Personal vehicle usage and public transport have transformed unimaginably in recent years, as innovative services like app-based cars, scooter or bike rentals, and ride-sharing have been introduced.

Such services led to the emergence of the concept of 'Mobility-as-a-service' (MaaS). In the “Technology in Society” journal the concept of MaaS is described simply as: 

“The bundling of different transport means, public and private, into one easy-to-use package for the customer. The service is provided to the customer on demand via mobile applications and payment is handled via a digital wallet.” 

In other words, MaaS brings all modes of transport together into one intuitive mobile app and makes any trip-planning easy and instant, putting the passenger at the forefront. It combines travel options with different vehicles from different carriers, providing everything from travel-planning to payment.

In addition to making travelling cheaper, easier and more accessible, the ‘MaaS’ concept also made it environmentally friendlier. The UK technology and innovation center for Intelligent Mobility has provided a theoretical example showing how a MaaS supporting user can reduce Single Occupancy Vehicle use in their report “Exploring the Opportunity for Mobility as a Service in the UK“.

And according to the research of ‘Mobility and the Sharing Economy: Potential to Overcome First- and Last-Mile Public Transit Connections’, one-way car sharing is able to reduce VMT and GHG emissions by 6%-16% and 4%-18% accordingly.

The concept of shared consumption has changed the landscape of the mobility industry. It is based on the idea that sometimes temporary access to a service is more convenient and beneficial than permanent access. The shared consumption model has been proposed with regard to personal vehicle use for several years. The bottom line is this: there are hundreds of different vehicles scattered around a city (usually economical or electric cars, scooters or bikes) which can be easily booked and accessed directly from an app on your phone. And when the ride is finished, you lock the vehicle using the app, get a receipt and no longer worry about where you parked your car, how much the monthly maintenance is for it, etc.  

When providing access to these services, you need to know your customer’s identity (and whether they’re allowed to use the relevant vehicle) before handing them the keys. This is where Veriff comes into play - helping you grant access to legitimate users with a high level of automation, accuracy, compliance and fraud prevention. And if you’re not convinced, check out what our partners, goUrban, said about us in our blog.

Mobility was one of the most affected industries during the COVID-19 pandemic. There are various factors at the heart of the negative consequences: lockdowns, closure of state borders, restrictions on movement, perceived health risk when using shared transportation etc. Different combinations of all of these factors affected every mobility service. According to recent McKinsey analysis “With the number of passenger-kilometers traveled declining 50-60% worldwide since the onset of the COVID-19 crisis, use of micromobility solutions has declined dramatically.” 

Today mobility companies are in a transitional stage full of uncertainty, with the potential need to introduce strict hygiene controls, such as compulsory face masks for drivers and passengers, health checks, protocols complying with distance and number of people allowed per space. The uncertainty concerns not only the timing of the return to pre-crisis indicators, but also the future image of the transport sector in the post-coronavirus world as a whole.

Veriff has an in-house built fraud prevention engine that is automating the decision making process and also assists specialists in case an automatic decision can’t be made (a hybrid approach). The engine can be broken into smaller pieces but all of them revolve around our proprietary device fingerprinting solution (see Graph 1).

Crosslinking allows Veriff to group together sessions that share similar data points. Based on previous knowledge, fraudsters don’t tend to limit themselves to one try - they’ll try to get verified today, tomorrow and in the upcoming months and they won’t stop as long as they have fake identities. All the information from crosslinks is taken into account by our automatic decision engine, and is forwarded to our clients. 

Velocity/Abuse ensures that no end-user abuses your service via multi-accounting. Taking into account all of the information we see through crosslinks, we can automatically shut down users if they, their document, or device have been approved before. We have three velocity checks that can be activated altogether or independently from each other:

Duplicated user - checks whether the person has been approved before

Duplicated document - checks whether the document has been approved before

Duplicated device - checks whether the same device has been approved before

Risk labels point out the signs of fraudulent behavior in sessions. These labels are used by our specialists in more detailed security review and are forwarded to clients to give insight about the final decision and help in post analysis.

What types of fraud are we discussing here?

We’re breaking mobility fraud down into 4 main types:

We’ll look at each in depth, what they are, the types we see most regularly, and the impact within the financial technology world.

This is often the type of identity fraud that leaps to mind first - tampered or entirely fake identity documents. These often exist in the form of fake IDs for a specific real world application - normally gaining access to something you’re underage for - but online there is normally more skill that goes into their creation, and they look to serve a monetary purpose, frequently some form of financial bonus on offer for inviting more users to a site.

In the case of mobility, we might consider a fake driver’s licence created to gain access to a vehicle when underage, or present when caught driving underage. Although both Veriff and police forces can catch these out with impressive speed.

There are various methods of tampering, but the end result always includes slight alterations made to a legitimate document in order to partially or entirely change the holder’s identity. Forgeries include but are not limited to:

Overwriting document data with a pen, pencil or other simple tools

Adding/removing specific document data or elements

Tampered documents are usually counterfeit originals, but fake documents try to imitate the appearance of a legitimate-looking document but are reproductions of the original. These come in the form of:

Alterated government-issued specimens that are public

Premade templates with fake photos and data

In the first 6 months of 2020, document fraud represented 7% of all fraud in the mobility market (see Graph 2).

Our in-house document database plays a key role in ensuring the accuracy of document fraud prevention. The database is updated regularly as we carry out extensive document related research (i.e. we find official specimens, information related to the issuing terms, etc) and cooperate with government authorities across the world.

In addition to our database, Veriff’s in-house fraud prevention engine plays a crucial role in document fraud detection and prevention. With the help of crosslinking we’re able to see if a user has previously submitted tampered documents or was involved in any suspicious activity.

This is exactly what you’d perhaps expect, fraud which involves a degree of technical skill which an average person wouldn’t possess. In this instance, we’re looking at streamed images and fraudulent access, two methods to take advantage of offers and make potential monetary gains.

Images and/or videos are streamed (or a slideshow)

This type of fraud happens when a verification includes media that’s coming from an emulated camera source. A fraudster might collect the portrait and document pictures belonging to different people in advance, edit them into a video and stream this inside Veriff’s flow to imitate the process being live.

Every time an end-user accesses the verification flow, we collect device and network information. Fraudulent accesses are defined as:

“Accesses associated with one verification session that has been accessed from different countries' networks and multiple devices.”

This is an indicator of the session link being fraudulently shared between different parties.

In the first 6 months of 2020, technical fraud represented 4% of all fraud in the mobility market (see Graph 3).

Our comprehensive profile of raw device and network data grants us full control over exactly which pieces of information we use and in what context. We can utilize specific elements of the device information, to spot whether camera emulation software was used at some point during the verification process. 

If we detect that an emulated camera source was used to submit the session, we note this, which helps in the final decision. We also perform checks on session images, to check if there is consistent natural movement between them.

To prevent possible fraudulent access in the session, we look to detect whether a session is being accessed from different countries' networks. If we detect a repetitive pattern indicating fraudulent access, we automatically block the user with the suspicion of the session link being compromised.

As we’re talking about technical fraud - did you know about the existence of romance scams? 

In romance scams fraudsters usually create fake online profiles with fictional identities, pictures and names with the help of which they lure their victims, where the main target group is usually senior women. After contact is established, they start expressing strong emotions for their victim, sharing ‘personal' information and digitally whispering sweet nothings. Once they’ve gained their victims’ trust, they request for money or other ‘favors’. These scams usually end up with big financial losses and a deep emotional feeling of betrayal.

We’ve unsurprisingly seen a similar ‘love story’ in Veriff. A woman was lured into opening an account for a service we assumed she would never use, most likely not understanding she’s the victim of a scam. Thanks to our fraudulent access detection and video feature, we caught the fraudster red-handed while he was asking the woman to take additional pictures and send authorization details via messenger.

Now we come to identity fraud. Not dissimilar to document fraud which we mentioned earlier, identity fraud is more about impersonation than actual document tampering. That’s one of the two examples we’ll look to highlight in fact, attempted impersonation, along with attempted deceit.

Attempted impersonation is the intentional use of someone else’s identity document with the aim of obtaining access to the service on someone else’s behalf. This type of fraud usually uses an illegally obtained physical document of the victim presented by a fraudster.

The end-user doesn’t show a real physical document, but shows it from a device screen or a printed-out paper as they’re using someone else's digital document or a digitally manipulated document of their own.

In the first 6 months of 2020, identity fraud made up 55% of all fraud in the mobility market making it by far the most prevalent type (see Graph 4).

Given the nature of the industry, every mobility company has to keep a balance between ensuring compliance with all the relevant regulations and offering a great customer experience. And this is where Veriff comes in, with our highly configurable flow and strong fraud prevention. 

In order to detect whether a verification process has been initiated with someone else’s physical document, we compare extracted faces from a selfie and a document photo. If our confidence in the similarity is too low we decline the session. If our automated engine is unsure it highlights appropriate risks and leaves the decision to a specialist.

For mobility, we’re predominantly verifying driver’s licenses, and this is why we also now offer driver’s license category extraction, as an additional feature geared towards mobility companies. You’ll not only be able to see the details of your user, but also what category of vehicle they’ve been approved to drive. 

By providing high-value assets to consumers, namely cars, every mobility service is subject to high business risks. Along with a potential vehicle’s theft there is the danger of identity theft by fraudsters who penetrate real users' devices or create fake identities to get access to the service.

“Identity theft is not a joke, Jim! Millions of families suffer every year!“ - Dwight Schrute 

Here in Veriff, we’ve seen different types of identity theft - from underage kids using their siblings' or parents' documents to rent a scooter to deepfakes trying to imitate someone else’s likeness by manipulating images and/or videos. The rising tide of AI and machine learning is constantly making it easier to steal someone’s face without undergoing a plastic surgery (like John Travolta did in the movie “Face/Off”), but our anti-spoofing controls and deepfake detection will make sure the right person is getting access to the service they require.

An example of deepfake technology: in a scene from Man of Steel, actress Amy Adams in the original (left) is modified to have the face of actor Nicolas Cage (right) - source https://en.wikipedia.org/wiki/Deepfake

Finally, we come to recurring fraud. This is also broken down into two examples, one of which is basic ‘recurring’ fraud, where a fraudster has been successful and come back to try again. The other is velocity abuse, which we’ll explain further below.

Recurring - Strong links to previous fraud

If fraudsters manage to abuse the system - they will come back and try again, if they fail to do so - they will come back and try twice as hard.

Velocity abuse works as follows - after getting approved once, fraudsters try to abuse the system and get approved as many times as possible, which usually involves verifying different real users without telling them what they’re being verified for. Fraudsters tend to go as far as creating synthetic identities, where they try to create a new identity by combining their real information in conjunction with fake data.

In the first 6 months of 2020, recurring fraud made up 34% of all fraud in the mobility market (see Graph 5).

Recurring fraud is where our crosslinks shine the brightest. If we’re confident that the end-user has committed fraud before, we’ll automatically decline all the recurring attempts associated with the same person, device or document. 

If the same person, document or device have been found approved in the historically submitted sessions, all the recurring attempts will be declined with Velocity/Abuse. 

In our third fraud report, we take a look at the impact of online and identity fraud on the world of mobility in 2020, and the most prevalent types of fraud seen by Veriff, with data gathered from our verification flows.

The Veriff Mobility Fraud Report - January to June 2020

The Financial Technology (Fintech) industry has been gaining momentum over the years by transforming the way financial businesses operate and providing a huge range of services to consumers. The industry has evolved rapidly and keeps on growing. According to the 'Fintech Global Market Opportunities and Strategies' report published in July 2020:

“The global Fintech market reached a value of nearly $111,240.50 million in 2019, having grown at a compound annual growth rate (CAGR) of 7.9% since 2015, and is expected to grow at a CAGR of 9.2% to nearly $158,014.3 million by 2023. Also the market is expected to grow to $191,840.2 million in 2025 at a CAGR of 10.2% and to $325,311.8 million in 2030 at a CAGR of 11.1%.”

Fintech transforms traditional financial institutions into faster, more secure and coherent businesses by implementing technologies like Blockchain and AI. It enabled the possibility of day-to-day banking operations, trading, investing, lending, international payments etc to users all around the world. Moreover, according to the World Bank Group report, digital financial services have the potential to help the poor increase their income and resilience by gaining access to basic financial services.

However we’ve seen the potential for fraud and financial abuse within the industry, with the recent Wirecard story acting as a stark reminder to up-and-coming players in the financial world of having risk management protocols in place. But this was fraud on a large scale - what about the everyday fraudsters, intentionally attempting to steal identities in an attempt to gain access to accounts or gain financial windfalls? This is what Veriff is fighting daily.

The COVID-19 pandemic hit most industries incredibly hard. It impacted the financial stability of business as well as individuals, sending millions to poverty. According to the Global Economic Prospects the crisis is expected to leave a 5.2% contraction on global economic activity in 2020.

At the same time the crisis brought an opportunity for Fintech companies to increase their demand in times of social distancing, quarantines and people adapting to a new reality powered by digitization. We’ve written on our blog about how the pandemic will impact the future of the financial industry and measures to combat illicit financing.  

As many businesses look to go digital, the demand for digital KYC processes also increases. And this is where Veriff comes in by helping granting access to services to legitimate users, and blocking the fraudsters.

We’re breaking Fintech fraud down into 4 main types:

In the first 6 months of 2020, document fraud represented 24% of all fraud in the fintech market (see Graph 2).

In addition to our database, Veriff’s in-house fraud prevention engine plays a crucial role in document fraud detection and prevention. With the help of crosslinking we’re able to see if a user has previously submitted tampered documents or was involved in any suspicious activity. 

Document fraud is the second most prevalent type of fraud in Fintech, so no matter which area you’re in, we’re ready to help you tackle this problem. And trust us, we’ve seen different types of document tampering, from very obvious one-time document manipulation to complex fraud schemes, like the following: 

”We noticed unusual traffic coming from an Eastern European country, associated with a financial institution. What raised suspicions even further was the fact that customers were submitting documents issued by a different country. At first glance one could think these were people travelling, as the documents seemed legitimate and people presenting them matched the identity on the document. But having all data points collected by our fraud engine and our highly trained specialists' expertise, it became evident that the presented documents were fake, and the end-users presenting them were up to something fishy. Our further investigation revealed that the group of fraudsters used disposable tools in order to emulate foreign traffic and create the illusion of “legitimacy”, and we had a reason to believe that the ultimate goal of this scheme was to set people up for migration to a more developed country (with fake documents in hand and a financial history). Unfortunately for these people, the trip was short lived.”

Every time an end-user accesses the verification flow, we collect device and network information. Fraudulent accesses are defined as:
“Accesses associated with one verification session that has been accessed from different countries' networks and multiple devices.”
This is an indicator of the session link being fraudulently shared between different parties.

In the first 6 months of 2020, technical fraud represented 1% of all fraud in the fintech market (see Graph 3).

Now we come to identity fraud. Not dissimilar to document fraud which we mentioned earlier, identity fraud is more about impersonation than actual document tampering. That’s among the examples we’ll look to highlight in fact, attempted impersonation. We’ll also look at third party guidance, which involves a more physical presence.

Third party guidance usually involves physical assistance of the end-user, sometimes without telling them what the verification is for. This behavior leads us to believe that the end-user being assisted will not be the one actually using the service they’re being signed up for.

In the first 6 months of 2020, identity fraud made up 67% of all fraud in the fintech market making it by far the most prevalent type (see Graph 4).

Given the nature of the industry, every Fintech company has to keep a balance between ensuring compliance with all the relevant regulations and offering a great customer experience. And this is where Veriff comes in, with our highly configurable flow and strong fraud prevention. 

In order to detect whether a verification process has been initiated with someone else’s physical document, we compare extracted faces from a selfie and a document photo. If our confidence in the similarity is too low we decline the session. If our automated engine is unsure it highlights appropriate risks and leaves the decision to a specialist. 

It’s no wonder identity fraud is the most prominent type of fraud in fintech. Malicious actors' appetite grows together with the industry, as more and more services are digitized and clients don’t have to physically meet a financial representative anymore to open accounts or perform any financial transactions. Here’s another first-hand story from inside Veriff:

“Forging a photo on a document is one thing, but forging the person presenting the document is a whole other story! The villain of this story must have watched the episode of “The Office” (the US version), where Dwight Schrute demonstrated his collection of wigs for every single person in the office with the words: “You never know when you're gonna need to bear a passing resemblance to someone”. Our perpetrator printed out a document with a nicely crafted face on it, and in addition, has designed a life-like mask matching the identity on the document he was showing. If only he knew we were able to see him ‘changing faces', he probably wouldn’t have gone this far.”

In the first 6 months of 2020, recurring fraud made up 8% of all fraud in the fintech market (see Graph 5).

Now that we’ve looked at the 4 different types of fraud that we’ve seen within the fintech industry, we can see the full breakdown below (see Graph 6):

In our second fraud report, we take a look at the impact of financial crime and fraud on the world of fintech in 2020, and the most prevalent types of fraud seen by Veriff, with data gathered from our verification flows.

The Veriff Fintech Fraud Report - January to June 2020

The cryptocurrency market is subjected to the highest fraud rate compared to other industries that Veriff works with right now. In fact this was still the case when we wrote our first fraud report, midway through last year, and this isn’t looking to change very fast.

The industry itself gains popularity day-by-day, by enabling faster and lower-cost international transactions, along with different promotional activities, which in turn lures criminals willing to cheat the system. And crypto itself is still seen in some quarters as a niche interest, but as the value of some of the more stable coins stays high, it’s worth understanding it all a little better.

To do that, we’d recommend our accompanying blogs - a Geek’s Guide to Crypto and Why Crypto is Ready for IDV to help you brush up before getting into the nitty gritty of this report.

As an illustration of the level of global financial crime within cryptocurrency alone, in 2019 cyber criminals were able to siphon away $4.26 billion from cryptocurrency users and exchanges. In the larger cases, this was down to sophisticated hacking of wallets and exchanges, but like all financial crime, there are larger and smaller scale examples.

One of the more public examples of fraudulent activity around crypto took place on Twitter recently, as a number of celebrities had their accounts hacked, and links were placed with the enticement to “send money here and you’ll get double back”. Unsurprisingly, those who sent crypto saw none in return and the scammers were quickly taken down, but not before damage had been done.

We wanted to take a deeper look into the ways in which criminals look to exploit cryptocurrencies through identity-related fraud, the trends we’ve observed, and how Veriff is designed to help crypto fight back.

Crosslinking allows Veriff to group together sessions that share similar data points. Based on previous knowledge, fraudsters don’t tend to limit themselves to one try - they’ll try to get verified today, tomorrow and in the upcoming months and they won’t stop as long as they have fake identities. All the information from crosslinks is taken into account by our automatic decision engine, and is forwarded to our clients.

When it comes to Crypto, we can break fraud down into 4 main types:

We’ll look at each in depth, what they are, the types we see most regularly, and the impact within the crypto industry.

While tampered documents are usually counterfeited original documents, fake documents include manipulations that try to imitate the appearance of a legitimate-looking document but in reality are reproductions of the original. Such forgeries might come in the form of:

Alterations of government-issued document specimens that are publicly available

Premade templates with inserted fake photos and document data

In the first 6 months of 2020, document fraud represented 4% of all fraud in the crypto market (see Graph 2)

Our internal specimen database plays a key role in ensuring the accuracy of document fraud prevention. The database is updated on a daily basis as we carry out extensive document-related research (i.e. we find official specimens, information related to the issuing terms, etc) and cooperate with government authorities across the world.

In addition to our database, Veriff’s fraud prevention engine plays a crucial role in document fraud detection and prevention. When it comes to crypto, fraudsters usually tamper with documents in bulk. This means they often have various amounts of documents but also mobile devices to ensure some kind of anonymity. Luckily, with Veriff’s crosslinking we’re able to see data points that fraudsters are able to change. 

Every time an end-user accesses the verification flow, we collect device and network information. Fraudulent accesses are defined as:
“Accesses associated with one verification session that has been accessed from different countries' networks and multiple devices.”
This is an indicator of the session link being fraudulently shared between different parties. 

In the crypto realm, link-sharing scams are initiated to get victims to sign up with legitimate documents, and then reap the benefits of an account takeover. Usually a fraudster will create an account on a crypto site, entering all the victim’s information that has been scraped from the web, and when the time comes for verification, they send a link to the specific individual - saying ‘verification is required’ for some other purpose. This could range from getting a free box of chocolates, to some kind of exclusive discount, to anything really. We’ve seen a lot of examples!

In the first 6 months of 2020, technical fraud represented 2% of all fraud in the crypto market (see Graph 3).

Thanks to a comprehensive profile of device and network data, we have full control over exactly which pieces of information we use and in what context. We can utilize specific elements of device information, to spot whether camera emulation software was used at any point during the verification process. 

We also perform checks on verification session images, and if there is little-to-no natural movement between them, we raise a risk label to flag this. 

To prevent possible fraudulent access within sessions, we’ve developed a specific risk label that is triggered if we detect the session being accessed from different countries' networks. 

Also added to the mix is crosslinking - if our fraud engine detects previous fraudulent accesses submitted by the same user, all their further verification attempts are automatically blocked as we consider it hard fraud.

Now we come to the two biggest types of fraud in the crypto market, the first of these being identity fraud. Not dissimilar to document fraud which we mentioned earlier, identity fraud is more about impersonation than actual document tampering. And that’s one of the two examples we’ll look to highlight - attempted impersonation and attempted deceit using fake images.

Here’s a real life example from the Veriff team:

“Fraudsters put a fake job ad on a popular social media site claiming to represent a large company. Users applied for the job, and after that the scammers collected the applicants CVs and opened crypto accounts on their behalf. When identity verification for the crypto wallet was required, fraudsters sent verification links to ‘job applicants’ as part of a hiring process. Fortunately the “scammed people” contacted the company for whom they allegedly applied for a job and had done the verification for. Naturally they found out that online identity verification was not part of the company’s hiring process."

In the first 6 months of 2020, identity fraud made up 34% of all fraud in the crypto market (see Graph 4).

In order to detect whether a verification has been initiated with someone else’s physical document, we compare the faces from the selfie and document photo. If our confidence in the  similarity is too low we decline the verification. If we’re not sure, we highlight the appropriate risks and leave the decision for a specialist. 

If the same user tries to submit a different verification attempt in future, we can crosslink the incoming session with the previously declined sessions. 

Finally, we come to recurring fraud - and if you’ve been doing the addition through this report, you’ll know it makes up the lion’s share of fraud in the crypto market. This is also broken down into two examples, one of which is basic ‘recurring’ fraud, where a fraudster has been successful and come back to try again. The other is velocity abuse, which we’ll explain further below.

Here’s another story from the Veriff team:
“We noticed abnormal traffic associated with a car dealership located in the US. In addition to the store’s employees opening crypto accounts and verifying themselves at the spot in the shop, it seemed like shop’s customers were also asked to pose with their documents as a part of the ‘store procedure'. Some of the sessions were guided by what we think was an employee of the shop, some were carried out independently by customers sitting in cars. Unfortunately, this didn't lead anyone to getting a good discount at the car dealership, but a free crypto account was created on their behalf without their knowledge.”

Crypto market experiences the highest rates of multi-accounting due to different promotions involving free money. After getting approved once, fraudsters try to abuse the system and get approved as many times as possible, which usually involves verifying different real users without telling them what they are being verified for. Fraudsters tend to go as far as creating synthetic identities, where they try to create a new identity by combining their real information in conjunction with fake data.

In the first 6 months of 2020, recurring fraud made up 60% of all fraud in the crypto market (see Graph 5).

Recurring fraud is where crosslinks shine the brightest. If we’re confident that the end-user has committed fraud before, we’ll automatically decline all the recurring attempts associated with the same person, device or document. 

Now that we’ve looked at the 4 different types of fraud that we’ve seen within the crypto industry, we can see the full breakdown below (see Graph 6):

Of course in all of the above instances, Veriff is well-placed as a verification provider to fight back against online fraud in all forms. We continue to observe trends across the crypto industry so we can stay ahead of developments, and prevent losses for our crypto partners.

Look out for our next report coming in the near future all about fraud in Fintech.

Get a free trial of Veriff for 30 days with 100 free verifications to get a real look at our fraud prevention capabilities in action. Don't make identity verification a difficult hurdle for your potential customers.

We looked at the impact of financial crime and fraud on crypto in 2020, and the most prevalent types of fraud seen by Veriff, with data gathered from our verification flows.

The Veriff Crypto Fraud Report - January to June 2020

Starting with an overview of the current state of fraud in a growing digital economy, the following report will shed light on the causes and forms of online identity fraud today, and close with industry-specific recommendations on how to put a stop to it.

You can’t sweep identity fraud under the rug in 2019

Since the birth of the World Wide Web 30 years ago, it has become an inseparable aspect of day to day life. Within only a year, the number of users on the Internet increased by 9.1%, compared to a relatively small 1.1% increase in the total population.

Whether it is the sheer increase in the volume of online users, or that fraudsters are innovating at a faster rate than corporate security teams and anti-fraud technology, trust online is increasingly difficult to uphold. If you find this tough to swallow, take a look at the cost of identity fraud for people and businesses.

The consumer and business cost of online identity fraud

In 2018, a staggering $1.48 billion in losses resulting from online fraud complaints reported to the Internet Crime Complaint Center. That’s a 28% increase compared to their 2017 numbers. Businesses aren’t safe either. A 2018 survey published by EY revealed that 33% of surveyed business leaders saw fraud and corruption as one of their greatest risks.

Fintech companies and banks usually come to mind when you think about fraud, but other industries are just susceptible albeit in different ways. According to a study by ThreatMatrix, the fraudulent new-account trend makes global e-commerce transactions ten times riskier than they used to be. 

Adding to that, our data gathered from millions of verifications a year detect that as much as 5% of all attempted verifications are fraudulent, with some industries like cryptocurrency and blocktech seeing rates as high 24.6%. 

The many manifestations of online identity fraud

While identity fraud has a severe impact on private individuals and businesses, it also trickles into political and social issues. Without proper identity verification practices in place, corruption, social manipulation, and a pervasive sense of doubt become serious problems in the modern world. 

Back in 2013, the European Commission found as much as 16% of online reviews were fake. A more recent study by the Washington Post in 2018 estimated 57.8% of reviews for selected products were suspicious.

Rather than bots, which are easy to detect, most fraudulent reviews are a result of multi-accounting. Entirely preventable with the right identity verification process in place, review fraud is particularly disturbing when noting that 84% of people trust online reviews as much as they trust their friends.

2. Political polarization and distrust in media

Trust in online reviews is just the tip of the iceberg. The increasing polarization in today’s social and political spheres is undeniable, and the rise in online adoption has also contributed to the volume of misinformative media channels and accounts online. 

According to the 2019 Digital News Report, almost a third of surveyed participants claimed that they actively avoided the news. Moreover, trust in social media platforms like Facebook and YouTube is also flailing, both as a result of hate speech, fake accounts, and compromised user privacy as seen in the Cambridge Analytica Scandal.

What were once best practices for online safety have become easy to hack by even the most amateur fraudsters. Research by Amnesty International found that hackers were easily capable of breaking into thousands of Yahoo and Gmail accounts, even those with 2FA enabled. 

Other forms of account takeover fraud are also making use of artificial intelligence, and in March 2019 the chief executive of a UK-based subsidiary was impersonated by an AI-based voice manipulation software. The attack resulted in a fraudulent transfer of $243,000, as well as concerns regarding the rise of innovation on the wrong side of the fight against identity fraud. 

The future of fraud prevention will ultimately rely on advances in machine learning and AI-based solutions that are capable of countering such attacks, especially as they increase in volume.

The role of identity verification in fighting fraud

Combating identity fraud and the many facets of its damage calls for changes in the current approach to user verification online. With the rise of internet adoption, fraud innovation and a growing reliance on online reviews and digital media are inevitable. 

We expect to see more verification checks in online services like marketplaces and social media platforms, as well as a couple of other trends that will make more effective identity verification essential in 2020.

Trend #1 - Tighter regulations for fintech companies

The Fintech industry is already on its way as far as regulatory pressure for higher security goes.  On September 14, 2019, the European Union PSD2 directive went into effect, forcing all financial institutions to implement Strong Customer Authentication (SCA) practices. 

The authentication options include a one-time passcode, push notification, and a login or transaction supported by public-key cryptography. And even with these SCA practices in place, our data shows that there is still room for fraud to take place, particularly when it comes to two-factor authentication methods. 

Trend #2 - The need for more secure user authentication

It is expected that companies across all sectors will search for a more secure form of login that does not solely rely on the increasingly vulnerable device authentication. Identity verification software like Veriff will offer much-needed security across a range of services, offering a secure alternative that does not cost companies conversions.

Veriff is used to connect companies with honest customers. Millions of data points collected between January and July 2019 via Veriff’s end-user flow pinpoint the core causes of online identity fraud. However, different industries have varying levels of risk depending on the markets they serve, the nature of the product, and the incentive to commit fraud.

Here are the most common categories of fraud across all industries investigated:

Confirmed Fraud: The document is false, the session is not live, device or document security is compromised, or any other case where fraud is easily confirmed.

Suspicious Behaviour: In our video feed, the user appears to be coerced, under the influence, or other actions suggest access from different locations and devices simultaneously that may be the result of farming, scamming, or other forms of fraud.

Attempted Impersonation: The person’s face doesn’t match the photo in the shown id during verification.

Document Tampering: The selected document looks modified or damaged in a way that suggests tampering.

Velocity Abuse: The same user verifies themselves multiple times after previously being approved.

When it comes to financial institutions such as peer-to-peer lending marketplaces and banking applications, the most prevalent form of fraud falls under the umbrella of suspicious behavior. 

Suspicious behavior encompasses a range of actions monitored via live video feed that suggest the user is unaware of what is occurring, or that the person being verified is not even physically completing the verification process.

The most common form of suspicious behavior observed by is when customers appear to be guided through the process, unaware of what the verification taking place is for. This suggests coercion, alongside other common cases where a third party is holding the ID in front of the end-user, who is simultaneously being guided over the phone or via remote desktop software. 

Other, less common cases of confirmed fraud include falsified documents, photos that are either printed out or not taken during the live session, slideshows used in the video feed, or previously detected fraud activity. Document tampering is also seen in the form of spotted irregularities in IDs and attempted impersonation as the verification process is attempted with another person’s ID.

Recommendations for fintech companies fighting fraud

With the majority of fraud cases identified through live video activity, the fintech industry must be particularly vigilant when it comes to preventing identity fraud. 

Account takeover fraud, in particular, is a high risk, and less secure methods such as a one-time passcodes do not adequately prevent cases of coerced or suspicious logins. In short, the SCA practices enforced by the European Union PSD2 directive do not cut it.

Like the Fintech Industry, the most common form of identity fraud seen in our clients in the gaming industry result from suspicious behavior observed in live video feeds during the verification process. 

However, our gaming industry clients, consisting primarily of esports platforms, see nearly six times more cases of suspicious behavior, which is possibly a result of the appeal of competitive esports to underage audiences. 

Our Gaming clients experience suspicious behavior in 7.69% of all verifications, although not exactly in the same way as fintech clients. In addition to appearing unaware of what the verification process is for, and being guided by a third party, gaming clients also see cases where a third person is submitting a session while the customer is entirely unaware of the process. 

Other industry-specific cases include attempted personation, with minors using their parents’ identification documents as the most common. Document tampering is also seen although not quite as much, and the least common form of identity fraud comes in the form of photos shown from another device which do not belong to the person completing the session.

Recommendations for gaming companies fighting fraud

The competitive gaming industry is booming, with esports in particular set to hit $1.1 billion in revenues in 2019. As the number of investments and interest grows, so will the incentive for identity fraud, both for the sake of accessing high-earning accounts and to bypass age restrictions. Staying vigilant as demand increases will be the key to managing higher volumes of users and fraud.

The mobility industry has some of the lowest identity fraud rates, with suspicious behavior and confirmed fraud nearly neck to neck as the top causes. The mobility sector is relatively new and developing fast, which may explain the significantly lower prevalence of identity fraud in comparison to established industries with higher levels of risk.

Common identity fraud cases in mobility 

Of all forms of suspicious behavior, the most common was the customer being guided through the process while seemingly unaware of what the verification was for. 

Confirmed fraud was often in the form of verification being performed from a compromised device or using an ID that was previously flagged for fraudulent activity. There were also cases where the photos shown during verification were from another device and did not belong to the person submitting the session.

Recommendations for mobility companies fighting fraud

As the mobility sector continues to shift focus away from production and moves towards more service-based business models, account security and anti-fraud practices will become increasingly important. 

Continuously monitoring fraud cases and adapting security measures accordingly will play a huge role in maintaining these low rates in an industry that is growing fast. 

Cryptocurrency and blockchain services experience the highest rates of fraud. The most likely cause for this is the nature of promotional activity in the sector, which usually involves “airdrops” or free money campaigns that give fraudsters a high incentive to cheat the system. This is why velocity abuse is seven times more likely to happen than suspicious behavior.

The most common form of velocity abuse is when a customer is attempting to verify themselves multiple times after being previously approved. This can be done with the same identification document or with different customers using the same device. 

Our crypto industry clients also see forms of suspicious behavior unique to the sector, such as users appearing under the influence and sessions accessible from more than one country and device, suggesting scamming. 

Farming is also uniquely prevalent, where the same user repeatedly submits sessions of other people in the same settings, usually with the portrait pictures taken by someone else. Known fraud in the form of printed photos is also common, as well as slideshows in the video. 

Recommendations for crypto companies fighting fraud

Because cryptocurrency is built on the principles of anonymity and decentralization, introducing identity-based security measures might be faced with high resistance. However, Know Your Customer (KYC) compliance laws will soon apply to many forms of cryptocurrency services, particularly exchanges and wallet services that include the use of fiat currencies. 

With the regulatory environment gaining momentum, it is recommended that cryptocurrency and blocktech companies implement identity verification as soon as possible to minimize the friction that will occur as a result of the transition. 

Keep your eyes on our blog and social channels for more news in identity verification and fraud prevention tips.

The Veriff Identity Fraud Report draws conclusions about the current state of identity fraud. These are based on contemporary research and millions of data points gathered through our verification flows between January and June 2019. 

Reports
Back to all articles

The Veriff Mobility Fraud Report - January to June 2020

The Veriff Fintech Fraud Report - January to June 2020

The Veriff Crypto Fraud Report - January to June 2020

The Veriff Identity Fraud Report 2019

Stay up to date on Veriff news, product updates, and more

ReportsBack to all articles

The Veriff Mobility Fraud Report - January to June 2020

The Veriff Fintech Fraud Report - January to June 2020

The Veriff Crypto Fraud Report - January to June 2020

The Veriff Identity Fraud Report 2019

Stay up to date on Veriff news, product updates, and more

Reports
Back to all articles