Why Fraudsters Look Trustworthy and Good Customers Look Suspicious

Criminals are increasingly aware of the signals banks use to identify “good customers”—and they are using that knowledge to evade detection.

At the same time, legitimate customers are adopting behaviors that were once considered tried-and-true risk signals. Data breaches and privacy concerns, for example, have spurred many consumers to use VPNs, a behavior that was once viewed as a reliable fraud red flag.

The result is a growing inversion of traditional fraud signals: legitimate customers can look suspicious, while sophisticated criminals can appear trustworthy.

In a recent PaymentsJournal podcast, Diarmuid Thoma, Head of Fraud and Data Strategy at AtData, Jose Pallares, Senior Director of Product Management at Experian, and Jennifer Pitt, Senior Fraud Management Analyst at Javelin Strategy & Research, discussed the convergence of these patterns and how they are reshaping the fraud landscape.

This ambiguity has created an environment in which bad actors are thriving and consumers are losing confidence in financial institutions. To combat this threat, financial institutions must adopt methods that are both broader and more granular to accurately identify fraud.

The Rise of Manufactured Trust

Technology has accelerated this shift, but the underlying challenge is familiar. Whenever fraud systems learn to identify certain behaviors, criminals adapt to avoid them.

“Back when I was doing fraud review 20 years ago, if somebody was on a mobile device or a mobile number, that was slightly riskier because landlines were safer statistically,” Thoma said. “Whereas now if you gave a landline, that’s kind of a weird thing. There’s a natural part to that, and people have to keep that in mind, there are these shifts and profiles evolve.”

In the past, the prevailing fraud prevention philosophy was to build models capable of detecting abnormalities and inconsistencies. However, criminals are all too aware of this strategy, and it has instead become a blueprint for avoiding detection.

Artificial intelligence has also allowed bad actors to deploy these tactics at scale. With a few prompts, even technologically unsophisticated criminals can generate multiple synthetic profiles and manage them at scale.

They are also becoming more patient and strategic in how they carry out illicit activities.

“Once they had an account, they used to run up the account quickly, do a bust-out, and then run away,” Pitt said. “They don’t do that as much anymore. What they do is they make the account look legitimate over time. To skirt the detection on the forefront, they’re building up that identity with non-financial accounts. They might open up an email account, and once that identity becomes legitimized and verified at one organization, other organizations see it as more legitimate. It’s building that credit profile.”

These capabilities have allowed bad actors to manufacture trust at a time when it is more difficult than ever to discern an individual’s intentions. This is partly because consumers have also rapidly adopted technologies like AI and social media, especially among younger and more digitally native generations.

“The behavior profile of a good consumer is completely different than it was even five years ago,” Pallares said. “Fraudsters now think or look like good consumers, and consumers—from a fraud systems angle—look completely messy and risky. So how do we level up our existing fraud systems to catch and look at those things differently?”

The Compounding Effects of Misclassification

Beyond potential fraud losses, gaps in fraud infrastructure often cause legitimate customer activity to be misclassified as fraudulent. As a result, the customer experience suffers.

These errors often occur at a time when organizations’ relationships with customers are most tenuous.

“There are a lot who from early account set up are coming in and they’re spending a lot,” Thoma said. “They’re doing exactly what you’d be worried about from a commercial point