Dwight is right. ‘Identity theft is not a joke!’
We couldn’t be more serious about it.
BNPL is everything we ever wanted. Buy now and pay later. Unfortunately, fraudsters want to buy now and pay never. Their weapon of choice? Identity Theft Fraud!
In this blogpost, we uncover all you need to know about how identity theft fraud happens in BNPL.
What is identity theft?
Identity theft simply is a case of impersonation. A person using another person’s identity to transact and commit fraud.
How does identity theft fraud happen?
- Stolen data: Take a trip back to all those times when you went to the local photocopy store to get your documents scanned/xeroxed. The same vendor can keep a copy of your scanned sensitive document for themselves and later use it to steal your identity.
- Data breaches: You and I aren’t strangers to data leak cases happening now and then. This data is later up for sale on the dark web. Fraudsters can easily buy from there and exploit it to steal money or access financial accounts.
Modus operandi
PAN Check
Most BNPL companies need the user’s PAN number for KYC purposes. This is used for verification either from government databases or the individual’s CKYC records.
Government databases such as NSDL/UTIITSL only confirm the individual’s name, PAN number, and date of birth. It doesn’t return the person’s face as an output parameter.
So it becomes hard to tell if the person being onboarded is the same person whose PAN details are being submitted.
Name Check
It is at this stage that the name comparison check takes the lead as the only level of verification. Alas! Fraudsters can readily bypass this as well by providing the victim’s personal details while signing up.
Furthermore, fraudsters can click a picture of the owner’s physical PAN card and plaster their own picture over the latter’s. These cleverly manipulated documents easily pass AI/ML-based face comparison checks.
Face Comparison Check
But every cloud has a silver lining.
You can get the customer’s KYC details from CKYC too. It returns the face of the person linked to a particular PAN number. It also makes it possible to do further authentication. A selfie of the customer is captured followed by a face comparison check, with the face returned from the CERSAI database.
While this seems secure, fraudsters still manage to game the system. They stalk the victim’s social media profiles for a suitable picture. Then meticulously take a picture of that picture such that it resembles a selfie. If the underlying facial recognition solutions are not sophisticated enough, some attempts end up in success.
How to prevent identity theft fraud in BNPL?
- Face recognition during onboarding: Face Compare helps ensure that the documents provided belong to the individuals we expect them to be. Face Liveness helps indicate the absolute gospel truth. It checks if the individual’s selfie is indeed live or a photo of a photo.
- Tampered Document Check: There are many editing software out there in the market which makes it simple to fiddle with any document’s details. Document tampering API checks for any alteration in the IDs submitted by the customer.
BNPL is here to stay. Unfortunately, so are the fraudsters. Using technology effectively at the right places can help prevent most of the fraud plaguing the industry.