Identity management is key to preventing credit fraud

CNG Holdings turns to SAS^® analytics and machine learning on Microsoft Azure to detect and prevent fraud while providing an optimal customer experience

Speed is essential for financial services companies. Given the competitive and regulatory landscape, online credit application decisions must be made instantly and at scale. But fraudsters are lurking in the shadows to steal identities and take over accounts, making it imperative that institutions know the true identity of every applicant.

No one wants to be a victim of identity theft, especially considering the time and resources it takes for a consumer to recover their identity and protect their reputation.

Rick Cooney, Vice President of Fraud and Identify Management for CNG Holdings, has been fighting fraud for more than three decades. His team took a new approach – stop fraud before it happens. This strategy shifted the focus to identity. If CNG could validate an applicant’s identity, fraud would not be an issue.

“Customers care about security,” Cooney says. “By putting an identity platform in place, we can’t stop somebody from stealing your identity, but we can stop them from using it.”

CNG knew such a strategy would require a different set of tools and deployment methodology. So it sought a company that could build, design and supports its desired solution. CNG selected SAS as its primary partner based on four strengths: transactions at speed, entrepreneurial product development, flexibility and fraud expertise.

With an identify-first approach, the lending and leasing company is now spending less money fighting fraud, has reduced its false positive rate to nearly zero, and gives its investigators the tools to quickly close those rare cases.

Why identity management is preventive

Before turning to SAS, Cooney’s team used various fraud tools that provided alerts after suspected fraud occurred. They could stop a fraud event, but only after it was underway.

Many instances of fraud start with identity theft, while other forms can involve a person claiming to be the victim of identity theft. As Cooney’s team discovered, focusing on identity upfront stops fraud in its tracks.

There is just one issue: You can’t stay in business if it takes days – or even hours – to verify identity. The customer will go elsewhere, or regulators will step in with fair lending concerns. “When people go online and apply for a loan, they don’t want to wait 15 or 20 seconds,” Cooney says. “Speed is an issue.”

CNG needed an identity platform that seamlessly and quickly worked with multiple data sources, from traditional name/address databases to biometric data sources. SAS analytics and machine learning technologies were the answer. CNG uses  SAS Fraud Decisioning as its orchestration layer, which supports linking multiple data sources and a vendor ecosystem that informs the credit application decision process.

“SAS is our air traffic controller,” Cooney says. “We push all our applications through the identity platform that SAS developed, and we are linked to all the different data sources and vendors that we need to process those applications from an identity management standpoint. Then within the platform sits the strategy manager, where we devise, develop, build and maintain the strategies we use to understand if the identity is real and then determine the risk in the identity. Once we’re convinced the identity is real, we want to make sure we’re doing business with the owner of that identity and not someone else.”

Benefits of real-time data

CNG recently migrated to Microsoft Azure to get real-time access to data within seconds of an application.

“We send the real-time response to our credit system as well as our back-end,” Cooney says. “By using Azure and being able to push that real-time response through into our data lake, I can access that data within moments of an application. So, for example, if I believe I have a fraud attack that’s occurring, and I need to adjust my rules in real-time, I can get to that data in time to make those adjustments and shut it down quickly.”

The identity platform is tuned to flag problems. For instance, it will alert CNG if an applicant cut and pasted text, used a newly created email address or used a Social Security number issued before the person was born.

“We built numeric codes for all of our outcomes,” Cooney explains. “So no matter what outcome we obtain, we know exactly why we received it and what to do next. SAS has helped us standardize our operating procedures.”

If the simplest steps can’t validate the customer, the identity platform automatically – and quickly – moves on to the more sophisticated options that might include asking for a real-time selfie to match a driver’s license photo. The movement through the identification steps involves models built using SAS analytics and machine learning.

Impressive results and cost savings

It took just 90 days to get the identity platform up and running, achieving a false positive rate of nearly zero.^[1]

“We’re getting a very high percentage of our customers through the application process – well over 90% for brand-new customers, which is almost unheard of,” Cooney says. “And our fraud false positive rate almost doesn’t exist.”

In addition, Cooney was able to sunset several existing fraud tools, so his fraud-fighting costs dropped by 30%.

Helping investigators work quickly

The identity platform also proves valuable when customers report that they are the victims of fraud because some of those requests are fraudulent themselves.

“Some individuals are trying to clean up their credit,” Cooney says. “They’ve had a bad loan, and they try to call a year later to say, ‘That wasn’t me.’ With SAS, we have all the data that we used to authenticate the applicant. An investigation that used to take two hours now takes two minutes. The identity platform has made our investigation team’s job infinitely easier.”

Putting the identity platform to a challenge

CNG recently experienced a major test of its identity system. A fraud attack submitted 8,500 credit applications over 60 days – virtually all using stolen or false identities.

“Only three of the 8,500 applications defeated our process,” Cooney says. “In these cases, the fraudster used social engineering, where they got a customer to give them a one-time passcode. When we saw that was happening, in just 24 hours we moved away from the one-time passcode and chose a combination of other authentication models.”

The identity platform not only helps CNG mitigate and prevent fraud, but it also helps the company provide peace of mind to its customers.

“Ultimately, most customers today want to feel secure – they want to do business with companies that care about their identity and their security,” Cooney says. “We provide customers with a service they need, when they need it, while using the latest technologies to protect them.”

^[1] Learn more about the cost savings and business benefits enabled by SAS Viya on Microsoft Azure in the Forrester Consulting study, The Total Economic Impact™ of SAS Viya on Azure.