Weaponizing Vulnerability: COVID-19 Fraud


We shudder at the word…vulnerable…people feel exposed, violated, insecure, and taken advantage of. And this is where fraudsters thrive. During times of uncertainty, misinformation, and rapid change, fraudsters prey on those caught in the storms of life. While the globe is shutting down, fraudsters are waking up. Vulnerability is certain and the first step in protecting yourself is first identifying that there is weakness. Before 2020, fraud prevention was dynamic but manageable because there was typically a certain vector or vulnerability that fraudsters were targeting. But post pandemic, the floodgates have opened and all I can hear is Cyrus from The Warriors. “…WE got the street suckers! Can you dig it?”


Consumer Vulnerability

As unemployment continues to grow, so does consumer desperation. The more people begin to worry about how they will feed their families, the less they focus on legitimacy of opportunity. This makes it much easier for fraudsters to take advantage of the situation as they prey on weakness. Below are just a few methods that have seen a rise during COVID-19:

  1. Phishing – Phishing emails have increased by over 600% according to InfoSecurity Magazine
    • Common Trends
      • Emails claiming to be from your financial institution
      • Emails from the government about stimulus payments, unemployment, or assistance
      • Emails from the CDC or WHO about a cure or vaccine
    • Protecting Yourself
      • If you didn’t request it, don’t click on it
      • What is the tone of the message? If the email is alarming in nature and is attempting to scare you into clicking a link, don’t click it
      • Who is it coming from? Is the email domain from the typical sender, or does it look like its coming from haha@igotyou.com? If you’re suspicious of the domain, don’t click on it
      • Do they use your name, or something generic? Example. I work for a credit union and our customers are called “members”. If an email begins with “Dear Customer” then it probably isn’t legit. If the email is too generic and is asking for you to click a link to verify, you guessed it. DON’T CLICK ON IT
  2. Scams
    • Relationship – One of, if not the fastest growing trends today. Fraud itself is sad, but to think someone can take advantage of not only financial vulnerability, but emotional vulnerability as well. It’s honestly sickening. Fraudsters will target people online through dating sites and social media, gain their trust, and then use them for illicit financial gain.
      • Signs
        1. They request you to move to a more private messaging environment. They want to get off the dating site as quickly as possible and move to text, email, and are even utilizing apps like Snapchat
        2. They have a dilemma or opportunity that only you can help them with. This involves you opening accounts, accepting money, or sending money on their behalf
        3. Requests to immediately wire, transfer, and also purchase gift cards
      • Protecting Yourself
        1. If you’ve never met them in-person never send money on their behalf
        2. If you feel pressured or rushed, it’s probably a good time to slow down. See how they react.
        3. Reverse search their profile picture on Google. You’ll most likely find that it doesn’t belong to Prince Charming.
    • Work From Home – During COVID-19 this type of scam has become all too easy for fraudsters. Not only are people being laid off, but people are afraid to even go outside which makes the allure of working form home so enticing. Fraudsters see this and are chomping at the bit to come up with new “job openings”. They approach unassuming victims online with surefire ways to quickly make money with little to no experience. These jobs may include becoming a “secret shopper” and sending the mystery employer gift cards purchased with random checks mailed to you ( SPOILER ALERT: the check returns day later and you’re left on the hook). They can also be opportunities to do simple data entry, stuff envelopes, repackage deliveries and mail to a new destination, or the promise to help build your online business with upfront training costs.
      • What Can You Do?
        1. Do your research
        2. Be cautious of opportunities that promise high pay for almost no work
        3. If they require you to open a bank account in order to pay you. DON’T DO IT

Merchant Vulnerability

It’s no secret that spending is down across the board in almost every market segment. Consumers sentiment is down, and transaction behavior is shifting away from in-person purchasing to e-commerce. Luckily this has allowed a lot businesses to stay afloat, but also poses risk due to small businesses not having the resources or expertise to implement the proper controls in their online stores.

  1. Transaction Behavior – As most retailers and stores have closed their doors, consumer behavior has shifted even further to e-commerce. Businesses such as restaurants and even some boutique retailers have shifted to a drive-up/delivery only options which is also driving keyed transactions. The introduction of EMV a few years ago shifted fraud trends heavily to card not present fraud which is extremely difficult to solve for using a rules-based system. COVID is making this even harder as what would have normally been considered “suspicious” is now normal activity for the everyday cardholder.
  2. Carding Shops – Due to increased e-commerce activity driven by quarantine there has been an increase in CNP (card not present) dumps in carding shops on the dark web. Through recent work and partnership with Gemini Advisory we are starting to see cards sell quicker and be used faster by fraudsters. More cards are being compromised, they are being used quicker, and due to the nature of the compromise it is harder to solve with authorization rules. Financial institutions need to become more proactive and dynamic in their approach. It’s time to move away from a strictly rules-based approach and layer a proactive reissue strategy that addresses the problem before it occurs.

Banking Vulnerability

As we head towards a recession, banks tend to allocate more to their allowances for bad debt in order to safeguard against higher delinquency rates. To offset delinquencies, they’re also forced to lend more which can open them up for additional fraud. As consumers reach hardship, banks and credit unions may tweak their underwriting criteria to be more lenient in lending and take on a little more risk. One specific type of fraud poses an enormous amount of risk to financial institutions, and more of the problem stems from the lack of education and awareness around the issue. I’m talking about Synthetic Identity Fraud

Synthetic Identity Fraud, according to the Boston Federal Reserve, occurs when perpetrators combine fictitious as well as real information to create new identities. These can include SSNs (both issued and not), names, DOB, and other forms of PII (personally identifiable information). These are used to defraud financial institutions, government agencies, as well as normal consumers. It is difficult to quantify the impact of synthetics due to their ambiguity and the industry’s failure to properly define them. It is believed that 20% of credit losses in 2016 could be attributed to synthetic identity fraud, and I believe that number has continued to increase over the last few years. But what can financial institutions do?

NECESSARY CHANGES

  • Innovation/Collaboration – Synthetics are so successful because on the surface they look like consumers that financial institutions typically bend over backwards to lend to. But as you dig into the profile you can notice irregular behavior and history that doesn’t support the score being presented. These usually get swept up into credit losses due to not properly being defined, and assumed to be similar to first-pay-defaults. Financial institutions need to change their strategy and approach in order to catch this type of fraud. Historically lending has been based on very simplistic underwriting criteria which synthetics thrive on. But through the use of AI and Machine Learning financial institutions can take advantage of more granular data to identify atypical behavior in the consumer profile. Leveraging big data and AI allows fraud strategy to become more fluid and change much more quickly to address new patterns and trends.
  • Burning Platform – In order for change to occur it first needs to be defined. And through a lot of the work that the Boston Federal Reserve is doing, that is finally happening when it comes to synthetic identities. Legislative change requires a purpose. A “burning platform”. And synthetics are a perfect use case to try to update the outdated landscape of fraud on the legislative level. In order to have success though there needs to be a solution to address the issue which is driven through innovation and collaboration. Thus these two in tandem are necessary in order to create real change.
  • Legislative – True change comes at the legislative level. But nothing hits the Hill if it doesn’t have legs. Burning Platform + Innovation/Collaboration = Legislative Change. Synthetics is the “burning platform”. AI/Machine Learning is the “innovation/collaboration” . As referenced by the Federal Reserve white paper, synthetics are also of concern to government agencies as they can be used for much more sinister reasons than just loan fraud. But that is a discussion for another day (See “Scratching The Surface”).

As COVID-19 continues to spread across the world, fraudsters spread with it. But as I said before, the first step in protecting yourself from fraud is first identifying that there is weakness. This post is meant to be a 30,000 ft picture of the current landscape. Be on the lookout for follow-up posts that dig a little deeper into the intricacies of these schemes.

Never stop chasing checkmate.

1 thought on “Weaponizing Vulnerability: COVID-19 Fraud”

  1. Pingback: Scratching The Surface - Synthetic Identities -

Leave a Reply

Scroll to Top