Halloween is approaching, bringing an inevitable array of “Fright Night” movie marathons, haunted houses, and ghoulish decorations almost everywhere you turn. While it’s a fun time of year for most, fraud-fighters can find it to be overwhelmingly frightening. With identity-related cyberattack types getting more innovative and fraudsters becoming increasingly brazen, the customer account opening process can deliver some nightmarish results. 

‍

Black Widow and Iron Man costumes will undoubtedly be popular, but the real heroes are the fraud-fighters applying identity checks and other attack monitoring as critical lines of defense. They’re helping banks and other businesses, such as credit card companies and financial institutions, fight back against the scary specter of identity fraud, phishing attacks, credential stuffing, account takeover, and other fraud tactics and scams. 

‍

Effective fraud leaders know that account openings don’t have to be scary. With the right approach to identity verification, fraud prevention teams can turn the Halloween season into more pumpkin spice, and less blood and gore. Let’s learn how.

‍

Why Are Account Openings So Scary?

‍

Access is the first, and most critical step for fraudsters, which is why they focus their efforts at the account opening phase. Businesses are eager to sign up new customers and often prioritize speed and ease of use over rigorous verification. The primary methodologies employed by fraudsters to gain access include:

• Identity theft: This involves stealing a person's personally identifiable information (PII), often obtained from a variety of public sources, to impersonate them during account onboarding. 
• Synthetic identity fraud: This is when a fabricated identity is created by combining real and falsified customer information. Fraudsters use these synthetic identities to open accounts, making it difficult to detect since the data may not match any existing individual.
• Application fraud: This is when fraudsters submit false or manipulated information during the account application process to gain approval. They often attempt to exploit weaknesses in identity verification systems, potentially bypassing cybersecurity checks.
• Bot attacks: In this type of attack, fraudsters use previously breached or stolen PII to arm an automated script in the account opening process
• Social engineering attacks: These attacks rely on psychological manipulation to trick individuals into revealing PII. Scammers use that personal data to manipulate account opening processes in their favor. Example: phishing.

‍

Scared yet? No need to be, because by implementing attack rate fraud checks, banks and  financial institutions can dramatically identify and shut down fraud at account opening. Let’s look at what banks and other types of businesses, such as credit card companies, should monitor:

‍

Attack Rate: Know When, Where, and Everything Else About Attacks

‍

Account opening fraud perpetually evolves and adapts, and as we saw above, it manifests itself in many ways. Because of that, it’s not always easy to know the specifics of what you’re seeing, but fraud teams typically can identify an attack based on certain behaviors. 

‍

Attack rate monitoring is among the most important defense mechanisms for fraud teams. It is a representation of the frequency and intensity of attempted fraudulent activities aimed at infiltrating the account opening process. Experienced fraud leaders understand that it is not just a matter of identifying if an attack occurs, but comprehending the scale and patterns of these attempts.

‍

By tracking the attack rate meticulously, companies gain real-time insights into the malicious intent of cybercriminals. This enables proactive detection and analysis of potential threats, allowing for swift and informed countermeasures to be deployed. The attack essentially acts as a pulse on the vulnerability of the system, providing a tangible metric that helps in fine-tuning cybersecurity protocols and preparedness against emerging fraud tactics.

‍

Early fraud detection is critical; the earlier an issue is discovered, the faster it can be eliminated and the less chance an attack can do harm to your organization. The attack rate serves as an early warning system, allowing organizations to identify anomalous patterns and swiftly respond to potential threats. In doing so, companies can substantially reduce the financial and reputational damage that could result from successful fraudulent account openings. And, since attack types change regularly, by monitoring the attack rate, fraud teams can allocate resources efficiently and strategically to fortify defenses where they are most needed.

‍

“Early fraud detection is critical; the earlier an issue is discovered, the faster it can be eliminated and the less chance an attack can do harm to your organization…”

‍

Ultimately, the attack rate is a vital indicator of an organization’s resilience – both in real-time and as a predictive measure – against cyber threats. With fraud becoming increasingly sophisticated, staying ahead necessitates a proactive stance. Technical leaders recognize that by monitoring attack rate metrics, and then using that information to operationalize their defenses, they can bolster and optimize security measures and foster more secure bank account onboarding processes.

When monitoring the attack rate at account opening, banks should focus on key metrics that provide valuable insights into the nature and intensity of fraudulent activities. These metrics aid in assessing the level of vulnerability and the effectiveness of fraud prevention measures. Here are the crucial metrics:

‍

• Attack Frequency: The frequency of attempted fraudulent activities is a fundamental metric. It quantifies the volume of attacks over a specific time period, offering insights into the regularity of attempts.
• Attack Success Rate: This indicates the proportion of attempted attacks that successfully bypassed security measures and resulted in unauthorized access or account openings. Understanding the success rate helps in gauging the efficacy of the security system.
• Account Opening Rate: Tracking the ratio of successful legitimate account openings to attempted account openings provides a baseline for measuring the potential impact of fraudulent attempts on the overall account opening process.
• Time to Detection and Response: This metric signifies the duration it takes for the system to detect a fraudulent attempt and initiate a response. A shorter time to detection and response indicates an efficient monitoring and alerting system.
• Types of Attacks: Categorizing and analyzing the various attack vectors, such as phishing attacks, identity theft, or application fraud, provides valuable insights into the evolving tactics used by fraudsters.
• Attack Origin and Geography: Understanding the geographical origin of attacks can shed light on potential hotspots for fraudulent activities. It aids in strengthening security measures in vulnerable regions.
• User/IP Anomalies: Analyzing abnormal patterns in user behavior or IP addresses during account opening can help identify suspicious activities, enabling proactive responses to potential attacks.
• Rate of Rejected Applications: Assessing the rate of rejected applications due to suspicion of fraud provides insights into the accuracy and effectiveness of fraud detection mechanisms.
• Customer Feedback and Complaints: Actively monitoring and analyzing customer feedback and complaints related to the account opening process can uncover potential gaps or vulnerabilities that fraudsters may exploit.
• Measure Success Rate of Auto-Approve, Auto-Refer, Auto-Decline: This involves tracking the percentage of applications that are auto-approved, as well as the rate at which auto-referred applications are reviewed and subsequently approved or declined. 

‍

Take the Fear Out of Account Opening

‍

The approaches described in this blog will help banks and financial institutions take the scare out of the account onboarding process and ensure that you can increase users without fear of fraud and cybercrime encroaching on your systems.

‍

Want to learn how Prove helps prevent account opening fraud while still delivering an optimal customer experience? Get a demo of the Prove platform to see it in action.

‍