Maybe they are not aware of the consequences, but people are selling or renting their identities to cybercriminals. How can businesses identify these “identity mules”? 

It may sound like the plot of a bad movie, but it’s happening in real life. A growing number of people are voluntarily handing over their identities to fraudsters in exchange for money or favors. 

People driven by financial desperation, ignorance or manipulation are selling access to their personal details, allowing criminals to open accounts, launder money, evade background checks, and commit crimes that are eventually traced back to the original identity owner. 

This creates all kinds of headaches for online gaming operators, banks, fintechs, retailers and other businesses. Recently, CybersecAsia.net discussed the burgeoning “identity sales and rental” market with identity fraud expert Ofer Friedman, CBDO, AU10TIX. 

How does identity selling work, and what drives people to agree to rent or sell their identities to cybercriminals?

Friedman: Familiar with the concept of mules? People who sell their identities are by definition “identity mules.” More precisely “willing identity mules”, as no mentally sound person accepts payment from a stranger in exchange for the latter’s use of the seller’s personal information without having any suspicions. 

They are accomplices. 

Renting or selling one’s identity information requires either desperation, feeling of immunity, or both. Possibly there are also “revenge identity mules” who sell someone else’s personal data without their knowledge. “Recruiters” may use dark-web marketplaces or social media to post about “quick cash” or “financial services” that promise significant returns. 

Criminals can also use encrypted messaging platforms and even create private groups to advertise their need for mules. Some of those responding may be attracted by word of mouth. It has been observed that there are even “professional” mule services out there. 

Those who respond to such solicitations are typically students, unemployed people, and individuals with addiction problems. To build trust in this anonymous environment, many bad actors have in place reputation and feedback systems, where buyers can rate sellers and their “goods.”

What are some red flags that businesses should look out for to detect rented or sold identities?

Friedman: Detecting identity mules is not that easy, as these are genuine individuals. However, there are a variety of tools that can help detect such cases before and after “account opening”. 

While the sold personal data is genuine and verifiable, account opening in regulated markets does require the use of identity documents and live biometrics. It is not enough to submit the data itself; it must be retrieved in a process that involves live capture of a government issued ID and a live selfie. 

Live captured ID documents and selfies can be checked for authenticity both directly and indirectly, which is what AU10TIX does. Post onboarding, mule accounts are typically detected via behavior: user behavior, application behavior, and device behavior. In the case of AU10TIX, cases can be AI-screened against a global database of known fraudulent submission.

Are there regulations in place, especially in Asia, to discourage this trend?

Friedman: There is no indication that this particular phenomenon of selling or renting one’s own personal data is a dominant practice. There are much easier options for fraudsters to conduct impersonation attacks en masse, at global scale. 

Regulations typically address those who need to defend against such attacks, not those who perpetrate them. Crime prevention regulations tend to be quite universal, with nuances addressing required practices and sanctions. 

While a person selling their own identity might seem like a private transaction, most data privacy and consumer protection laws around the world don’t specifically outlaw the act itself. Instead, they focus on the actions of the entities that collect, use, and sell personal data, particularly in a commercial context.

Can technology help safeguard against this emerging threat?

Friedman: Whether you like it or not, technology is imperative for any effective action against unlawful usage of personal data. Today’s technology paradigm is advocating the “minefield” concept where multiple checks and indicators are simultaneously used in order to heighten the barrier to fraud. Identity verification, biometrics, device indicators, network indicators, behavioral indicators all can serve that purpose. 

What’s nice about today’s fraud prevention technology is most of it is completely transparent to the customer, thus exerting no friction on users. Please mind that the availability of technologies and paradigms makes prevention quite effective, but not all solutions are necessarily the same — thorough research on what exactly each vendor is claiming and practicing is recommended.