Fraud

_We’ve been telling enough about the advantages of alternative data and risks associated with collecting conventional data on your borrowers. Today we will demonstrate how personal data usage can not only turn into risk and damage for the financial institution’s working process but also spell disaster for the whole business. We will draw on several cases from our experience, which are: Seasonal Aggravations, Fraudulent Brute Force Attacks, and the Black Swan. What are these risks and how to get protected?_

## Seasonal attacks

New Year’s Eve is a magical time when all our wishes come true. But to really make them true, a grown-up dreamer has to be a good employee for a whole year. If you want something more, you can always call on a lender, and your credit will be surely approved – after all it’s December, the most wonderful time of the year! We expect everyone to be a little kinder, and a credit to be given as easy as a present to be found under the Christmas tree.

To be serious, there is a strong consumers’ belief that big holiday period is the time when credit institutions are happy to approve a loan everyone who needs some spare money and asks for it. Spoiler alert: that is not true. Neither the seasons, nor the weekends or holidays have any effect on the approval range or the risk policy extent.

Yet the demand grows and the number of loan applications grows dramatically as well. As a result, during this “high season” you will receive 100 applications instead of the average 10, for example. Supposing that each tenth application would be fraudulent, we should say there will be ten times more of them than normally. For credit institutions, such a flow is extraordinary yet natural and casual. And as it is casual, it is possible that you will not focus enough on the growing risks.

Nevertheless, these seasonal attacks bring a lot of troubles due to the growing percentage of the “black sheep”: it’s been several years that we register an increase in the number of fraudulent applications at the end of December. The number of such fraudulent requests frequently grows by several times.

![](/uploads/1_2_580eb98141.png)

![](/uploads/2_2_44e7b30b8b.png)

  
Incoming applications risk level at a credit institution in December 2017 and 2018\. A significant growth of fraudulent applications of a high risk can be seen in the twentieth of December. At this moment, the institution is exposed to a higher share of fraudulent applications.

It can be seen on the graphs that the late December was loaded with credit applications on general and risky applications as well, both in 2017 and 2018\. What should a credit institution do in this case?

In order to neutralize such seasonal attacks, we recommend taking a more prudent look on the risk policy. The “seasonal” fraud is usually not of a profound background and most of the risky applications can be easily cut off, saving the business from collateral damage.

Basically, the most efficient way to protect yourself against this type of fraud is setting more rigorous cut-off levels after existing patterns. Of course, this will lead to rejecting some reliable clients too, but if we have to choose between safety and greed, it’s better to choose the first one. The missed profits can be compensated by offering credits with extended limits to a well-known and reliable part of your portfolio.

## Fraudulent brute force attacks

Let’s think of the DDoS attacks, familiar to anyone related to online lending. A cybercriminal overloads the incoming channel with an enormous number of applications in a short period of time until the system breaks down or the security tools kick in, cutting off the source of the threat on one or several IP addresses. In such a case we imagine one or several malicious computers which are the source of the attack and an army of zombie devices willing to destroy their aim.

When we talk about fraudulent brute force attacks, it becomes more complicated. Such an attack is launched from a big number of devices which are no “zombies” but have an individual IP and some supporting data preventing them from being cut off by conventional security tools in one operation.

They also aim at finding weak points in the applications screening system. Such weak points are requests to the data sources which make the basement for the whole system. Credit bureaus, telecommunications operators and other data suppliers give information valuable for the workflow and used in the credit decisioning.

Each supplier has its own limit on requests from a client (credit institution) to be processed. When the limit (usually the lowest) is overcome during an attack, the source is being backed up or falls out of the processing. A security leakage appears where the whole flow of risky applications swoops down to. The decision is taken at random then and the whole flow is being identified either as reliable which brings direct damage or as neutral and is being transferred to manual processing, which slows down the whole thing and draws in the number of credits approved, that is, some profits missed.

![](/uploads/3_37c2059702.png)

![](/uploads/4_2_56fa1f9859.png)

  
An average incoming flow of applications on clients (blue) and two financial institutions from Southeast Asia (orange), affected by a Fraudulent brute force attack in February 2019\. The number of risky applications grew by 3-4 times, which looks abnormal compared to the average level and out of proportion to the normal incoming flow at the beginning of the month.

How could we deal with such evil? The most efficient solution would be monitoring the risk level using fraud score detecting and blocking the most suspicious and active devices, analyzing application frequency from the IP address and subnet. Yet such a method implicates a constant control over the incoming flow by risk managers.

## The “Black Swan”

“Storing and using personal data is dangerous”, we keep telling this over and over again. Sticking to our today topic, we will demonstrate how dangerous it can be. Let’s think for a minute about the worst: another data leakage has occurred and it has end up in the black market. But this time it’s not only about ID details of a client, but all personal data, all the sensitive information, all we had about residence addresses, IDs, insurance numbers, tax reference numbers and any changes made to this data for several years. And it’s not about one unlucky client, but one hundred employees of an unfortunate company in a nameless town.

The situation is fictional of course, yet the threat is more than real. At fraudsters’ disposal, such a data set would be an absolute Black Swan, and the conventional data processing system has no solution against it.

![](/uploads/5_bc52b90341.png)

![](/uploads/6_30f242f7b2.png)

![](/uploads/7_1_e80ae84916.png)

![](/uploads/8_f8acf5ecd3.png)

  
Several “black swan” cases. Average clients’ figures (blue) against clients exposed to the attack (orange). We can see an abnormal grow of risk rating by 4 times.

Although consequences of such attacks are severe, they are not commonplace. It is possible to get prepared, bringing in extra tools of data and loan applications analysis and using poorly reproducible alternative data in the loan workflow.

Thus, detecting repeated devices, combined with cross-checking the data used in different loan applications sent from a same device along with analysis of large deviation markers could be useful.

We hope that the cases demonstrated in our article will foster clients’ determination to use alternative data and extra tools for loans approving and security. It’s useful to remember though that fraudsters do not stay behind in their methods as well, which means that we should always be on our guard.

Our service is a relevant tool to fight against fraud, in line with the today’s realities. It will help you to reduce significantly the consequences from the attacks described above. Yet how useful this tool can be depends on the man, that is, the risk manager who is familiar with modern security tools, literate in data use and understands the incoming signals, has a fast track to handling the threats and helps the business to develop in a most successful way.

**Take care of yourself!**

**Your Juicy Team**

We’ve been telling enough about the advantages of alternative data and risks associated with collecting conventional data on your borrowers. Today we will demonstrate how personal data usage can not only turn into risk and damage for the financial institution’s working process but also spell disaster for the whole business. We will draw on several cases from our experience, which are: Seasonal Aggravations, Fraudulent Brute Force Attacks, and the Black Swan. What are these risks and how to get protected?

0219-1.png

The Dangerous Three: the Most Recent Examples of Fraudulent Attacks

As you may have noticed, this is a topic we just couldn’t ignore.

Thanks to the cryptocurrency market becoming, for better or worse, the latest media darling, the term “blockchain” seems to be on everybody’s lips. By itself, blockchain technology is a collective term that combines both the database (databases) containing information about owners and a number of technologies, such as blockchain (chain of transaction blocks) and distributed ledger technology. It is this sphere that receives the most attention, and the hype is deserved at the moment.

Blockchain (distributed ledger technology) is considered effective because records or transactions are contained in database blocks, where only new records can be added, and cannot be changed without editing the previous blocks in the chain. New blocks are attached to the existing ones and protected by an encrypted digital signature. The reliability of the signature is confirmed by the global computer network. When the block is changed, all blocks associated with it are declared invalid. And since multiple copies of this database or ledger are created, the system immediately identifies unauthorized changes.

Blockchain technology is revolutionary, but you need to understand its limitations and possible vulnerabilities. And, perhaps, in much the same way that the Internet changed how we communicate, blockchain technology will change how we assign value to assets. And furthermore, it will help us to create digital analogs of rights to assets that can be verified without intermediaries.

The significant advantages of distributed ledger technology are the simplification and reduction of costs of complex processes, when the documents of one organization or a small number of others are verified. Some examples of this include:

•legal documents on corporate banking transactions;

•verification of the authenticity of holders of shares, options and other securities, a and the administration of new types of securities (this trend is now developing in the form of primary placement of cryptocurrency);

•work of notaries and verification of powers of attorney (which may significantly change in the future);

•management of logistics and supply chains;

•verification of the authenticity of official documents, drawing up of state certificates, etc.

Today, pioneers are trying to find a practical application of this system to perform various tasks, but they often overlook the existing problems of blockchain.

One of the frequently mentioned tasks which is expected to yield revolutionary results is the remote online identification of users and the creation of a reliable system of protection from online fraud. It should be understood that solving the problem of remote identification or preventing identity theft will eliminate about 20-30% of incidents of online fraud. The pre-feasibility study showed that solving the remote identification problem will face a number of challenges associated with the current form of blockchain technology.

* **False data.** By itself, the blockchain system does not verify the authenticity of the data, but rather protects the existing data from unauthorized changes. In this situation, with the initial input of false data, the system will protect this false data, which creates a serious vulnerability for the “collective fraud” model. Suppose, a remote authentication system was created using the blockchain mechanisms. Let’s say that there is an employee in a large bank with 10 wealthy clients and 10 friends. At the moment of updating or creating identification parameters for clients, the employee invites his friends and proposes them to enter their parameters as identifiers. After entering this data, the system will decide that the customers are the employee’s friends. Further, the employee and his friends will have the opportunity to remotely prepare a “blow” on the bank and other financial institutions.

* **Personal account hacking.** Frequent incidents of hacking of cryptocurrency exchange participants’ private accounts proved that this problem is one of the most serious threats.

* **Synthetic accounts.** This type of attack occurs when fragments of proved data are used from different blockchain systems. Such an attack is based on the fact that a person has on average more than five email addresses, more than three bank cards and more than one SIM-card, which constantly change and therefore they cannot be permanently registered in one system. In the foreseeable future, it will be difficult to build a single system capable of tracking all contact data, including the creation of fictitious companies for 30-50 people with a corporate mail, telephones, “bloated” accounts in social networks and salary projects in banks.

* **Competition for access to information and customers.** This is the format of an indirect attack, when there is a single identification system distributed among the main market participants. Suppose that after the client’s identification with Bank A, he enters Bank B. In this case, Bank B will benefit from opening as many accounts for the client as possible to entice him away from Bank A. As a result, this system will only register new customers without checking existing ones.

* **Operational costs.** If you compare the cost of transaction in a centralized and decentralized system, the difference will exceed 10-100 times in favor of the first one. This is also true for systems performance.

* **51% Attack**. This type of attack takes place when the system that monitors a significant portion of the nodes or the network’s mining capabilities is likely to change values in cells or network ledgers. Currently, almost every network has 2-3 players with the capacity above 40%.

The first three problems listed are based on an important assumption: the blockchain system can control release and use of all identification parameters only within itself and with simultaneous creation. The fourth problem is connected with the fact that the blockchain system is open; there is no competition for access to information, as ledgers are stored on a huge number of nodes.

The need for a remote authentication system is very high. Most likely, such a system will be created on the basis of a centralized approach or distributed ledgers for a small number of participants. However, in the open part of the system, the users will not have the personal data; probably, there will be only their masks (for example, instead of [email@email.ru](mailto:email@email.ru), you have e\*\*\*l@e\*\*\*l.ru) or hashed data will be specified. This system should be managed by an independent operator or a small number of participants who will not be commercially interested in accessing personal data, but will be interested in the number of users. Perhaps, with the solution of these existing problems, we will see the successful implementation of this task on the basis of blockchain approach.

It remains to be seen whether blockchain can be the “end all, be all” solution to online fraud. However, the way the technology is designed does present us with many opportunities to thwart it. Like any new technology, all it takes is a deeper understanding of its strengths and weaknesses.

Have a question for us about something that is relevant to the development of your business? Send your queries to [info@juicyscore.com](mailto:info@juicyscore.com) and we will do our best to cover them in our publications and studies.

As you may have noticed, this is a topic we just couldn’t ignore.

Thanks to the cryptocurrency market becoming, for better or worse, the latest media darling, the term “blockchain” seems to be on everybody’s lips. By itself, blockchain technology is a collective term that combines both the database (databases) containing information about owners and a number of technologies, such as blockchain (chain of transaction blocks) and distributed ledger technology. It is this sphere that receives the most attention, and the hype is deserved at the moment.

blockchain-advertisement-2556699-1.jpg

Can BlockChain Stop Online Fraud? Not Yet

There is clearly a fraud problem in our industry. Over the past year, the level of technical fraud in has increased by a staggering 80%. What’s more, among new applications that have been on the market for more than three years, an average of 4-6% have fallen prey to fraud (and throw in another 10-20% among online lenders that have appeared in the past 12 months).

The main components of technical fraud are still identity theft and the use of frontmen and users in the process of obtaining money. In addition to technical fraud, the so-called “social” fraud is actively developing, characterized by a large number of applications from one real user or using the principle of the “pyramid”: the borrower successfully takes several loans in a row, each time raising their credit limit, and when the maximum limit is reached, he refuses to pay the credit.

To better understand the existing mechanisms and ecosystem of fraudulent networks in Russia, we have conducted a detailed geographic analysis of the spread of fraud and the technologies used in it. The analysis included more than 500 Russian cities. According to the results obtained, more than 30% of all technical cases and about 10-15% of the cases of social fraud are related locations with socio-taught situation. The risk level for cities is shown in the following graph:

![](/uploads/c01cfe72_4c21_4d7a_80d0_56eed731cc6e_1024x618_min_2_791446d818.png)

  
_Graph: The level of risk in Russia corresponds to the color of the marker – min = 0.05 and max = 0.37;_ 
_The size of the marker corresponds to the number of applications in the city_

**_There are four types of cities in which the level of risk of fraud is much higher than average:_**

- Satellite towns of large centers, where penitentiary institutions are located.
- Socially unprotected cities.This includes those dominated by “social” fraud, for example, the town of Kondopoga and some towns in the Crimea. After discussion with the market leaders, we found out that it is a standard practice to block applications from towns that met this criteria. However, it is our opinion that this is excessive and creates niches for other players in the market.
- Regime cities. A number of closed cities, “military towns”, and several small towns with a predominance of technical fraud; for example, the village of Lenin and the town of Uzhur.
- Cities associated with botnets and fraudnets. Such associations are easy to detect and their applications are, as a rule, immediately eliminated. (A good example is the town of Timashevsk.) Most likely, these technologies are used for stress-testing of systems and more effective SEO indexing of sites by search engines.

Observation: If we exclude the first 41 towns with the highest risk of fraud (15% of observations), the average level of risk in the regions becomes more homogeneous.

We hope that our review was helpful to you. In the future, we are planning to conduct similar studies and familiarize market participants with them. The more we educate ourselves about fraud, the better we can protect the entire industry from it.

Have a question for us about something that is relevant to the development of your business? Send your queries to [info@juicyscore.com](mailto:info@juicyscore.com) and we will do our best to cover them in our publications and studies.

There is clearly a fraud problem in our industry. Over the past year, the level of technical fraud in has increased by a staggering 80%. What’s more, among new applications that have been on the market for more than three years, an average of 4-6% have fallen prey to fraud (and throw in another 10-20% among online lenders that have appeared in the past 12 months).

-------------_----.png

The Fascinating Geography of Online Fraud in Russia

Snap

AdsTwitter

GTAG

!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-NTGCZRN",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")

GTM.start

function gtag(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],gtag("js",new Date),gtag("config","G-16F2F1RKM2")

Fraud

A collection of 3 posts

The Dangerous Three: the Most Recent Examples of Fraudulent Attacks

Can BlockChain Stop Online Fraud? Not Yet

The Fascinating Geography of Online Fraud in Russia

The company

Products

Rules