Identity fraud is the use of a misappropriated identity with the intention to commit illegal activities. It is a problem that has gained more attention in the wake of the increasing threats of terrorism around the world. This white paper addresses some of the basic issues related to the use of identity technology to detect attempts of ID fraud. The use of biometrics in relation to detecting ID fraud, the issuance process of identity documents and the scope of the ID fraud dilemma are several key issues presented in this white paper.

Identity fraud is nothing new to society, but has gained attention in recent years. Coupled with the introduction of new types of security technology features, the need to continually improve and develop measurements used in identifying an individual’s credentials emerges.

These measures can be described by the term identity management, which relates to the manner in which a societal institution manages citizen’s identity.

To understand the scope of this problem, we can see it as an ongoing battle between those that govern individual’s identity management, the Identity Management System, and those who have some reason to misuse identities.

The groups of characters with a reason to misappropriate identities include:

• People planning to conduct acts of terrorism
• People with intentions of conducting illegal activities, or criminals
• People who illegally receive state benefits
• People with relations to organized crime, smuggling or human trafficking

This battle of identity can be described using the metaphor of the “Arms Race” in that the involved parties always seek to overcome the opposition with some kind of advantage.

The extensive use of communication tools such as the Internet and the ease of access to technological devices to produce fraudulent identification documents are characteristics of what we can call the current paradigm of identity management.

The introduction of biometrics and the revision of existing legislation both in the U.S. and the European Union are examples of the future changes in the identity paradigm and of the approaches used to stay ahead in this “Arms Race”. However, introducing new measurements to the identity management system could prove to be a double-edged sword if not applied correctly. On one hand it eliminates the possible use of the existing fraudulent methods, on the other hand it might provide new ways of conducting identity fraud.

This paper gives an overview of some of the most common practices regarding ID Technology Fraud Detection today, based on the discussion of these three questions;

• What are the measurements used to verify identities today and what kind of technology is used?

• What are the most common types of ID Fraud?

• What can be described as best practices in preventing ID Fraud?

Analysis

Identity Measurements

The term “identity” is a word that can be used by different definitions, here we refer to the identity as the unique attributes of an individual which enables them to be either identified or verified by an identity management system. These unique attributes can be categorized by three basic elements:

Biometric Identity –Unique to an individual:

• Fingerprints
• Voice
• Retina
• Facial structure
• DNA

Attributed Identity –Components of an individual, given at birth:

• Full name
• Social security number
• Date of birth
• Place of birth
• Parents name and addresses

Biographical Identity –Individuals history, built up over time.

• Registration of birth
• Registration of educational information
• Tax registry
• Employment history
• Registration of marriage/divorce
• Mortgage account information/ property ownership
• Insurance policies
• History of interaction with public/private organizations such as banks, police, creditors etc.

When describing measures of identification we illustrate the difference between authentication; which describes the process of verifying a claimed identity, and recognition; which refers to the process of how to determine an identity from an already established database based on the registered attributes of an identity. In other words, does the identity match the one it claims to be and do the attributes provided match the attributes registered in the system.

This differentiation of the identification process is also mentioned by Willox and Regan, who describe three basic means of identification; (1) Knowledge-based, (2) Biometric Identification and (3) Token-based. They highlight the differences between authentication and recognition, whereas in the first phase of the process of identification (the enrollment), the only means of identification that applies is knowledge-based information.

“This phase is the beginning of the identity verification process when the individual is new to the verifier. It is this stage of the identity verification process that is most susceptible to abuse”.

Jain, Hong & Pankanti refer to these two different processes as “the enrollment module” and “the identification module”. To differentiate between the two separate parts of an identification process is important in order to establish a general understanding of what could be looked up on as the best practices to detect attempts to fraud the identification management system, regardless of its scope.

Enrollment

The authentication of an identity is where the process of the establishment of an identity begins; also known as “the first-time registry”. This is when an identity will be “registered” into the identity management system, as though the greatest challenge regarding the verification of an identity is the authentication of a identity for the first time. The key question to address in this part of the process is “How can the system know that the identity being registered in fact is the real identity?”

Whether it is the issuance of a passport, a driver`s license or any other document that can be used as identification, the challenge regarding this issue is to determine if an identity is real or not, based on the absence of, or the lack of good enough documentation to actually prove that the identity that is being submitted for application in fact is the identity it claims to be.

The use of biometrics in identity management could be used to address this problem, for instance by registering biometric information from birth. This practice is still years from being a feasible solution, as it poses some major challenges regarding what to do with the those who already have an established identity in the system. There are some cases where countries have already started the process of rolling out this solution, such as the ID Project in India, but this is an implementation that might not be applicable to other countries either because of the project-cost, or simply because of the controversial discussion going on in some countries regarding the scope of use of biometrics.

In the paper Identity Fraud: Providing a solution (2002), Willox and Regan emphasize the use of knowledge-based means of identification will probably continue to be regarded as the most important measure of first-time registries in the time to come. Measures like this include:

• Birth certificates
• Social security numbers

Identification

When an identity has been established with its attributes in the system, the issue of identifying relies on the system’s ability to recognize and connect the attributes provided with the attributes registered.

The key issue in this part of the identification process is to have systems that are able to separate whether the attributes that are being introduced to the identity management system are the same that are registered in the system. If there is no match, then the system will not recognize the identity.  The scenario of verifying identities has four possible outcomes;

• The identity introduced matches the identity registered in the system, and the identity is verified.
• The identity introduced is registered in the system, but the system fails to identify it. This is also known as the false non-match rate.
• The identity introduced is not the real identity registered in the system, but the attributes matches the attributes registered in the system and it is verified. This is known as the false-match rate.
• The identity introduced has false attributes and are rejected by the identity management system.

It is the two latter possible outcomes that are related to identity fraud. In ID Technology fraud detection the challenge with designing systems that have low false-match rates is that in most cases low false-match rates means higher false non-match rates.

Types of ID Fraud

The issues of ID Fraud range across several areas, which can be divided into two main categories; (1) individuals altering their own identity or (2) altering the identity of someone else.

Some commonly known types of ID Fraud include;

• Usage by non-authorized persons
• Altering personal information
• Replacing or altering the portrait/tampering the ID document
• Creating a new ID document
• Duplications of an ID document
• Spoofing*

*The use of false attributes either to gain acceptance to an identity, or to purposely be rejected by the ID management system is known as spoofing. The spread of using biometrics in identification poses new challenges for the design of an identity management system. The first biometric identification system that was introduced could easily be fooled through spoofing.

Some examples of spoofing include using falsified fingerprint replicas to be approved by a system, or using other falsified biometric data with the attempt to fool the system.

Making systems less prone to spoofing includes some approaches to combat spoofing such as;

• Attended, supervised sample collections
• Changes in responses, such as changing the specifics of the collection of the attribute data on the collection point
• Liveness detection: Technology that is able to detect that the biometric sample is from a living, breathing human being. Using liveness detection technology is a key tool in the prevention of spoofing. An example of use is to have the sample collection point look below the surface of a fingerprint to detect the presence of veins, tissue or other features.

Practices in ID Technology Fraud Detection

The issuance of an identity poses a great challenge for many in the identity management environment. In the U.S. and in the E.U., measures are being introduced to standardize both the issuance process and the tokens holding the attributes of an identity. This will increase the possibility of detecting fraudulent IDs without increasing the false non-match rates. For instance; The Real ID Act of 2005  that is currently being introduced in the U.S. describes 18 benchmarks for the issuance of IDs that will serve to help the identity management systems detect if an attempt to use a fraudulent identity has been acted. The 18 benchmarks cover areas from the process of issuance to the data requirements the ID card should possess.

Detecting Fraud in Enrollment Module

The verification of an identity in the first-time registry process may be the most difficult area of identity management to perfect, this is the area at greatest risk for fraudulent attempts. With only knowledge-based information to rely on, the need for a resilient framework is inevitable. The identifier in this process has to be able to determine identity attributes based on unreliable information. Typically this kind of information has been limited to identifying information such as birth certificates or social security numbers. The best practices to detect fraudulent attempts in the first-time registry process is to have systems that are able to determine if the information that is being provided is something that only the real identity would posses. In the proposed U.S. Real ID Act, measurements to ensure the validity of the knowledge-based information is implemented in the benchmarks 2-8,12,13,15 and 16 all apply to the problem of verifying first-time registries. In the case of first-time registries the possible failure rate cannot be totally eliminated, so introducing multiple barriers to approve the application of an identity being submitted reduces the possibility of fraud, and could therefore be considered as the best practice.

In the U.S., these barriers cover areas such as the verification of different identity documents which either verifies the identity or the legal status such as birth certificates, employment authorization documents, documents containing social security numbers or principal addresses amongst others. These documents are controlled against a series of reference databases like the USCIS SAVE-database, The National Association for Public Health Statistics and Information Systems Electronic Verification of Vital Events database (NAPHSIS EVVE), and other Vital Records Agencies.

Furthermore, in the United Kingdom (UK) efforts to simply tighten the existing systems for issuing documents and unique identifiers are being implemented. Raising fraud awareness amongst issuance staff is one of these efforts.

The UK cabinet office paper Identity Fraud: A Study also mentions some other actions to introduce multiple barriers in the issuance process;

• Supplementing the existing systems with private sector-style checks against “biographical” evidence of identity. Enabling more identity fraudsters to be detected by a more sophisticated way of risk profiling
• Use of face-to-face interviews for those who fail the “biographical” test of identity
• Checking applications against a central registry of known frauds
• Applying dedicated IT systems to check applications for internal consistency and consistency against other information held by the government

Tightening the systems in the issuance process is highlighted in the study Identity Fraud: A Critical National and Global Threat carried out by the LexisNexis Group and CIMIP, the Center for Identity Management and Information Protection at Utica College.

The Verification Of An Established Identity

Once an identity has been established in the identity management system, more measures can be included in the verification process that increases the possibility of detecting fraud. Deterring whether an identity is real or fake in this phase not only relies on the knowledge-based information but also the identity attributes in the form of biometric information or token-based identification. Biometric attributes provide the identity management system with more reliable attributes of identification as they are unique to the individual.

The introduction of fingerprints and facial recognition are examples of using biometric attributes for identification. Using biometric information requires that the system-in-use of identification is able to properly detect that the attribute being provided is in fact the same that is registered in the system. This relays back to the issue of spoofing, and altering the biometric attribute that is provided to the system.

Using technology that is capable of detecting counterfeit biometric attributes through the approach of liveness detection is a key tool in preventing attempts to spoof. This could be implemented through extensive measures in recognizing the attribute. In fingerprints for instance, systems looking below the surface of the skin to detect the presence of tissue, veins or other features.

Another measure to ensure the validity of the attribute is to randomly change the specifics of the attributes at the collection points, for instance in the case of facial recognition to look for changes in the facial characteristics.

Conclusions

Detecting identity fraud is a complicated process; it is much dependent on how the systems for issuance and identity management are designed. The measurements on how to verify an identity forms the base of how fraudulent identities can be detected. This includes both the legislation that forms the basic set of rules that an identity management system relies on, as well as the technological instruments that are available to detect fraud. Standardization of the identity attributes that form the identity, and a solid framework in the issuance process are key in the development for best practices solutions in detecting ID fraud. Using multiple barriers to ensure that the identity being verified is the same identity that has been registered is another significant factor to the success formula of developing best practices.

Best practices in the issuance process are related to the use of multiple-sources as support for decision-making in the verification of an identity application. The identity management system’s ability to verify the authenticity of information in the submitted application is important. Software that enables detecting fraudulent documents combined with extensive risk-profiling will help reduce the probability of accepting fraud documents.

The use of multiple barriers makes the tokens used for identification hard to forge. Using biometric attributes for the means of identification should include some form of redundancy in systems, making the biometric information less prone to spoofing.  Besides using measurements to detect spoofing in the identity management system, having more than one biometric attribute linked to the identity could help reduce the false match rate without necessary increasing the false non-match rates.

At last, the tokens used for identification should be designed in a way that makes them as tamper-resistant as possible. Measurements like watermarks, bar codes and other measurements for card security design should be included. The last suggestion is to continually work with improvement of the identity management system, to always be one-step ahead in the race.