The techniques of fraud are vast, multivarious, and complex. In order to protect themselves from sophisticated fraudsters, merchants would be well served to learn about particularly dangerous forms of fraud such as new account fraud.
New account fraud is a form of true fraud in which a criminal opens a new account with a bank or other financial institution using false personal information—either from stolen information or employing a form of synthetic identity fraud. This is different from other forms of identity fraud in which the fraudster conducts fraudulent transactions after having stolen or hijacked someone else’s payment credentials. Instead, it involves creating new payment credentials that belong to the fraudster through the use of fraudulent information.
Fraudsters acquire or create personal data through other fraud techniques such as phishing or by purchasing them on the dark web. They use this data to construct a persona that is credible-seeming enough to create a payment card account with a bank, store, or other financial institution. The fraudster makes as many purchases as they can with this fraudulent payment card before being detected and then disappears.
Due to the relatively rigorous efforts of banks and financial institutions to confirm the identity of potential new cardholders, new account fraud is a tactic only used by sophisticated fraudsters. Many will use bots or other AI-powered technology to comb through massive amounts of data in order to compile the fraudulent identity profiles. Some fraudsters will try to maximize their efforts by creating several new accounts at the same time and make as many fraudulent purchases as possible in a small time span.
The losses resulting from new account fraud are usually absorbed by the issuing banks and financial institutions. In most instances of new account fraud, the bank is the target of the fraud and the merchants are unwitting accessories, leaving the bank liable for the losses.
However, there are some circumstances in which merchants accept the liability for losses from new account fraud. The most obvious would be for merchants that engage in embedded finance. If the merchant is taking the role of a finance provider and falls victim to new account fraud, they are the only entity available to accept the liability for this fraud. Other circumstances in which a bank may assign liability to the merchant could include circumstances in which the bank determines that the merchant did not do enough to detect or prevent fraudulent purchases or circumstances in which new account fraud is used in conjunction with other fraud techniques that more traditionally result in merchant liability. It may also even be possible that a financial institution seeks to shift its own liability to the merchant due to merchant errors.
Even when the bank accepts liability, it is never in a merchant’s best interest to allow fraudulent purchases to occur. Fraud reduces trust and accountability amongst the legitimate entities throughout the financial system and allowing fraud to proliferate causes long term damage in ways that may not immediately be apparent.
Merchants may struggle to prevent new account fraud at the point where it is directed at a financial institution. But adhering to fraud detection best practices and employing anti-fraud tools can help protect merchants from any sort of blame shifting from financial institutions and may well allow merchants to sometimes catch fraudsters on behalf of the banks.
For merchants that employ some form of embedded finance, they need to be aware of some of the warning signs of new account fraud. These include:
As with all red flags, none of these is necessarily enough on its own to indicate fraud. But an applicant with multiple suspicious attributes should be treated with caution.
The bad news about new account fraud is that it is one of the more difficult kinds of fraud to detect and prevent. The good news, for merchants at least, is that it is generally the responsibility of banks and other financial institutions to catch new account fraud before it can be implemented. But merchants that have lax identity verification procedures or merchants that employ embedded finance need to be especially wary of new account fraud, as they are positioned to reap the consequences.