7 years ago, 2 years ago Twenty data scientists have discovered a new phenomenon called synthetic identity fraud. They turned that discovery into his burgeoning SentiLink, a member of his Fintech 50 for 2023.
D.From summer to autumn 2018, Hasan Hakim Brown, a Florida man in his early 40s, had applied online for a loan against a fake company he founded and a fake identity. He had mixed success. He swindled over $1 million from a Texas bank. But some of the other targets using his software from the San Francisco-based startup SentiLink have flagged his application as suspicious because it has too many social security numbers associated with the same address. .
It turns out that Brown had begun manufacturing a “synthetic identity” that combined a stolen (but real) Social Security number with a fictitious name. He then honed his technique and purchased a rig from his computer consultant in Atlanta that could manage multiple virtual desktops simultaneously from different his IP addresses, bypassing certain fraud detection screens.
When Covid-19 broke out in early 2020 and Congress appropriated hundreds of billions of dollars to finance paycheck protection programs that are hurting businesses, Brown was prepared. rice field. Ultimately, according to federal court records, including guilty pleas, Brown and six of his criminal associates controlled 700 synthetic IDs, dozens of dummy businesses and associated bank accounts. All in all, the gang swindled him out of over $20 million from the Small Business Administration and various banks. Brown was sentenced to 60 months in prison.
While Mr. Brown was busy with theft, SentiLink co-founders Naphtali Harris and Maxwell Blumenfeld, both now 31, also changed their early insights and thought about synthetic identity fraud. Grow into a well-growing niche business. “At first everyone told us that this kind of scam couldn’t be possible and that they must be doing something wrong,” says CEO Harris.
Harris and Blumenfeld’s six-year-old startup made about $25 million in revenue last year, more than double the previous year’s revenue. forbes Estimate. Over 300 customers include 7 of the 15 largest US banks and 6 of the 10 largest credit unions, as well as leading fintech companies such as Ramp and Plaid. According to PitchBook, SentiLink raised $70 million in July 2021 at a valuation of $430 million. The company spends just $1 million a month, Harris said, and has enough cash to operate without additional funding for more than five years. He and Blumenfeld are veterans of Forbes magazine’s 2020 His 30 Under 30 list, and this year SentiLink made his annual list of the most innovative private fintech startups. made its debut in the Fintech 50.
Of course, artificial intelligence is an important part of SentiLink’s business. But Harris and Blumenfeld learned an important lesson from how they first recognized synthetic fraud. It was a human, not a computer, who made the important connections. In August 2016, Both of my college friends were data scientists at Affirm, a buy now pay later startup. Harris’ team was building a model for approving or rejecting borrowers. Blumenfeld’s job was to look for fraud.Blumenfeld one day I noticed that two applicants have the same name and date of birth, but different social security numbers. When he looked up the names on his computer, it turned out that 12 people with the same name and birth date but different Social Security numbers had applied for loans. Even more shocking, all 12 had credit bureau records and good FICO credit scores of over 700. One had a credit card with a limit of $20,000. Another took a personal loan of $35,000. The third had secured an $80,000 BMW loan.
“This is crazy,” Harris recalls thinking. “People like this don’t exist, but they tricked the authorities into getting credit reports.” Using the same name and date of birth was foolish. But the underlying strategy was clever and patient. Scammers were stealing Social Security numbers from people who were unlikely to actively shop for credit, including children, prisoners, and nursing home residents. They paired those numbers with fictitious names and real addresses. They then established a credit record for their work by opening checking accounts and making timely payments via loans and credit cards. Ultimately, you will be able to use this credit history to qualify for large loans that you cannot repay. This is now known as “busting out”.
But when Harris and Blumenfeld first encountered the scam, it was largely unknown to experts. “They told us that as long as the financial institutions had accurate records of all Americans doing credit activity and verified that the identities were in the financial institution’s records, that would not be possible. said,’ recalled Harris. But it was. And it’s still going, despite the launch last year of a rather clunky federal database (used by SentiLink) that allows authorized users to match names to social security numbers.
Currently, with 78 employees, SentiLink has eight full-time employees dedicated to manual reviews of potential fraudulent activity, and others spend at least one hour per week investigating incidents. to discover new patterns, such as new angles of fraud and legitimate applicants who may be unfairly rejected. algorithm. “There is a big misconception that AI can discover these things on its own,” said Blumenfeld, SentiLink’s chief operating officer and head of research and development. ” [AI] The model in this case is literally trying to mimic what humans do. It scales really quickly. ”
So far, ingenuity and speed have been key to their success. Harris grew up in Los Angeles (his father is a finance professor at the University of Southern California), spent three years at Milken Community School, a Jewish full-time school named after a billionaire donor, and four years of high school mathematics. , learned English and Spanish. Michael Milken. He applied to dozens of top universities without graduating from high school. The University of Chicago was one of five schools that accepted him. During his first few days there, he met Blumenfeld, the son of an art teacher and tax attorney.
Harris graduated from Chicago in three years with a degree in statistics and a Ph.D. He completed his doctoral program at Stanford University, but thought he was too theoretical and got a master’s degree in statistics instead. In June 2014, he was persuaded by Affirm co-founder Max Levchin to become the company’s first data scientist. According to Levchin, Harris is “a very first-principles thinker.” He took nothing for granted, evaluated things from scratch, and was very good at mathematics. Blumenfeld joined Affirm six months later.
little big picture
no more phishing
Spam-blocking app Truecaller estimates that Americans lose nearly $40 billion each year to phone scams in 2022. Fake calls peaked in his 2019 as regulators and carriers stepped up crackdowns and people stopped answering calls, with scammers doing what everyone else was already doing, texting instead. is now done.
spam received monthly
In March 2017, just seven months after first encountering synthetic identity fraud, Harris and Blumenfeld decided to build their company around it. They got $575,000 in seed funding. $300,000 of that came from Dallas-based venture capital firm Goldcrest, and most of the rest came from Levchin. They began working in a windowless basement office in a seedy neighborhood in San Francisco. “It was the cheapest office we could find at the time, and we felt that a company fighting fraud should be in a basement office,” Blumenfeld thinks.
Building a useful fraud scoring model requires a large amount of customer data. They started smart, buying millions of dollars worth of bad debts written off from lenders for about $10,000. This allowed them to obtain the credit reports of defaulted borrowers and look for clear patterns. They also started coding specific behaviors into their algorithms. If someone applies using an email address that he created only a month ago, or using her IP address in a different location than their actual address, those are red flags. counted.
As they scrambled to build models, the need for them grew. Research firm Aite Novarika estimates that losses to U.S. financial institutions from synthetic ID fraud tripled from $800 million in 2017 to at least $2.4 billion last year. However, the company said that some financial institutions are still writing off bad loans without knowing whether the deadbeat was artificial or real, so the loss could be more than double the expected amount. points out that there is. (Aite-Novarica does not estimate the losses suffered by governments, telecoms and online gambling sites who are equally heavy victims.)
In 2019, Harris and Blumenfeld finally landed their first major bank customer, Synchrony, a consumer finance company that offers personal credit cards offered by Amazon and JCPenney. That same year, SentiLink raised its first significant funding ($14 million) from the likes of Andreessen Horowitz and Felicis Ventures. Hans Morris, managing partner at venture capital firm NYCA, one of the investors, said the boyish, nerdy-looking duo have a way of dealing with financial services executives. “They are so nerdy that they are trusted and attractive.”
Glamorous or not, it helped that the duo targeted the right kind of weird fraud problem. While the problem is growing as a threat, it’s still not that important, so there are already many big competitors in the space with good models. Then the pandemic happened. The surge in e-commerce and the influx of federal funds has been a boon for both fraudsters and SentiLink, with customer numbers growing from 12 in December 2019 to 45 by the end of 2020. Last year, the company processed 323 million customer identities. From 148 million in 2021. The more data we process, the better the training of our models, and the more revenue we make, as many of our clients pay both a fixed license fee and a per-identity-check usage fee.
SentiLink extends beyond synthetic fraud to classic identity theft and first-party fraud (where people use their real identities to steal money or goods by challenging valid charges). Harris said she was able to cross-sell her second or her third product to more than half of her synthetic fraud customers, and about 60% of her revenue now comes from new areas.
But despite this traction, SentiLink is only a fraction of the total $15 billion annual fraud prevention market, credit bureau (and competitor) Experian estimates. In fact, some banks work with up to 10 anti-fraud firms at once. Companies like Experian, Lexis-Nexis, and fintech unicorn his Socure all offer a wider range of services than SentiLink.
Another challenge is that business moves fast. As fraud prevention models proliferate, scammers continuously come up with new schemes and variations. “A thousand companies a year say, ‘I’m better than everyone else in this space,’” said Max Ackler, chief credit officer at Synchrony. Harris and Blumenfeld will have to keep trying if they want to catch up with competitors and criminals.