Why Velocity Checks Fail to Detect Fraud Rings, Synthetic Identity Fraud

A lender sent us a batch of 128 applications it suspected were coordinated. When I lined up the confirmed fraud, most of it had exactly one thing in common: the same name.

Nothing else repeated. Every application came with its own birthday, address, phone number, email, and connection.

None of them were declined. Two were funded.

On paper, they looked like different people. But four things still gave them away.

TL;DR

Our findings in a nutshell:

• One common name came up again and again, and nothing else repeated: a new birthday, address, phone number, email, and connection every time.

• The lender's existing checks passed them, velocity checks included.

• Four signals exposed the ring: one name wearing many identities, identity details pasted instead of typed, the same proxy hiding an overseas origin, and SSNs that failed verification. Most of these are weak on their own. Together they're precise.

• Running the pattern back across six months of traffic turned up 68 more applications that weren't on the lender's fraud list.

• The lesson: link identity, behavior, network, and verification data instead of judging each application on its own.

What happened

The lender flagged 128 applications as suspected coordinated activity. Of those, 26 came in under one common name over 51 days. Twenty-two of those were later confirmed as fraud.

Every one had its own birthday, street address, phone number, email address, and connection, spread across 15 states. Nothing repeated except the name. They all came from a Mac running Chrome, but that's one of the most common setups there is, so it doesn't point to a shared device.

The lender's existing workflow didn't stop them. Across almost 100 automated fraud checks, the group got no rejects and no declines. Two loans were even funded.

Why do velocity checks miss fraud rings?

Velocity checks count repeats: the same connection, device, or email showing up in a short window. This ring repeated nothing except the name, so there was nothing to count.

Wider windows didn't help. When we tested stretching the window from 30 minutes to 7 days, it flagged thousands of applications and caught almost no fraud. Tuning velocity harder only buries the review team in more alerts.

When nothing repeats, you have to look at how the details relate to each other instead.

What gave this fraud ring away?

We went back through the confirmed cases field by field: what was entered, how it was entered, where it came from, and whether it checked out. Four signals kept showing up together.

Identity

We started with the name. It kept coming back with a different birthday each time. A real person has one birthday. A common name will naturally carry a few, because plenty of people share it, so the bar has to sit well above that. On its own, this signal is noisy: common names in busy traffic collect birthdays, and it flags plenty of real people.

Behavior

Then we looked at how the forms were filled in. The name, date of birth, and SSN were never typed. They were pasted. People usually type their own birthday; they don't paste it. Alone, though, pasting is too broad. Plenty of real applicants paste from notes, documents, or password managers.

Network

Next, the connections. They ran through the same set of proxies set up to look domestic. The connection looked local; the device said otherwise. Oscilar's device and network intelligence resolved the true origin behind the proxy: overseas, mainly Eastern Europe and the Middle East. Alone, this is too broad as well. VPNs, privacy tools, and corporate networks are common among real customers.

Verification

Last, the SSNs. They failed verification checks. Fraudsters also reuse SSNs, so SSNs from past confirmed fraud cases are kept on a watchlist, where reuse shows up immediately. This is the strongest of the four on its own, but it's narrow and it fires late, only once an SSN has already failed verification or turned up in fraud. A fresh SSN slips past it.

All 22 confirmed fraud cases showed this same pattern across all four signals.

Why are four weak signals stronger together?

Each signal on its own is either too noisy or too narrow. Read together, they cover each other's blind spots:

• Many birthdays per name spots one name being reused across many identities, the shape of this ring. Alone, common names make it noisy.

• Pasted identity details show the applicant didn't know what they were entering. Alone, too many real people paste.

• A hidden origin shows someone concealing where they really are. Here, that was overseas. Alone, VPNs and corporate networks are everywhere.

• A failed or watchlisted SSN ties the application to bad or reused SSNs. Alone, it can't see a fresh one.

Since real customers rarely trip all four at once, when these signals are evaluated together, they pick out the ring cleanly while touching very few real applicants.

The check we built for this lender doesn't treat any one of them as a rule. It requires them together: many birthdays under one name in a recent window, plus pasting into identity fields, plus a proxied connection, plus a failed SSN check, or an SSN on the watchlist.

On this lender's traffic, the combined check touches under 1% of passing applications, lower than the birthdays signal alone. That's their number, not a benchmark. Yours will differ, so measure it on your own data.

It's the same point I made in Why Fraud Rules Stop Working (and How to Tell When Yours Have). Come at an attack from more than one angle, so one change doesn't take out your whole defense.

How do you know if your fraud list is complete?

When a client hands us a fraud list, we treat it as a lead, not the answer. Once we find a pattern, we run it back across months of traffic and look at everything it would flag.

In this instance, we searched the name across six months of the lender's traffic:

• 94 applications turned up, and 68 of them weren't on the lender's list. They showed the same four-signal pattern.

• Two of those 68 had reached the final fraud check.

Running the pattern back surfaced two other things worth a look:

• A second common name with nearly the same profile: about 97 applications over 112 days, 82 birthdays, 25 states, and only about 2% stopped. It wasn't on any list. It matches the pattern, but it isn't confirmed fraud.

• A different shape entirely: about 56 names and roughly 730 applications where one person, with the same name, birthday and address, reapplied again and again with a new email each time. That shape needs its own check, one that counts emails per person.

A fraud list only holds what someone already noticed. The rest of the ring is usually sitting right next to it, and that's the part still costing you money.

We raised these points with the lender to review, who agreed each is risky, and they confirmed that they’re working on them. 

Should a new fraud check block right away, or watch first?

Watch first. New checks start in shadow mode, watching live traffic without affecting any decisions, and we review what they surface with the client before anything blocks.

That review is also where business questions come up. The email-reuse pattern raised one for this lender: do customers legitimately reapply with a new email after a decline? If they do, that's part of how their customers behave, and the check has to account for it. It's the lender's call whether it's a problem.

A check that looks right on historical data still needs time on live traffic before it blocks anyone.

How to tell if this is happening to you

These checks come straight from this case:

• Count how many identities each name, SSN, email, and phone number carries.

• Check whether identity fields are pasted or typed.

• Look through the proxy to the connection's true origin.

• Keep a watchlist of SSNs from confirmed fraud cases.

• Search past your fraud list. Run what the confirmed cases share across months of traffic.

Fraud rings hide between applications, not inside them.

No single signal exposed this ring. It took identity, behavior, network, and verification data read together. That's why Oscilar looks at all of them.

Want to see it in action? Book a demo today.

FAQs

Why do velocity checks miss fraud rings?

Velocity checks look for repeats, such as the same connection, device, or email inside a short window. A ring that brings a new birthday, address, phone number, email, and connection to every application leaves them nothing to count. Widening the window doesn't solve it: it flags thousands more applications and still catches almost no fraud.

How do you detect a fraud ring when every application looks different?

Stop judging applications one at a time and look at how they relate. Signals that are weak alone, like many birthdays under one name, pasted identity details, a proxied connection and a failed SSN, become precise when you require them together.

What is synthetic identity fraud?

Synthetic identity fraud is when someone builds an identity out of made-up details, sometimes mixed with real ones, and uses it to apply for credit. Because the identity doesn't belong to one real person, there's often nobody around to notice and report it.