Social Security Numbers Easiest Path to ID Theft

MBA (3/17/2008 ) Murray, Michael
CHICAGO—As the mortgage industry resets—getting back to basic loans and underwriting—identity thieves also adapt. And the core source of ID theft remains the same—Social Security numbers.

ID theft ranges from Fictitious ID Fraud—created through constant use of a false Social Security number that winds up on credit reports—to stealing an individual’s real SSN, also known as True Name Fraud, said Larry Ruder, vice president of fraud at Wells Fargo Home Mortgage, Des Moines, speaking here at the Mortgage Bankers Association’s National Fraud Issues Conference. Social Security misrepresentation and collusion—such as a straw buyer purchasing collateral for a fee on behalf of a third party—are other forms of ID theft.

“I believe people are going to start using ID fraud to get out of a property,” Ruder said.

Whether the issue is credit or fraud, Ruder said to find the facts behind case—ask questions on how to stop fraud and put the proper controls in place. “Start gathering the documentation and develop a case file,” he said.

Lisa Binkley, executive vice president of risk strategy and policy development at Rapid Reporting Verification Co., Dallas, said ID policies are critical. “The criminals are not going away,” Binkley said.
Specific ID verification policy and independent information help identify ID theft, including validation or verification with the Social Security Administration. “It would be nice if automated underwriting engines or systems would trigger these red flags,” Binkley said, noting that ID theft affects 10 million people each year at a cost of $50 billion for businesses.

Data from Fannie Mae and the Mortgage Asset Research Institute, Herndon, Va., support reports that ID theft or fraudulent SSNs are rising in the mortgage industry. “It is critical to be proactive with effective policies and procedures to detect ID thieves throughout your organization before funding the loan,” Binkley said.

At Wells Fargo, investigations begin with an alleged victim, meaning that it needs to be seen at the servicing level, and it could conclude a mistake at the credit depository.

“Cost effective tools run on all applications,” Binkley said. “Always run a SSN search against internal data tables to determine if other loans exist. Underwriting should be able to quickly match information against the loan application. And it should be run 100 percent of the time. It’s the only way you’re going to solve the problem 100 percent, if you’re looking at it 100 percent.”

For pre-funding, ID theft is difficult to find if not looking at data and trends, including changes in an individual’s pattern of behavior; multiple individuals on a credit report; and inconsistencies on the loan application that do not match.

“Once again, it’s common sense. Does it make sense? That’s really the most important thing you can do for your organization. Let them see if it makes sense,” Binkley said.

Sometimes, the SSN is a typo; if not, Wells Fargo sends out an ID Theft Fraud Packet for investigation into a potential victim of ID theft. Questions arise about disabling the account to prevent more exposure or loss or having a victim file an affidavit. Ruder and his group process SSNs against sister companies under the Wells Fargo umbrella to identify any other forms of potential fraud within the company.

If borrowers do not respond to the ID Theft Fraud Packet, Wells Fargo waits for 30 days for a complete package, and if it does not receive that fully completed package, they close out the investigation. However, when receiving the package, Wells Fargo notifies the borrower if the SSN is valid and, if not, it notifies credit bureaus to take information off of credit files to fix up credit and provide a form of customer service for the borrower.

“Notify, notify, notify,” Ruder said of internal legal departments, investor clients, sister companies and in creating suspicious activity reports, or SARs.

Customer call-in, third-party notification—including sister companies, attorneys, investigators or relatives—can contribute information on identity theft for mortgage firms.

Wells Fargo also scrubs all closed loans after 30 days against external or internal data sources to identify impossible SSNs based on the SSN Death Index and other indexes. “There can be problems with the credit repositories,” Ruder said.

Rosemarie Wolfe, director of quality control at EquiFirst, Charlotte, N.C., said appraiser ID theft is nearly impossible to detect, while lending in different markets results in low familiarity of the area by underwriters. “We really don’t know the market so that appraiser is our eyes and ears in that market,” she said.

“It’s a real common theme we are seeing, even in full-doc loans,” Ruder said. “It’s time to get back to Underwriting 101.”

Some customers call with a “real SSN” to fix the current one on file, but Wells Fargo’s customer service operations set up an actual process to prove that the caller knows the correct identification. Phone matching tools, such as a voice recognition unit—VRU—provides steps when a caller does not provide the loan number or the last four SSN digits.

In some cases, ID theft is part of a larger scheme: a perpetrator steals an ID and changes a borrower’s information. The perpetrator files for bankruptcy and servicers are unable to call during a bankruptcy filing for legal reasons, giving a fraudster time to sell the property, exit and leave the borrower homeless.