Banks that take loans originated by financial technology companies are feeling compelled to strengthen their risk control measures as fraudsters attack fintechs with scam bots and fake identities.
While the pandemic accelerated digital transformation in banking, it also increased the number of cyber fraud incidents at fintechs. In February, PayPal Holdings Inc. said it closed 4.5 million accounts that it believed "were illegitimately created" to reap the benefit of offers such as account opening bonuses.
Banks that work with fintechs on loan origination are susceptible to this trend. Bronx, N.Y.-based Ponce Financial Group Inc. put back $17 million of loans to its fintech partner Grain Technology Inc., which was "victimized by cyber fraud using synthetic and other forms of fraudulent identifications," according to a May 5 SEC filing by Ponce.
"I do think post-pandemic we are seeing, as an industry, an uptick in fraudulent attempts and behavior. So it forces us to be even more on our toes," said Jamie Warder, executive vice president and head of digital banking at KeyCorp.
Identity theft for the purpose of financial fraud has seen a significant increase in 2020 and 2021, following the launch of pandemic-related government stimulus programs, according to the Federal Trade Commission. In 2021, fraud on credit cards, government documents or benefits, and loans or leases are the top three subjects that the FTC has received the most identity theft reports on.
Fraudsters tend to take advantage of chaotic times when there are changes to procedures and practices, said Matt West, chief strategy officer at MVB Financial Corp. Now that the government stimulus programs have wound down, they are shifting their focus to other financial service products, KeyBank’s Warder said.
Digital lending platforms were a target of the fraudulence bred by the pandemic. For instance, fake companies were granted 378 Paycheck Protection Program loans worth $7 million using online lending platform Kabbage, according to an investigation by ProPublica in May 2021.
A layer of risk to bank-fintech partnerships
Fintechs' fraud prevention oversights can be costly for their bank partners, as banks have been teaming up with fintechs to test out loan categories or underwriting methods that they may not have adopted in-house for risk management or technical reasons.
At Ponce Bank, $11.8 million out of the $17 million in fraudulent loans were outstanding as of March 31. Even if Grain intended to pay all amounts due upon the completion of a series A financing, Ponce noted in the filing that capital raises "may not materialize" because Grain is not yet able to generate profits and is highly dependent on its partnership with Ponce. Grain has agreed not to originate new loans until further notice, according to the May filing.
Ponce's partnership with Grain is part of its strategy to serve the underbanked population as a Community Development Financial Institution and a Minority Development Institution, according to a press release in June 2020 announcing the partnership.
Different from the traditional underwriting model relying on credit scores, Grain's model takes into consideration broader payments records, not just the ones being reported to credit bureaus, said Rutger van Faassen, head of product and market strategy at financial data and consulting firm Curinos Inc. The goal is to extend credit to borrowers with lower or no credit scores.
In the filings, Ponce said bad actors engaged in synthetic fraud, creating fake identities using valid pieces of information, such as home addresses or Social Security numbers from different, real individuals.
Synthetic fraud has been a pervasive issue that impacts a wide variety of different organizations and industries focusing on prime or subprime borrowers, said Naftali Harris, co-founder and CEO of SentiLink Corp., a provider of identity verification technology.
Marching forward with fintechs
The solution is for banks to explore new technology and hone their partnership programs, rather than withdrawing from fintech partnerships or investments in digital capabilities, industry executives said.
While SentiLink works with fintechs to combat synthetic fraud, it also works with sponsor banks as a second line of defense, Harris said.
When MVB Bank decided to expand its footprint in banking-as-a-service, it began working with fraud prevention specialist Paladin LLC, and it later acquired the company in 2020. MVB provides banking and payment services for fintechs, as well as companies with higher risks, such as cryptocurrency exchanges and custodians, and businesses in gaming and online sports betting.
"One of the reasons that drew our acquisition of Paladin was that we were getting [in]to more fintech partnerships," West said in an interview.
Those fintechs typically open accounts digitally and don't see the customer in person, creating higher risk of identity fraud, West said.
In addition, MVB turned compliance services into a business of its own, with a belief that more banks will be getting into banking-as-a-service, West said. The bank provides professional services for other financial institutions to help them navigate regulatory compliance and fraud prevention through its acquisitions of Palatin, professional service firm Chartwell Compliance and software developer Trabian Technology Inc.
At KeyBank, its fintech partners are asked to maintain the same risk standards as those of the bank, Warder said. Even if the task can appear to be difficult, KeyBank has not had a problem maintaining its risk standards thanks to its fintech partners' ability to execute, Warder said.
"I do think digital opens up different vectors of fraudulent opportunity," Warder said. "As banks mature, as the industry matures, it has to be mature at fraud and identity capabilities."