Bubbling Up: The rise of fraud in the COVID-19 economy [Feature]

Instances of detectable auto fraud and cybersecurity breaches are likely to bubble up amid declining vehicle sales as the COVID-19 crisis forces dealerships to shift their focus to online sales, and lenders’ employees work remotely. Car loan applications have dropped between 30% to 50% for some lenders, and one would expected that the number of fraudulent applications would fall in tandem with overall volume, but they’re not, said Frank McKenna, chief fraud strategist at PointPredictive . “We are not seeing a corresponding drop in the number of fraud applications. This, in turn, is leading to the higher rate of fraud.” In times of recession and crisis, fraud rates traditionally rise. “Whether it is due to borrower desperation, sales pressure at dealerships or more active fraud rings taking advantage of the chaos, the stage has been set for higher fraud and default risk moving forward,” McKenna said. Just how much higher, though, is still up for debate. Last year, losses incurred due to fraud in the auto finance industry were estimated to clock in north of $7 billion. Prior to the outbreak of the coronavirus, that figure was expected to reach $7.3 billion, but forecasting total fraud exposure at this point is “enormously difficult,” McKenna said. “What we do anticipate is that fraud rates and early pay default rates could increase up to 30%, since that was the experience during the recession of 2008,” he explained. Fraudsters thrive in economic environments that limit in-person human interaction, said Todd Wolf, chairman of the Auto Finance Coalition (AFC). “Many, if not most, auto dealers are moving 100% online, which fraudsters love,” he said, noting that having little or no face-to-face contact lowers their exposure to being identified. In fact, the move to a fully digital process is inviting for would-be fraudsters and cyber attackers. “Online applications not only provide the sort of anonymity that fraudsters love, but it also emboldens them because they can test many different identities across lenders and dealers until they find someone that will accept and approve the application,” McKenna explained. “It becomes easier for them to identify the ‘weakest link’ lenders and dealerships and then exploit that weakness.” The devil is in the details Fraud tends to “bubble up” in periods of economic crisis for three reasons, McKenna said. First, fraud isn’t easily hidden when origination volume falls, since the number of fraudulent applications doesn’t decrease with contract volume. Second, loans that were taken out with fraudulent information are less likely to perform when the economy goes bad — even if borrowers were previously making payments. Finally, tightening underwriting criteria and high unemployment often encourages fringe borrowers and auto dealers to misrepresent their financial information in order to qualify for a loan. The combination of tightening credit terms on lenders’ scorecards and deteriorating financial health for consumers increases the demand for synthetic ID increases, McKenna said. A synthetic ID is a fraudulent identity that combines fictitious information, such as a name, with real information, such as a child’s Social Security number. In the last three years, the risk level due to synthetic borrowers on auto applications has increased by more than 240%. “We’re expecting even higher increases going forward,” McKenna said, mostly due to illegitimate companies touting “credit washing,” or when all negative items from a consumer’s credit report are removed, effectively building a new credit profile. “Since COVID-19, we’re seeing high activity on social media where these companies promote a wide variety of questionable services to desperate borrowers, encouraging them to ‘use the pandemic to your advantage,’” he explained. However, auto lenders’ blanket payment-deferral programs might make it hard to identify fraudulent accounts, AFC’s Wolf said. “These programs offer fraudsters a set time period where they can capitalize on [these programs], which gives them extra time to sell or export the vehicle,” Wolf said, noting that lenders won’t see the fraud for several months, after payment-deferral programs expire. Coupled with record unemployment, many lenders will assume the default is due to economic hardship, not outright fraud. But synthetic identities and fraudulent loan applications are not the only scams lenders need to guard against. As most companies’ workforces are stuck sheltering-in-place, another threat lurks beneath the surface. Hackers sense vulnerability For auto lenders, storing and processing immense amounts of consumer data and personal information is the norm. However, with businesses forced to adopt work-from-home policies amid the coronavirus pandemic, lenders become vulnerable targets in cyberspace. Hackers are lurking and looking to leverage the work-from-home culture and unguarded touchpoints. “Financial institutions are always at risk and with COVID-19 more at risk than usual,” said Steve Hunt, senior analyst at Aite Group . Email has the highest risk exposure. In fact, 94% of all cyberattacks against financiers, including auto lenders, originate in emails. Phishing, spear-phishing, ransomware and business email compromise accounted for billions of dollars of loss in 2019, and already show an increase. Figures in March 2020 showed an apparent tripling of the number of attacks targeting lenders, according to Hunt. Why? Because attackers thrive on uncertainty. On top of that, the auto finance industry is multifaceted. “In economically bad times, such as when an economic climate or credit cycle turns, the ugly side of lending is revealed,” Hunt explained. “Commitments to borrowers get fully utilized, debt-service coverage ratios crater, and deals turn out not to be structured as intended.” Unfortunately, such will be the case as the COVID-19 pandemic and its attenuating cancellations, business closures and social distancing surge through the world of small and midsize businesses that borrow from financial institutions. “Bad actors use that chaos to their advantage,” Hunt added, “and they have been quick to capitalize on the fear that surrounds the global outbreak.” Employees are the first point of vulnerability auto lenders need to be aware of since their credentials are the most common targets for attackers. Employees anxious for updates from management or the Centers for Disease Control and Prevention are attractive targets of COVID-19 themed and CDC themed phishing attacks. Moreover, employees working from home are connecting to outside networks and systems, representing new points of vulnerability. “Most lenders do not have policies permitting large numbers of workers to access sensitive assets and back-office systems from untrusted home networks,” Hunt said. “They will have to adjust with VPN access and careful privilege management.” Further, the COVID-19 environment can cause employees to be frazzled and overworked, making them more susceptible to fraudulent requests for money transfers. “Commonly, these take the form of an impersonation of a CEO requesting a wire transfer to a bank account,” Hunt said. “With entire companies working from home, this type of fraud will be easier to do and be more prevalent.” As companies experience layoffs and furloughs, it is likely that departments will be shorthanded, including the IT department, Hunt said. To that end, IT work is slowed, causing maintenance backlogs and slower response times. “Updates and regular maintenance are considered best practices to shorten windows of vulnerability,” he added. “Attackers use out-of-date systems to compromise security and execute ransomware.” Batten down the hatches With fraud and cybersecurity experts anticipating a large uptick in fraud related crimes and cybersecurity breaches due to the COVID-19 pandemic, lenders are advised to stay the course with their best practices and technology used daily to help mitigate fraud loss, AFC’s Wolf said. “Lenders need to remind their underwriters and credit analysts to watch out for fraud applications,” Wolf said. “If a credit application is viewed with human eyes, ensure all the data in the credit application, credit report and other databases make sense.” In fact, lenders can leverage the Dealer Fraud Awareness and Prevention Checklist and Dealers Offsite Delivery Checklist, Wolf said. Put out by the AFC and International Association of Auto Theft Investigators, these documents are used as tools to assist dealers to lower their fraud exposure, especially with regard to COVID-19. “It isn't a catchall, but used properly they are a guide to help identify red flags,” Wolf explained. “These documents have been shared with the National Automobile Dealers Association and can also be used by underwriters and credit analysts as a tool to assist in their decisions if red flags present themselves.” Other ways lenders and dealers can protect themselves are by monitoring their online applications, including tracking those based on their device IDs or IP addresses, PointPredictive’s McKenna said. “Monitor the velocity, timing and speed of submissions, and look for fraud patterns that are far different than their normal borrower profiles,” he said. “If you see sudden spikes geographically that differ from their historical averages, that could be an indication they are being attacked by a synthetic, or identity-theft fraud ring.” For cybersecurity, lenders equipped with an eagle eye into consumers’ finances and cash flows are in a unique position to provide advice about managing financial commitments optimally and maximizing their resilience, Aite Group’s Hunt said. At the same time, he advises lenders to cover their flanks. “This is the time to turn to your security and IT service providers and vendors to help you upgrade controls such as strong authentication, secure connectivity, distributed access and managed security monitoring,” Hunt said. “These will help you extend private networking environments securely.” In terms of workforce, lenders should ensure all remote employees’ work is screened just as that of in-office employees to detect any theft of funds or data, or other unacceptable actions. Moreover, instituting multifactor authentication via platforms like Microsoft Authenticator and Google Authenticator is helpful. Attackers exploit identity credentials to perform their most frequent and damaging breaches. Defend against business email compromise by vigilantly implementing a callback policy, with no exceptions allowed. Upon receiving a request for assets or information, the employee should hang up and call the requester back using numbers from the company directory. Finally, application and operating system updates should be prioritized so patch levels of servers and applications remain up to date. “Regular system updates keep attackers at bay,” Hunt said. Editors’ Note: This article first appeared in the May issue of Auto Finance News, available now.

Bubbling Up: The rise of fraud in the COVID-19 economy [Feature]

Letter from the Auto Finance Summit Chairman

Americans again file by the millions for unemployment benefits

Related Posts

Weekly Wrap: An all-in interest rate cap looms, inclusive lending in the spotlight

Tricolor Auto launches AI-powered software service

Credit Unions eye growth after flat 2020

Americans again file by the millions for unemployment benefits

INNOVATION & TECHNOLOGY

Volvo to go electric-only and shift sales online from 2030

Digital lending lags despite consumer expectations

CORONAVIRUS

Q4 brings positive delinquencies, mixed originations for auto finance

Carvana enjoys Q4 hike in finance GPU, origination volume

SPONSORED

Collateral Protection Insurance (CPI): What is CPI and what does it do?

Driving Customer Loyalty, Retention After Total Loss

When tough times hit, proactive strategies pay

About

Contact Us

Follow Us

Bubbling Up: The rise of fraud in the COVID-19 economy [Feature]

Already subscribed? Log in below.

Letter from the Auto Finance Summit Chairman

Americans again file by the millions for unemployment benefits

Related Posts

By subscribing you agree to our Terms of Use and Privacy Policy

CORONAVIRUS

SPONSORED

About

Contact Us

Follow Us