The cryptocurrency market is subjected to the highest fraud rate compared to other industries that Veriff works with right now. In fact this was still the case when we wrote our first fraud report, midway through last year, and this isn’t looking to change very fast.

The industry itself gains popularity day-by-day, by enabling faster and lower-cost international transactions, along with different promotional activities, which in turn lures criminals willing to cheat the system. And crypto itself is still seen in some quarters as a niche interest, but as the value of some of the more stable coins stays high, it’s worth understanding it all a little better.

To do that, we’d recommend our accompanying blogs - a Geek’s Guide to Crypto and Why Crypto is Ready for IDV to help you brush up before getting into the nitty gritty of this report.

As an illustration of the level of global financial crime within cryptocurrency alone, in 2019 cyber criminals were able to siphon away $4.26 billion from cryptocurrency users and exchanges. In the larger cases, this was down to sophisticated hacking of wallets and exchanges, but like all financial crime, there are larger and smaller scale examples.

One of the more public examples of fraudulent activity around crypto took place on Twitter recently, as a number of celebrities had their accounts hacked, and links were placed with the enticement to “send money here and you’ll get double back”. Unsurprisingly, those who sent crypto saw none in return and the scammers were quickly taken down, but not before damage had been done.

We wanted to take a deeper look into the ways in which criminals look to exploit cryptocurrencies through identity-related fraud, the trends we’ve observed, and how Veriff is designed to help crypto fight back.

Veriff has an in-house built fraud prevention engine that is automating the decision making process and also assists specialists in case an automatic decision can’t be made (a hybrid approach). The engine can be broken into smaller pieces but all of them revolve around our proprietary device fingerprinting solution (see Graph 1).

Crosslinking allows Veriff to group together sessions that share similar data points. Based on previous knowledge, fraudsters don’t tend to limit themselves to one try - they’ll try to get verified today, tomorrow and in the upcoming months and they won’t stop as long as they have fake identities. All the information from crosslinks is taken into account by our automatic decision engine, and is forwarded to our clients.

Velocity/Abuse ensures that no end-user abuses your service via multi-accounting. Taking into account all of the information we see through crosslinks, we can automatically shut down users if they, their document, or device have been approved before. We have three velocity checks that can be activated altogether or independently from each other:

Duplicated user - checks whether the person has been approved before

Duplicated document - checks whether the document has been approved before

Duplicated device - checks whether the same device has been approved before

Risk labels point out the signs of fraudulent behavior in sessions. These labels are used by our specialists in more detailed security review and are forwarded to clients to give insight about the final decision and help in post analysis.

What types of fraud are we discussing here?

When it comes to Crypto, we can break fraud down into 4 main types:

We’ll look at each in depth, what they are, the types we see most regularly, and the impact within the crypto industry.

This is often the type of identity fraud that leaps to mind first - tampered or entirely fake identity documents. These often exist in the form of fake IDs for a specific real world application - normally gaining access to something you’re underage for - but online there is normally more skill that goes into their creation, and they look to serve a monetary purpose, frequently some form of financial bonus on offer for inviting more users to a site.

There are various methods of tampering, but the end result always includes slight alterations made to a legitimate document in order to partially or entirely change the holder’s identity. Forgeries include but are not limited to:

Overwriting document data with a pen, pencil or other simple tools

Adding/removing specific document data or elements

While tampered documents are usually counterfeited original documents, fake documents include manipulations that try to imitate the appearance of a legitimate-looking document but in reality are reproductions of the original. Such forgeries might come in the form of:

Alterations of government-issued document specimens that are publicly available

Premade templates with inserted fake photos and document data

In the first 6 months of 2020, document fraud represented 4% of all fraud in the crypto market (see Graph 2)

Our internal specimen database plays a key role in ensuring the accuracy of document fraud prevention. The database is updated on a daily basis as we carry out extensive document-related research (i.e. we find official specimens, information related to the issuing terms, etc) and cooperate with government authorities across the world.

In addition to our database, Veriff’s fraud prevention engine plays a crucial role in document fraud detection and prevention. When it comes to crypto, fraudsters usually tamper with documents in bulk. This means they often have various amounts of documents but also mobile devices to ensure some kind of anonymity. Luckily, with Veriff’s crosslinking we’re able to see data points that fraudsters are able to change. 

This is exactly what you’d perhaps expect, fraud which involves a degree of technical skill which an average person wouldn’t possess. In this instance, we’re looking at streamed images and fraudulent access, two methods to take advantage of offers and make potential monetary gains.

Images and/or videos are streamed (or a slideshow)

This type of fraud happens when a verification includes media that’s coming from an emulated camera source. A fraudster might collect the portrait and document pictures belonging to different people in advance, edit them into a video and stream this inside Veriff’s flow to imitate the process being live.

Every time an end-user accesses the verification flow, we collect device and network information. Fraudulent accesses are defined as:
“Accesses associated with one verification session that has been accessed from different countries' networks and multiple devices.”
This is an indicator of the session link being fraudulently shared between different parties. 

In the crypto realm, link-sharing scams are initiated to get victims to sign up with legitimate documents, and then reap the benefits of an account takeover. Usually a fraudster will create an account on a crypto site, entering all the victim’s information that has been scraped from the web, and when the time comes for verification, they send a link to the specific individual - saying ‘verification is required’ for some other purpose. This could range from getting a free box of chocolates, to some kind of exclusive discount, to anything really. We’ve seen a lot of examples!

In the first 6 months of 2020, technical fraud represented 2% of all fraud in the crypto market (see Graph 3).

Thanks to a comprehensive profile of device and network data, we have full control over exactly which pieces of information we use and in what context. We can utilize specific elements of device information, to spot whether camera emulation software was used at any point during the verification process. 

We also perform checks on verification session images, and if there is little-to-no natural movement between them, we raise a risk label to flag this. 

To prevent possible fraudulent access within sessions, we’ve developed a specific risk label that is triggered if we detect the session being accessed from different countries' networks. 

Also added to the mix is crosslinking - if our fraud engine detects previous fraudulent accesses submitted by the same user, all their further verification attempts are automatically blocked as we consider it hard fraud.

Now we come to the two biggest types of fraud in the crypto market, the first of these being identity fraud. Not dissimilar to document fraud which we mentioned earlier, identity fraud is more about impersonation than actual document tampering. And that’s one of the two examples we’ll look to highlight - attempted impersonation and attempted deceit using fake images.

Attempted impersonation is the intentional use of someone else’s identity document with the aim of obtaining access to the service on someone else’s behalf. This type of fraud usually uses an illegally obtained physical document of the victim presented by a fraudster.

Here’s a real life example from the Veriff team:

“Fraudsters put a fake job ad on a popular social media site claiming to represent a large company. Users applied for the job, and after that the scammers collected the applicants CVs and opened crypto accounts on their behalf. When identity verification for the crypto wallet was required, fraudsters sent verification links to ‘job applicants’ as part of a hiring process. Fortunately the “scammed people” contacted the company for whom they allegedly applied for a job and had done the verification for. Naturally they found out that online identity verification was not part of the company’s hiring process."

The end-user doesn’t show a real physical document, but shows it from a device screen or a printed-out paper as they’re using someone else's digital document or a digitally manipulated document of their own.

In the first 6 months of 2020, identity fraud made up 34% of all fraud in the crypto market (see Graph 4).

In order to detect whether a verification has been initiated with someone else’s physical document, we compare the faces from the selfie and document photo. If our confidence in the  similarity is too low we decline the verification. If we’re not sure, we highlight the appropriate risks and leave the decision for a specialist. 

If the same user tries to submit a different verification attempt in future, we can crosslink the incoming session with the previously declined sessions. 

Finally, we come to recurring fraud - and if you’ve been doing the addition through this report, you’ll know it makes up the lion’s share of fraud in the crypto market. This is also broken down into two examples, one of which is basic ‘recurring’ fraud, where a fraudster has been successful and come back to try again. The other is velocity abuse, which we’ll explain further below.

Here’s another story from the Veriff team:
“We noticed abnormal traffic associated with a car dealership located in the US. In addition to the store’s employees opening crypto accounts and verifying themselves at the spot in the shop, it seemed like shop’s customers were also asked to pose with their documents as a part of the ‘store procedure'. Some of the sessions were guided by what we think was an employee of the shop, some were carried out independently by customers sitting in cars. Unfortunately, this didn't lead anyone to getting a good discount at the car dealership, but a free crypto account was created on their behalf without their knowledge.”

Recurring - Strong links to previous fraud

If fraudsters manage to abuse the system - they will come back and try again, if they fail to do so - they will come back and try twice as hard.

Crypto market experiences the highest rates of multi-accounting due to different promotions involving free money. After getting approved once, fraudsters try to abuse the system and get approved as many times as possible, which usually involves verifying different real users without telling them what they are being verified for. Fraudsters tend to go as far as creating synthetic identities, where they try to create a new identity by combining their real information in conjunction with fake data.

In the first 6 months of 2020, recurring fraud made up 60% of all fraud in the crypto market (see Graph 5).

Recurring fraud is where crosslinks shine the brightest. If we’re confident that the end-user has committed fraud before, we’ll automatically decline all the recurring attempts associated with the same person, device or document. 

If the same person, document or device have been found approved in the historically submitted sessions, all the recurring attempts will be declined with Velocity/Abuse. 

Now that we’ve looked at the 4 different types of fraud that we’ve seen within the crypto industry, we can see the full breakdown below (see Graph 6):

Of course in all of the above instances, Veriff is well-placed as a verification provider to fight back against online fraud in all forms. We continue to observe trends across the crypto industry so we can stay ahead of developments, and prevent losses for our crypto partners.

Look out for our next report coming in the near future all about fraud in Fintech.

Get a free trial of Veriff for 30 days with 100 free verifications to get a real look at our fraud prevention capabilities in action. Don't make identity verification a difficult hurdle for your potential customers.

We looked at the impact of financial crime and fraud on crypto in 2020, and the most prevalent types of fraud seen by Veriff, with data gathered from our verification flows.

The Veriff Crypto Fraud Report - January to June 2020

Starting with an overview of the current state of fraud in a growing digital economy, the following report will shed light on the causes and forms of online identity fraud today, and close with industry-specific recommendations on how to put a stop to it.

You can’t sweep identity fraud under the rug in 2019

Since the birth of the World Wide Web 30 years ago, it has become an inseparable aspect of day to day life. Within only a year, the number of users on the Internet increased by 9.1%, compared to a relatively small 1.1% increase in the total population.

Whether it is the sheer increase in the volume of online users, or that fraudsters are innovating at a faster rate than corporate security teams and anti-fraud technology, trust online is increasingly difficult to uphold. If you find this tough to swallow, take a look at the cost of identity fraud for people and businesses.

The consumer and business cost of online identity fraud

In 2018, a staggering $1.48 billion in losses resulting from online fraud complaints reported to the Internet Crime Complaint Center. That’s a 28% increase compared to their 2017 numbers. Businesses aren’t safe either. A 2018 survey published by EY revealed that 33% of surveyed business leaders saw fraud and corruption as one of their greatest risks.

Fintech companies and banks usually come to mind when you think about fraud, but other industries are just susceptible albeit in different ways. According to a study by ThreatMatrix, the fraudulent new-account trend makes global e-commerce transactions ten times riskier than they used to be. 

Adding to that, our data gathered from millions of verifications a year detect that as much as 5% of all attempted verifications are fraudulent, with some industries like cryptocurrency and blocktech seeing rates as high 24.6%. 

The many manifestations of online identity fraud

While identity fraud has a severe impact on private individuals and businesses, it also trickles into political and social issues. Without proper identity verification practices in place, corruption, social manipulation, and a pervasive sense of doubt become serious problems in the modern world. 

Back in 2013, the European Commission found as much as 16% of online reviews were fake. A more recent study by the Washington Post in 2018 estimated 57.8% of reviews for selected products were suspicious.

Rather than bots, which are easy to detect, most fraudulent reviews are a result of multi-accounting. Entirely preventable with the right identity verification process in place, review fraud is particularly disturbing when noting that 84% of people trust online reviews as much as they trust their friends.

2. Political polarization and distrust in media

Trust in online reviews is just the tip of the iceberg. The increasing polarization in today’s social and political spheres is undeniable, and the rise in online adoption has also contributed to the volume of misinformative media channels and accounts online. 

According to the 2019 Digital News Report, almost a third of surveyed participants claimed that they actively avoided the news. Moreover, trust in social media platforms like Facebook and YouTube is also flailing, both as a result of hate speech, fake accounts, and compromised user privacy as seen in the Cambridge Analytica Scandal.

What were once best practices for online safety have become easy to hack by even the most amateur fraudsters. Research by Amnesty International found that hackers were easily capable of breaking into thousands of Yahoo and Gmail accounts, even those with 2FA enabled. 

Other forms of account takeover fraud are also making use of artificial intelligence, and in March 2019 the chief executive of a UK-based subsidiary was impersonated by an AI-based voice manipulation software. The attack resulted in a fraudulent transfer of $243,000, as well as concerns regarding the rise of innovation on the wrong side of the fight against identity fraud. 

The future of fraud prevention will ultimately rely on advances in machine learning and AI-based solutions that are capable of countering such attacks, especially as they increase in volume.

The role of identity verification in fighting fraud

Combating identity fraud and the many facets of its damage calls for changes in the current approach to user verification online. With the rise of internet adoption, fraud innovation and a growing reliance on online reviews and digital media are inevitable. 

We expect to see more verification checks in online services like marketplaces and social media platforms, as well as a couple of other trends that will make more effective identity verification essential in 2020.

Trend #1 - Tighter regulations for fintech companies

The Fintech industry is already on its way as far as regulatory pressure for higher security goes.  On September 14, 2019, the European Union PSD2 directive went into effect, forcing all financial institutions to implement Strong Customer Authentication (SCA) practices. 

The authentication options include a one-time passcode, push notification, and a login or transaction supported by public-key cryptography. And even with these SCA practices in place, our data shows that there is still room for fraud to take place, particularly when it comes to two-factor authentication methods. 

Trend #2 - The need for more secure user authentication

It is expected that companies across all sectors will search for a more secure form of login that does not solely rely on the increasingly vulnerable device authentication. Identity verification software like Veriff will offer much-needed security across a range of services, offering a secure alternative that does not cost companies conversions.

Veriff is used to connect companies with honest customers. Millions of data points collected between January and July 2019 via Veriff’s end-user flow pinpoint the core causes of online identity fraud. However, different industries have varying levels of risk depending on the markets they serve, the nature of the product, and the incentive to commit fraud.

Here are the most common categories of fraud across all industries investigated:

Confirmed Fraud: The document is false, the session is not live, device or document security is compromised, or any other case where fraud is easily confirmed.

Suspicious Behaviour: In our video feed, the user appears to be coerced, under the influence, or other actions suggest access from different locations and devices simultaneously that may be the result of farming, scamming, or other forms of fraud.

Attempted Impersonation: The person’s face doesn’t match the photo in the shown id during verification.

Document Tampering: The selected document looks modified or damaged in a way that suggests tampering.

Velocity Abuse: The same user verifies themselves multiple times after previously being approved.

When it comes to financial institutions such as peer-to-peer lending marketplaces and banking applications, the most prevalent form of fraud falls under the umbrella of suspicious behavior. 

Suspicious behavior encompasses a range of actions monitored via live video feed that suggest the user is unaware of what is occurring, or that the person being verified is not even physically completing the verification process.

The most common form of suspicious behavior observed by is when customers appear to be guided through the process, unaware of what the verification taking place is for. This suggests coercion, alongside other common cases where a third party is holding the ID in front of the end-user, who is simultaneously being guided over the phone or via remote desktop software. 

Other, less common cases of confirmed fraud include falsified documents, photos that are either printed out or not taken during the live session, slideshows used in the video feed, or previously detected fraud activity. Document tampering is also seen in the form of spotted irregularities in IDs and attempted impersonation as the verification process is attempted with another person’s ID.

Recommendations for fintech companies fighting fraud

With the majority of fraud cases identified through live video activity, the fintech industry must be particularly vigilant when it comes to preventing identity fraud. 

Account takeover fraud, in particular, is a high risk, and less secure methods such as a one-time passcodes do not adequately prevent cases of coerced or suspicious logins. In short, the SCA practices enforced by the European Union PSD2 directive do not cut it.

Like the Fintech Industry, the most common form of identity fraud seen in our clients in the gaming industry result from suspicious behavior observed in live video feeds during the verification process. 

However, our gaming industry clients, consisting primarily of esports platforms, see nearly six times more cases of suspicious behavior, which is possibly a result of the appeal of competitive esports to underage audiences. 

Our Gaming clients experience suspicious behavior in 7.69% of all verifications, although not exactly in the same way as fintech clients. In addition to appearing unaware of what the verification process is for, and being guided by a third party, gaming clients also see cases where a third person is submitting a session while the customer is entirely unaware of the process. 

Other industry-specific cases include attempted personation, with minors using their parents’ identification documents as the most common. Document tampering is also seen although not quite as much, and the least common form of identity fraud comes in the form of photos shown from another device which do not belong to the person completing the session.

Recommendations for gaming companies fighting fraud

The competitive gaming industry is booming, with esports in particular set to hit $1.1 billion in revenues in 2019. As the number of investments and interest grows, so will the incentive for identity fraud, both for the sake of accessing high-earning accounts and to bypass age restrictions. Staying vigilant as demand increases will be the key to managing higher volumes of users and fraud.

The mobility industry has some of the lowest identity fraud rates, with suspicious behavior and confirmed fraud nearly neck to neck as the top causes. The mobility sector is relatively new and developing fast, which may explain the significantly lower prevalence of identity fraud in comparison to established industries with higher levels of risk.

Common identity fraud cases in mobility 

Of all forms of suspicious behavior, the most common was the customer being guided through the process while seemingly unaware of what the verification was for. 

Confirmed fraud was often in the form of verification being performed from a compromised device or using an ID that was previously flagged for fraudulent activity. There were also cases where the photos shown during verification were from another device and did not belong to the person submitting the session.

Recommendations for mobility companies fighting fraud

As the mobility sector continues to shift focus away from production and moves towards more service-based business models, account security and anti-fraud practices will become increasingly important. 

Continuously monitoring fraud cases and adapting security measures accordingly will play a huge role in maintaining these low rates in an industry that is growing fast. 

Cryptocurrency and blockchain services experience the highest rates of fraud. The most likely cause for this is the nature of promotional activity in the sector, which usually involves “airdrops” or free money campaigns that give fraudsters a high incentive to cheat the system. This is why velocity abuse is seven times more likely to happen than suspicious behavior.

The most common form of velocity abuse is when a customer is attempting to verify themselves multiple times after being previously approved. This can be done with the same identification document or with different customers using the same device. 

Our crypto industry clients also see forms of suspicious behavior unique to the sector, such as users appearing under the influence and sessions accessible from more than one country and device, suggesting scamming. 

Farming is also uniquely prevalent, where the same user repeatedly submits sessions of other people in the same settings, usually with the portrait pictures taken by someone else. Known fraud in the form of printed photos is also common, as well as slideshows in the video. 

Recommendations for crypto companies fighting fraud

Because cryptocurrency is built on the principles of anonymity and decentralization, introducing identity-based security measures might be faced with high resistance. However, Know Your Customer (KYC) compliance laws will soon apply to many forms of cryptocurrency services, particularly exchanges and wallet services that include the use of fiat currencies. 

With the regulatory environment gaining momentum, it is recommended that cryptocurrency and blocktech companies implement identity verification as soon as possible to minimize the friction that will occur as a result of the transition. 

Keep your eyes on our blog and social channels for more news in identity verification and fraud prevention tips.

The Veriff Identity Fraud Report draws conclusions about the current state of identity fraud. These are based on contemporary research and millions of data points gathered through our verification flows between January and June 2019. 

Reports
Back to all articles

The Veriff Crypto Fraud Report - January to June 2020

The Veriff Identity Fraud Report 2019

Stay up to date on Veriff news, product updates, and more

ReportsBack to all articles

The Veriff Crypto Fraud Report - January to June 2020

The Veriff Identity Fraud Report 2019

Stay up to date on Veriff news, product updates, and more

Reports
Back to all articles