1. Bringing Business Fraud to Life: The stories behind the numbers
Greg Bonin, XOR Data Exchange

2. Fraudsters are Evolving 28% of U. S
Fraudsters are Evolving 28% of U.S. small businesses fall victim to fraud. Assoc. of Certified Fraud Examiners

3. Losses are Growing Average Credit Loss: $2,500 Average Fraud Loss: $3,800 Based on losses reported to XOR Data Exchange

4. New wave of small business fraud requires better data and a practical, human approach to analysis.

5. It’s time to think like a fraudster.

6. Recycled Identity Element

7. Case Study: Recycled Phone Number
ASAP Construction LLC
15 Applications with same phone number between November and January 2017
Almost all applications are to one provider
Applications all use construction related names (Baker Construction, Bar Construction, Gibson Construction)
Different EIN’s and business addresses mostly in different parts of Texas

8. Recycled Identity Element
Very common in consumer fraud
Fraudsters often rely on having a common point of contact in order to collect equipment
This is a great example of how linkage analysis can catch fraud

9. Impersonating a Real Business

10. Case Study: Impersonating a Real Business
TNT Shear Studio
3 different applications to two different providers in a one week period all using same business name and address but…
Different EIN’s
Different Phone numbers (same area code)
One of the phone numbers matches what is on the window in the picture...

12. Impersonating Real Businesses
Fraudsters can easily impersonate real companies in order to defraud service providers
How do you tell if someone really represents a business?
Can use the type of business to figure out whether or not the request is “reasonable”
How many cell-phones does a hair salon really need?
Fraudsters are often “greedy” and try to get many devices from different carriers

13. Hiding in an Office Park

14. Case Study: Hiding in an Office Park
”J William”
Consumer name…
Business appears to be in an office park with a lot of businesses
Dozens of apps to lots of different providors over the last few years
There are several applications to a completely different company (“Horizon River Technologies”) about a month prior
If you lookup Horizon River you can see it is a legit company (has LinkedIn, website, etc) that is currently in that suite
No mention of a “J William” on either their website or on LinkedIn

16. Hiding in an Office Park
It is difficult to keep understand exactly what businesses exist in an office park (especially something like executive suite)
Looks like a business office with a history of other applications which would throw off an analyst
Also probably very easy to pickup mail from such a location
Can catch by looking for evidence of different businesses at the same suite number.

17. Beating the Clock

18. Case Study: Hitting Multiple Carriers
Hit all major wireless carriers in one day
Successful in 3 out of 4
Single day losses > $16,000
* Yellow circle indicates credit write off
August 2013
November 2013

19. Beating the clock
Blast multiple carriers in a short amount of time with same application before a trend is identified
Difficult to identify without data sharing
Cross-industry application velocity is indicative of this tactic

21. Wilson Lines Inc. 12 applications over 6 months to 4 carriers
All distinct EINs, multiple addresses used
Appears legitimate company is at address, but contact info does not match
domain does not match website
Over-Under: $10,000
Total Losses: $45,000

22. Central Texas Oil Immediate charge off at communications carrier
Applies for loan
Multiple attempts for phone, address change * Yellow circle indicates credit write off ** Red circle indicates confirmed fraud
Address Change
Over-Under: $25,000
Total Losses: $30,000+
January 2013
April 2013
July 2013

23. King of Queens Café 21 applications over 4 months to 3 carriers
11 accounts opened, all charged off
Tumbled address, EIN, and phone numbers
Clear evidence of another business at primary address
Over-Under - $45,000
Total Losses, One Provider: $6,000

24. New Homes Construction
Tries to hit every provider
Uses multiple addresses and EINs
Successful multiple times at one wireless store * Yellow circle indicates credit write off ** Red circle indicates confirmed fraud
Over-Under: $5,000
Total Losses: $18,000
March 2012
January 2013
April 2013

25. Joe’s Vending Machine Repair
Successful with all wireless carriers in two days
Successful with one lender six times in one week * Yellow circle indicates credit write off ** Red circle indicates confirmed fraud
Over-Under: $36,699
Total Losses: $37,000+
April 17, 2013
April 26, 2013
April 30, 2013