Stop identity fraud with income document authentication

Data breaches continue to become more and more common. The highly publicised Australian telco data breach drew a heightened focus on identity protection and identity fraud. There are many ways for fraudsters to get hold of personal data – whether it’s purchased online, a payroll breach, a targeted personal attack or a malicious insider.

PwC’s Global Economic Crime Survey had some startling statistics with increasing syndicated crime in conjunction with customer fraud, in particular identity-related fraud (with identity takeover, device cloning and synthetic ID) being the most prevalent issues over the past two years.

Many organisations such as banks, lenders, insurers and property managers manually process and verify thousands of proof of income documents each day – including payslips, bank statements, business activity statements (BAS) and tax notice of assessments (NOA) from the Australian Taxation Office. (Read more about automated income verification in this post.)

What these organisations might not know is that those documents contain crucial information in detecting potential identity or income fraud. Let’s explore why these documents are important in helping prevent fraud and protect victims of identity crime.

Typical application process

Let’s start with a typical application process – this is presented as a loan application process but it’s similar for other use cases.

1. Application creation and submission: The applicant is “onboarded” and identity verification and Know Your Customer (KYC) checks are performed.
2. Conditional decision: Using available data to make an initial decision to proceed with the application, or reject the application. At this point, the applicant may receive ‘conditional approval’, subject to further verification checks.
3. Document verification: Applicant submits supporting documents (payslip, bank statement, etc.). Documents are verified against the application.
4. Unconditional decision: Applicant is approved or declined based on data from supporting documents. This is the final decision to approve the applicant.

Why traditional identity verification cannot catch all identity fraud

Organisations typically rely on identity verification activities at the application creation stage to detect identity fraud. The problem is that when an identity is taken over, this is often not picked up by traditional checks, because of two reasons:

Firstly, the identity in use is from a ‘good’ victim – they had no previous fraud issues and have a good credit score, meaning no adverse issues will be reported by fraud or credit reporting agencies.

Secondly, the identity information the attacker uses is ‘genuine’, ie. is the same as what the government has on file. For example: if a driver’s license is leaked and the card details are captured, then the attacker can use these details and they will likely be confirmed as valid by a verification service such as DVS.

Minimising the impact by authenticating proof of income documents

Whilst an attacker can bypass identity checks by using real identity data, they are still going to need supporting documents such as payslips, bank statements or tax assessments to pass income verification.

This means they’ll need to fabricate a payslip, falsify a bank statement or modify a tax notice of assessment.

And this is where we can catch them: we will identify fake supporting income documents.

By fraud-checking supporting documents, you will achieve a 3%-7% detection rate uplift after IDV/credit/application fraud checks. These documents are a gold mine of information, saving lenders millions in fraud avoidance.

Furthermore, by detecting false income documents, you are preventing victims of identity crime from being exploited via your organisation.