Synthetic fraudsters can’t fake it anymore

No one embraces the aphorism “fake it till you make it” more than a synthetic fraudster.

This burgeoning variety of bad actor combines stolen info, such as a phone number and address, with fake info to create an entirely new (and bogus) identity.

A recent study from Aite-Novarica Group predicted that synthetic identity fraud will jump from $1.8B in 2021 to $2.42B by 2023. It also surveyed a group of top fraud executives who pegged “synthetic identities resulting from application fraud” as one of their most worrisome threats. And, as if the alarm bells weren’t already loud enough, the Federal Reserve put out a video in February to raise awareness about synthetic identity fraud.

Let’s take a closer look at the synthetic fraud landscape thus far in 2022. Then, we’ll show you how Deduce is outflanking the fakers.

Chasing ghosts

Our initial primer on synthetic identity fraud in February cited experts who foresaw an uptick in synthetic attacks in 2022. Three months in, it seems these experts lived up to their reputation as synthetic identities continue to negatively impact myriad industries and the consumer victims it leaves in shambles.

In 2020, financial institutions suffered $20 billion in losses due to synthetic identity fraud. The use cases keep piling up: suspicious auto loan applications (260% increase); Buy Now, Pay Later fraud (66% increase from 2020 to 2021); and synthetic refund fraud, to name a few.

Financial harm to businesses isn’t the only concern. Profits from synthetic identity fraud are also linked to terrorism and human trafficking. Parents even have to protect the financial futures of their young children who may not realize their identity was stolen until after applying for a credit card as an adult. Hacked school databases and social media accounts led to 1.25 million stolen child identities in 2020.

The most frustrating element of synthetic identity fraud for consumers, businesses, and law enforcement is the elusiveness of the perpetrator. Pinpointing the real human behind a “Frankenstein identity” is like chasing a ghost. A mishmash of, say, a random person’s address, another individual’s stolen social security number, and a made-up name, is more than enough to throw investigator’s off the scent. Complicating matters is the patience of synthetic fraudsters who often prefer playing the long game by taking out smaller loans, paying bills on time, and otherwise keeping a low profile

Fraud prevention solutions are tasked with a different set of challenges, namely: how do you stop a synthetic fraudster early, before an attack can take place, and is that even possible?

You can’t fake it

Preemptively stopping synthetic fraudsters in their tracks is indeed possible—if the largest real-time identity graph in the US is at your disposal.

Deduce’s Identity Network is just that. We’re a relatively young company, but our data is clever beyond its years, powered by more than 450 million anonymized US user profiles (many US residents have more than one email) and 1.4 billion daily activities. 

Think of Deduce as the wise old owl who’s seen every fraudster scheme in the book. Our vast database of user profiles and activity successfully prevents synthetic identity fraud for one key reason: it’s too expensive for synthetic fraudsters to fake us out. The amount of websites, diversity of activity, and length of time needed to circumvent our defenses—all using the same device and identity—would be too costly. (Fraudsters are a thrifty bunch.)

Given the patience of synthetic fraudsters and their efforts to legitimize fake identities by opening bank accounts, paying utility bills, etc., the static data traditionally used to prevent breaches isn’t sufficient. Real-time user activity, on the contrary, gives the Deduce intelligence layer the upper hand no matter how many real and fake details they’ve cobbled together.

And, because the Deduce Identity Network offers both risk and trust signals, you’ll combat synthetic bad actors while making sure legitimate users aren’t mistaken as false positives.
If you’re looking for a synthetic antiseptic, contact us today.

Static data alone can’t ward off synthetic fraudsters

The synthetic ascension

In 2021, identity fraud targeting US-based e-tailers made up 30% of all fraud losses. Within that troubling percentage lies an uptick in synthetic identity fraud, in which bad actors fuse stolen data (phone numbers, emails) with fake data to create a bogus identity.

Post-pandemic, fraudsters have feasted on users’ anxiety and increased online activity, phishing login information with very little effort. Given this trend, experts foresee another rise in synthetic identity fraud in 2022, especially in the financial services arena and on platforms that utilize seamless signup and other quick decisions.

With factors like social security number randomization making synthetic “Frankenstein identities” more prevalent, stopping this mish-mashed form of identity fraud is imperative before it festers into a costly and potentially years-long disaster.

Not your average identity fraud

The challenge of preventing synthetic identity fraud lies in its patchwork composition. A synthetic identity pulls together fake and legit info from multiple sources instead of targeting a single consumer victim, making it much more difficult to detect. With no defrauded person to tip off companies, accounts created via synthetic identity can remain active indefinitely like clandestine, money-sucking leeches only to vanish once the on-file credit card maxes out.

Again, there’s no real-life person to trace the account back to, which complicates the identification of synthetic identity fraud, much less the calculation of losses (assuming fraud is circled as the culprit). Unfortunately, differing interpretations of synthetic identity fraud among enterprises can often chalk cases up to credit-related issues, leaving credit lenders and related providers to carry the financial burden.

If need be, synthetic fraudsters can bypass defenses with more than a fake SSN and stolen email. Forget Frankenstein identities — the craftiest of synthetic fraudsters are combining facial features from multiple people with AI to create realistic “Frankenstein faces.” Yet another wire-crossing maneuver that throws traditional fraud prevention solutions off the scent.

The synthetic antiseptic

Old school fraud prevention tools rely on static data such as physical address and device fingerprinting to detect bad actors. This won’t cut it for synthetic identity fraud.

The only way to effectively root out stealthy synthetic fraudsters is to combine static data with live and historical real-time user activity data. By adding this extra layer of real-time intelligence —behavioral biometrics, time of day, location, etc. — there are too many holes for fraudsters to cover up or build an authentic digital “legend” and more than enough information to help companies spot a fraudulent identity.

This is precisely the extra punch Deduce provides. We pack more than 450 million anonymized US profiles and 1.4 billion daily user activities (logins, account creations, checkouts, etc.) from over 150,000 websites and apps into our real-time Identity Network, protecting organizations from financial losses and the other nightmarish side effects of synthetic identity fraud. For example, a solution that’s solely reliant on static data will fall victim to false positives and ultimately turn good customers away, while the Deduce approach is able to contextualize scenarios where a new device or other factor may not be consistent with identity fraud.

Fraudsters can fake a number of different attributes, but nothing they spoof can outsmart the collective intelligence and profile history of the Deduce Network. The breadth and diversity of our data (transactions, social media activity, etc.) is too gargantuan — and too expensive for the average fraudster to circumvent.

Tap into the Deduce Identity Network today and bolster your defense against synthetic identity fraud. Contact us here to get started.

Deepfakes are coming for the identity fraud crown

To no one’s surprise, cybercrime ballooned last year. Ransomware alone saw an 11x increase from July 2020 to June 2021. Adding to the excitement — for fraudsters, at least — is the burgeoning threat of deepfakes: synthetic media that uses AI to mimic a person’s face, voice, or movement with stunning accuracy.

With more companies incorporating biometrics, fingerprinting, and video/voice verification into their authentication processes, a growing interest in deepfake technology across the dark web doesn’t bode well for preventing identity fraud. Educating employees of deepfake warning signs helps, but ultimately companies will need to stave off the threat with AI technology of their own (and then some).

Truly, madly, deeply fake

Most of the general public still considers deepfakes a novelty item. People have used the technology to alter political videos and insert Nicholas Cage’s face into Indiana Jones and James Bond movies. Last year, Roadrunner, a documentary about the late chef Anthony Bourdain, stirred up controversy for using synthetic audio snippets of Bourdain’s voice.

But more nefarious examples of deepfakes illustrate the threat of identity fraud and companies potentially losing millions of dollars. In 2019, a man impersonated the French Defense Minister over Skype and scammed his way to $93 million. The same year, an AI-generated voice cheated a Hong Kong bank manager out of $35 million.

Manipulating audio is a layup for fraudsters — they can turn a short speech from a corporate executive or government official into a cloned voice sample using one of many readily available machine learning apps. Voice deepfakes are harder to spot than video due to the lack of visual evidence. Voice deepfakes delivered over the phone are even more difficult because of the reduced audio quality.

Image- and video-based deepfakes employ tactics reminiscent of Face/Off, fraudsters wearing silicone masks to fool facial biometrics (“face spoofing”), or using social pictures to bypass face verification. Fraudsters often circumvent authentication protocols using pre-recorded deepfake videos, or, again, by wearing hyper-realistic silicone masks. Liveness tools can help detect videos with silicone masks, but only tools that account for facial actions and traits: blood circulation, skin texture, blinking, etc.

Adopting AI-based software that detects deepfakes isn’t enough; fraudsters have AI tools of their own. Synthetic identity fraud is rising fast, as is the sophistication of the technology available on the dark web. Is it possible for businesses to beef up their biometrics authentication and stay a step ahead of bad actors?

Biometrics’ best friend: real-time insights

In the ’80s, no one defended the universe like Voltron. But the Voltron robot without its head? Not as formidable.

Not to say biometrics verification tools — specifically those designed to stop deepfakes — lack intelligence, but without another layer of AI-powered smarts, more identity thieves will slip through the cracks. This will open the door to synthetic identity fraud, account creation fraud, account takeover, and churn.

Why not buttress biometrics and other authentication techniques with an additional layer of real-time insights to thwart identity fraudsters? For example, a facial recognition solution coupled with trust signals such as time of day, IP address, or device ID could boost the certainty that a voice, image, or video is the real McCoy — and be the difference between stopping a deepfake and falling victim to a multimillion-dollar heist. Static, or historic, data can’t compete with real-time data. Relying upon names, dates of birth, addresses, and maiden names as another factor of authentication is futile because much of this information is available on the dark web.

At Deduce, we’ve built a product that pairs nicely with existing AI solutions like aged cheddar to a cabernet sauvignon, harnessing real-time, dynamic data to bolster account verification and help prevent identity fraud. Our real-time insights assist in preempting attacks by adapting to the latest fraudster schemes and behaviors — precisely the malleability needed to strengthen image, video, and voice authentication against deepfakes.

Our not-so-secret sauce? A real-time Identity Network that boasts more than 450 million anonymized US profiles (multiple devices and accounts per user) and 1.4 billion daily activities (logins, checkouts, registrations, etc.) captured from in-page collection methods on 150,000 websites and apps.

Want to see how Deduce’s real-time insights can fortify the castle walls of your identity authentication? Contact us today.

Cloud breaches aren’t going away any time soon.

For today’s enterprise organizations, operating within the cloud is table stakes. It’s faster, more scalable and cost-effective than your grandma’s service oriented architecture (SOA).

However, companies new to the cloud, or those that’ve been there for a while, may not realize the floodgate of security risks that comes with the cloud’s increased flexibility. Like a tourist unknowingly venturing into a city’s most dangerous neighborhood, they don’t see the cybercriminals around the corner waiting to pounce on valuable company assets.

A new Report from IBM details how hackers are feasting on vulnerable cloud environments, and offers a troubling look at how these stolen resources are trafficked on the dark web. (Picture a farmer’s market, but replace the locally grown carrots and beets with login credentials and other sensitive information.) Here are some eye-opening insights gleaned from the data in the report, gathered from Q2 2020 to Q2 2021.

Unforced errors

More than two-thirds of cloud breaches were simply a case of companies leaving the door open. Specifically, attackers took advantage of misconfigured APIs and default security settings that rendered virtual machines and other cloud tools defenseless. Passwords proved troublesome as well: 100 percent of cloud environments studied had violated password and security policies.

Thank you for shopping at Dark Web Depot

According to IBM’s report, upwards of 30,000 account credentials were up for grabs on the dark web. Some were going for a few dollars, others for as much as $15,000. Many of the sellers operated like your average big-box retailer, offering 1–2 week refunds if buyers couldn’t access the cloud environment with the credentials they purchased.

Keeping up with the times

Cryptominers and ransomware were the most common types of malware used to attack cloud environments, comprising more than half of the breaches in the report. Penetration testing revealed that threat actors updated old malware to key in on Docker containers and developed new malware written in cross-platform programming languages.

It also doesn’t appear that cloud breaches are slowing down any time soon: publicly disclosed attacks of cloud applications have increased by more than 150 percent over the last five years.

Clearly, the latest wave of malware is all-in on cloud vulnerability. Is your company all-in on cloud security?

Deduce safeguards your customers from account takeover fraud. Activate your free trial here, and see how Deduce can bring cloud conspirators back down to earth.

Deduce Insights lets businesses join forces to defeat cybercriminals

For businesses, cybersecurity is a big problem. Data breaches, identity fraud, account takeovers, and other kinds of cyberattacks cost companies billions of dollars a year — and with fraudsters and hackers targeting organizations of all sizes, nobody can afford to get complacent.

deduce insights

That’s why I’m proud to announce the launch of Deduce Insights — a first-of-its-kind cybersecurity radar that provides early warning of fraudulent behavior before it becomes a full-blown data breach. What makes Deduce Insights distinctive is the data that underpins it; the tool delivers early and accurate fraud detection by using over a billion authenticated user interactions per day.

Let me explain why that’s such a big deal. Here at Deduce, we believe the biggest threat to organizations’ digital security isn’t unpatched software, careless users, sophisticated malware, or even the rise of well-funded international cybercrime rings. All these things are dangerous, of course, but they can be anticipated and planned for.

⚠️ No, the biggest threat to today’s businesses is data poverty.

To defeat cybercriminals, we need to analyze user data in order to tease out the behavioral analytics that betray ‘bots and bad actors, allowing us to detect malicious activity in time to prevent fraud.

That’s fine in theory. But unless you’re a global giant with millions of users like Microsoft, Amazon, Google, or Facebook, you simply don’t have the volume of up-to-the-minute data needed to power an effective security strategy.

The truth is that no matter how much organizations spend on fancy cybersecurity software, those tools are only as good as the data they use. All too often, businesses wind up stuck in neutral, with expensive cybersecurity systems that simply aren’t smart enough to keep them safe.

It’s time to level the playing field

deduce insights design

Deduce Insights is designed to change that. Using a global network of shared identity data gleaned from over 150,000 websites and more than 450 million user profiles, we’re giving organizations of all kinds access to global security intelligence at a scale previously reserved for tech giants.

Drawing on the proven technologies behind our Customer Alerts solution, we’re making it possible for businesses to stay ahead of cybercriminals. Armed with rich, large-scale datasets, Deduce Insights enables organizations to instantly establish that a person really is who they claim, and to rapidly detect threats including:

  • Identity Fraud, by using identity intelligence to augment existing security solutions and prevent fraudsters from using compromised identities to open new accounts
  • Account Takeovers, by detecting irregular or anomalous user account activity to bolster defenses and stop account hijackers in their tracks
  • Account Anomalies, by spotting interactions or transactions that deviate from expected user behavior to block threats and prevent financial losses
identity insights

What makes Deduce Insights so powerful? It’s more than just the volume of security data we’re making available — it’s also the richness of the identity intelligence embedded in that data. We don’t merely try to spot ‘bots masquerading as humans. We validate legitimate users and flag bad actors of all kinds using powerful identity telemetry including:

  • Activity Data, to determine whether specific interactions and behavior are typical for a particular user
  • Device Metrics, to identify suspicious changes in the hardware and software being used to access an account
  • Network Intelligence, to detect anomalous network types such as proxy servers, TOR browsers, or data centers
  • Geolocation, to monitor a user’s point of origination for signs that they’re accessing your network from an unexpected country, state, city, or time zones
  • Threat Signals, to quantify the precise degree of risk in any given user behavior and enable decisive but proportional security responses
360-degree cybersecurity radar

Effectively, Deduce Insights gives your organization an always-on, 360-degree cybersecurity radar, constantly on the lookout for problematic behavior by new or existing users at any stage in the customer journey.

When problematic user behavior triggers a blip on your security radar, Deduce Insights gives you the specifics you need to respond effectively without needlessly disrupting legitimate user activity.

Some activity might automatically trigger an account freeze to prevent bogus transactions; other behavior might trigger a customer alert or a security challenge. Whatever the threat, you’ll have the intelligence you need in order to flag questionable activity, seamlessly re-authenticate users, and effectively prevent fraud.

Join our mission

The bottom line is that Deduce Insights makes your cybersecurity operations smarter. That’s something we urgently need, because cybercriminals are getting smarter too. While businesses struggle along using internal data to power security systems, fraudsters are actively collaborating and sharing information, compromised logins, exploits, and new technologies on the dark web.

As things stand, cybersecurity isn’t a fair fight. Isolated businesses with limited data simply don’t have the means to fend off sophisticated attacks from globally interconnected criminal networks. We need to change the rules of engagement — but that’s something no individual business can do on their own.

That’s where Deduce comes in. Our data network gives businesses the tools to safely share anonymized security intelligence without giving away sensitive or commercially valuable data — and every company that joins our cause makes the entire network stronger. Together, we’re leveling the playing field, and beating fraudsters by democratizing access to security intelligence.

The launch of Deduce Insights marks the next step in that journey. So don’t let data poverty sink your cybersecurity strategy. Get in touch today, and join our mission to make best-of-breed fraud prevention available to everyone.

Read the VentureBeat coverage.

Read the press release via WebWire.

Originally published at via CEO Ari Jacoby

Deduce’s Customer Alerts product is leveling the fraud prevention playing field

Deduce, the leading provider of cybersecurity solutions powered by real-time identity network data, today announces that Deduce is the Global InfoSec Awards’ Publisher’s Choice in Fraud Prevention. The awards are announced by Cyber Defence Magazine during the RSA Conference to honor startups and public companies that demonstrate a unique and compelling value proposition in the information security (InfoSec) space.

Deduce Customer Alerts works within global data privacy rules, including GDPR and CCPA, to maintain more than 450 million US profiles that provide a baseline for determining whether a user is who they claim to be at the point of online interaction. Powerful algorithms crunch the data to spot potentially fraudulent activity — like logging in from unusual locations, devices, or exhibiting unusual behavior — and send alerts asking the customers themselves if the login is valid.

“The alarming truth is that most companies lack the data resources to power proven and familiar best practices — email alerts — used by the internet giants, which puts consumers at risk,” explains Ari Jacoby, Deduce CEO and co-founder. “The Deduce Identity Network and our Customer Alerts provide powerful fraud prevention tools that spot potential fraudsters and level the playing field for companies of any size to protect their customers from criminal acts.”

“We scoured the globe looking for cybersecurity innovators that could make a huge difference and potentially help turn the tide against the exponential growth in cybercrime. Deduce is absolutely worthy of this coveted award and consideration for deployment in your environment,” said Gary S. Miliefsky, Publisher of Cyber Defense Magazine.

Originally published at