organizations the hardest, with the average cyberattack generating $17.36 million in costs. Of the 4,149 data breaches and 4.2 billion records exposed in 2016,⁸ as reported by cybersecurity firm RiskBased Security, the U.S. comprised 47.5 percent and 68.2 percent of those numbers, respectively.

Based on the monetization model of the Dark Web, it is safe to assume that most of those 3 billion stolen American data records are being trafficked on anonymous “eBay-like marketplaces,” where the median price of a stolen identity fetches $21.35.⁹ Consider that the 2013 Yahoo breach, which the company only disclosed last year, resulted in the theft of a record-high, one billion user credentials, which were then sold to three parties in $300,000 increments. Just like Amazon^® sellers, stolen data buyers then packaged their wholesale purchases into more consumer-friendly bundles, segmenting unit pricing by factors such as credit score, age, and geo-location, and resold Yahoo credentials to other criminals on the Dark Web.¹⁰ Although stolen identity data is a depreciating asset that becomes less valuable with each passing second on the market, new SIF schemes prove that high-volume data theft can still yield enduring dividends for financial criminals.