The many dangers of new account fraud and how to detect it

 A couple of recent high-profile examples over alleged inflated user metrics involving new account fraud used to manipulate the true number of users a company has really got us thinking about all the implications - not just legal - that these cases involved. At the core of all the hype is the allegation that new account fraud (also known as account opening fraud) was being committed - not just by fraudsters, but with the backing of high-level company members wishing to inflate their metrics. The purpose was to make the companies look more successful than they were - surely the more customers a company has, the more lucrative it must be, right? Not always. We’ve considered the negative aspects of each case but more importantly also the solutions available to prevent them from happening. Read below about the dangers of new account fraud and how to stay safe against such threats.

At the core of the allegations against Block Inc. (formerly known as Square Inc.) with its popular cash app platform is that their true number of users is far below what they report - potentially done to mislead investors. Research carried out by Hindenburg Research alleges that former Block Inc. employees reported that as many as 40-75% of their accounts are either fake or multiple accounts tied to one individual. 

Some accounts are also allegedly connected to fraud activities as fraudsters open fraudulent accounts (again, using fake identities or a mix of a fake identity and details of a real person) for the purposes of committing scams and money laundering - something that was allegedly neglected by Block Inc. due to its “wild west” approach to opening up finance to the ‘underbanked’.

 In certain cases, it was alleged that some fake accounts were blacklisted - but not the original user connected to them - which allowed them to continue their activities by creating more accounts or continuing using other accounts they controlled not yet blacklisted. This practice is allegedly so commonplace that hip-hop artists brag about this in their songs!

In the case of Frank, the fintech startup aimed at helping young Americans with the student loans application process is alleged to have inflated its user base with fake accounts to give the impression that it was more successful than it was. J.P. Morgan, impressed by this apparent success, acquired the fintech for $75m. Their suspicions about the company’s success led them to ask for proof of the true no. of its user base, which the CEO Charlie Javice stated stood at 4 million. In their lawsuit against Frank, J.P. Morgan claims the true user base stood at around 300,000.

In fraud prevention circles, we always look for the telltale signs of fraudster activities right from the word go - account fraud occurs during the acquisition and registration process when threat actors try to create fake accounts with completely made-up details right down to accounts created with stolen and synthetic identities (obtained through phishing scams, data leaks or bought on dark web marketplaces) and even new account creation using a mix of real and made-up information. Detecting these attempts early can prevent any major damage from being done to all companies offering digital goods and services, which is why advanced fraud systems need to be so effective. 

The strange thing about the case against Frank, in particular, is that the CEO is alleged to have ordered the user base be inflated with a mix of fake accounts consisting of multiple accounts per user and synthetic IDs being used to create completely new identities - often using the details of genuine existing customers, without their knowledge. The result, as we now see in media reports and J.P. Morgan’s allegation was to make the company look bigger, more popular and more successful than it was to fool investors, ultimately leading to its acquisition. And this was potentially based on an outright lie by inflating data with fraudulent accounts. Food for thought.

It must be stressed that the aforementioned cases are allegations, with court cases ongoing and more likely to follow. What is certain is that any such allegations can be potentially damaging for any company (profitability, stock prices etc.), let alone fintech startups. Existing customers may choose to jump ship, seeking out competitor services, and potential future customers may be wary to sign up, wary of inadequate cybersecurity measures and false reporting of data. Even if the allegations turn out to be false, unfortunately, the damage has already been done. Regaining user trust in such a situation is an unenviable task for any online company.

While no anti-fraud system can prevent potentially malicious actions of a CEO, it can detect and distinguish genuine user accounts from fake ones that could avoid the inflation of user metrics by effectively blocking any fake/multiple account creation automatically before it had a chance to succeed. Preventing the creation of fake/multiple accounts can also put a stumbling block in a fraudster’s plans - no fake account, no fraud attempts. No successful account takeover (ATO), no illicit gains.

The use of advanced authentication measures could potentially avoid all the pain and negative effects that we have seen in such cases, namely the misleading of investors and the media fallout that followed. It could also actually improve your cybersecurity credentials and reputation among online users.

One of the many claims from Block Inc. is that it can provide a frictionless experience for its users. Fast account setup processes without the added friction from additional security checks.  It’s a great approach - but only if it works properly and prevents threat actors from creating the accounts, which is the complete opposite of what the allegations are against Block Inc. by facilitating threat actors and their actions.

Nethone’s approach to detect and prevent such situations is to use AI-powered fingerprinting that determines genuine users from bad actors based on their behaviors and service interaction along with their device and network settings (whether or not efforts are being made to conceal or spoof these settings). Advanced profiling of users provides a real-time risk assessment that could save your business from any major operational and reputational problems in the future.  So what can this approach resolve? Just to name a few…

• Fake account creation
• Multi-accounting
• Account sharing
• Account takeover (ATO)
• Promo and policy abuse

It’s easier than you think to avoid the stresses of any major future issues by stamping out their chance of ruining your business even before threat actors have had a chance to even start toying with your service. Let us show you how we protect all businesses from digitals goods and services to financial institutions

___

If you liked this article and would like to learn more about how to avoid the nasty consequences of new account fraud, arrange a call with us by clicking ‘book a call’ at the top of this page to see how our solutions could help your business. Alternatively, contact Patrick directly via email at patrick.drexler@nethone.com or via LinkedIn.