Financial institutions continue to prioritize investment in digital banking to grow revenue and acquire new customers. The coronavirus pandemic has only accelerated that transformation, specifically around digital account opening. With access to physical branches restricted, digital account opening surged, with nearly two out of three checking accounts opened by consumers either online or from a mobile device during the height of the pandemic. A majority of the growth has come from demographic groups, such as boomers and seniors, who have been traditionally slow in adopting digital banking and commerce.

While the global pandemic has presented numerous opportunities for banks to drive digital adoption, it has also had a noticeable impact on account opening fraud, accelerating trends the industry was already seeing pre-COVID. The remote environment has provided optimal conditions for cybercriminals to hide within the surge of digital account openings — and they have the data to do so with ease. In only the last few years, more than 10.5 billion accounts, mostly username and password credentials, have been exposed through mass breaches. Trace Fooshee, Senior Analyst in Aite Group’s Fraud & AML practice noted in a recent webinar with BioCatch, “It’s easier than ever to abuse identity data to commit fraud, create bogus identities and create drop accounts to move stolen money.”

Digital account opening fraud, also commonly referred to as application fraud, continues to dominate the mindshare of fraud executives as the threat they are most concerned about in relation to detecting and preventing losses. A survey conducted by Aite Group in September 2020 revealed 71% of respondents reported an increase in account opening fraud with 10% indicating it to be at a significant level. Two in three financial institutions reported an increase in account opening fraud for the purpose of creating money mule accounts.

Money Mules: The Modern Day Gold Rush

Money mules have become the modern day gold rush for cybercriminals. First, the economic climate brought on by the COVID-19 pandemic has enticed cybercriminals to step up their game. Global economic relief programs, such as unemployment benefits and government stimulus checks, were ripe for fraud because of open-door policies designed to distribute money fast to businesses and consumers. In the U.S. alone, it is estimated that more than $36 billion in improper payments were made to scammers. In the UK, up to £3.5 billion of unemployment payments were the result of fraud or error.

Second, technology has made it easier than ever for criminals to open new accounts using digital banking channels and bypass traditional KYC barriers. Previously, cybercriminals would have to recruit mules, most often through romance or work-at-home scams. Fraud-as-a-service business models have also grown in fraud forums, offering cybercriminals the opportunity to “rent” mule accounts to cash out stolen money. But these days, it is possible for cybercriminals to control their own mule accounts by simply opening an account in someone else's name and withdrawing the stolen funds.

Finally, the lack of clear ownership and resources dedicated to continuous detection and monitoring for mule accounts has given cybercriminals the edge. Most financial institutions are not in the business of proactively identifying mule accounts unless it is painfully obvious. Mule detection is instead a reactive practice that only moves up the priority list when law enforcement or a regulatory agency becomes involved. Combined with a lack of industry standards or best practices, and suddenly an ideal environment is born for mule accounts to flourish.

New digital banks or newly enhanced digital channels are particularly vulnerable for account opening attacks, with fraudsters assuming these organizations don’t have the right defenses to drive attacks away. This was confirmed after one digital bank, a BioCatch client, launched an aggressive marketing campaign offering high interest rates to acquire new customers. Results from the marketing campaign produced a significant amount of new applications, but it wasn’t good news. The bank realized they were under an account opening attack where cybercriminals were using the bank to create mule accounts that could be used to cash out funds from other compromised accounts. Behavioral biometrics played a key role in putting the brakes on this massive account opening attack.

The Road Ahead: Mule Detection Becomes a Priority for Fraud Teams

Today, only 6% of financial institutions state they are actively investing in mule detection programs. However, it will become a priority. With all the fraud perpetrated from government stimulus programs, mule accounts are a huge regulatory risk for the financial services industry suggesting they are not up to speed with Know Your Customer checks. Second, they create operational overhead once fraud is reported as resources need to be assigned to investigate reported cases. Finally, there is the risk of reputation or brand damage that can happen. No financial institution wants to see their name in a headline associated with money laundering.

While Anti-Money Laundering (AML) teams traditionally have bore the responsibility of detecting and investigating mule accounts, their approach has been reactive. In addition, AML teams often lag behind fraud and security teams in advanced technology adoption simply because their budgets have not allowed for the investment as their spend is most often focused on compliance.

With global regulators taking notice of the fraud from economic stimulus programs, AML practices pertaining to mule detection are likely in for some changes. BioCatch anticipates in the coming year:

  1. Legislation will spawn action. The Anti-Money Laundering Act of 2020 set forth that the S. Department of Treasury must establish national AML priorities within six months and subsequently review whether and to what extent financial institutions have incorporated those into their risk-based programs to comply with the Bank Secrecy Act. To what extent guidelines for cyber scams will play in those priorities is to be determined, but it is likely greater attention will be paid to this subset of financial crimes following the wave of COVID fraud. The U.S. is only one example and other nations will likely follow suit.
  2. Development of industry best practices. Financial institutions will come together to develop best practices and standards for detecting mule accounts. Some major banks are already taking the lead to improve mule detection capabilities and develop information sharing programs which are pivotal in preventing cross-institution P2P payment fraud perpetrated across platforms such as Zelle, Venmo and CashApp.
  3. Progressive technologies will be implemented. The financial industry is making full use of technologies such as device reputation and, more recently, behavioral biometrics, to stop mule accounts at the source in the account opening process. These technologies are currently deployed across many large institutions already for a variety of fraud prevention use cases. However, they are also poised to play a major role in building digital trust and safety where fraud teams are taking a more active leadership role.

Discover more strategies for winning the battle against account opening fraud. Get in touch today to discuss how behavioral biometrics can help drive your next-generation fraud management strategy.

Recent Posts