David Maimon, Head of Fraud Insights at SentiLink, joins Yvette Bohanan for another episode to raise awareness about different fraud tactics and their impacts.

In this conversation, Yvette and David explore the intricacies and implications of Credit Profile Numbers (CPNs) and synthetic identity fraud, as well as “zombie debt” and assumed identity fraud. Listen in to hear the implications of these fraud schemes and how industry professionals can get ahead of them.

Yvette Bohanan: Hello, I’m Yvette Bohanan, a partner at Glenbrook and your host for this episode of Payments on Fire.

Welcome to our second installment of Scams, Stings and Swindles. I’m here sitting down with David Maimon, Head of Fraud Insights at SentiLink. David, welcome back. Thanks for being here. We really appreciate it.

David Maimon: Thank you so much for having me.

Yvette Bohanan: For this episode, I wanted to jump in and spend some time focusing on identity and specifically, specifically I want to start asking about credit profile numbers or what’s referred to as CPNs, credit profile numbers. You had a post a while back on LinkedIn, and if people are not following you on LinkedIn, I’m telling you guys you should be.

CPNs, let’s start at the basics. Can you define, explain what they are just at their very basic level? Why do they exist?

David Maimon: Sure. So, CPN, credit profile number or credit privacy numbers are essentially a fake sequence of numbers which seems to be like a social security number. Some individual use them instead of social security numbers in order to hide a bad credit history or the fact that they don’t have a social security number. So, essentially the CPNs are marketed as a tool which will allow you to repair bad credit or disguise or conceal the fact that you have a very low credit scores.

Many people out there will simply use them in order to try and purchase a new phone and establish a new phone line. Many people will, try to use those CPNs in order to rent an apartment. And we hear a lot of companies, a lot of tenant verification companies who are experiencing issues right now with CPNs and the fact that they’re so popular among residents. And of course folks will use CPNs in order to try to open bank accounts and create new credit lines.

Now, the cool thing about CPNs, or the important thing about CPN, is that in order for it to be functional, it needs to have some history around it. So in order to be functional, you need to have the CPN, a name, and some history which will allow you to work with the synthetic identity that you’re building when you’re applying to all those organization, institution, FIs, whatever you were trying to do with a CPN.

And it takes time to create this history around the CPN in order for it to be functional. So if you know what you’re doing and you understand how social security numbers are created and you know what the three digits stand for and so on, then maybe you’ll be able to create your own CPN.

Once you have your own CPN, you will then need to apply to different places, financial, maybe more non-financial institution, to have a footprint in the public record. But if you don’t know what you’re doing, you’re going to need to have some help with that. And so that is where the CPN vendors come very handy because the CPN vendors offers to sell those CPNs for reasonable prices, I have to say.

Yvette Bohanan: This is so fascinating because people don’t talk about this, right, in the industry? I’ve been in this space for a long time and didn’t realize what was going on. So did this all start, did CPN start as a legitimate thing or has it always been an illegal activity? Just the creation of them.

David Maimon: You can create it, but you can’t use it, you know I mean? Creating a sequence of nine numbers and pretending it to be a social security number is, is okay. I mean, you can do it, we can do it now, but the problem start once you start using it and you start replacing it with a social security number.

Yvette Bohanan: Sorry, I just want to be really clear with our audience. When you’re saying vendors of our CPNs, they’re actually in the business to supply people for using these for illicit gain. There’s nothing good about this. It’s not like you should be using this to do credit repair. It’s credit obfuscation.

David Maimon: As you know, Yvette, it’s all about the marketing, right? The CPN vendors will try to sell this as a legitimate thing, right, as a legitimate number, as something that you should use in order to repair your credit. But at the end of the day, some of the CPNs will be created using some of the tools out there and some of the knowledge that the CPN vendors have. But most oftentimes, many of the CPNs we are familiar with are stolen social security numbers. They are stolen social security numbers of young individuals who haven’t really started using their social security numbers, of babies, of people who hasn’t really started using social security in the context of their credit history. And so oftentimes those individual will become the victim of the CPN usage.

Yvette Bohanan: So this is some vendor, they may be posing as a quote unquote legitimate business of credit repair to put out a shingle to offer these. They may be fabricating these, and we’ll talk about fabrication and what they’re doing, or they may be stealing them from people who would be completely, they have no idea that this is happening. And then are there mules? Are there people that like will sell their information?

David Maimon: So, so, no. Essentially what will happen, you’ll have a CPN, you have a fake social security number to work with.

Yvette Bohanan: Okay.

David Maimon: And then what the vendors will do is they will try to start building the history for the CPN. And so what they will do is exactly what we discussed. They will start using the identity along with the CPN in order to apply for account with Big Lots or account with AutoZone. They will use the identity to try and create as many public records as possible, including trying to create some footprints in the financial industry. And the way they’re doing this is by taking advantage of tradelines. So tradelines are extremely important, right, in the context of understanding the CPN and the whole operations of the vendors out there. So essentially, when you need a CPN, you are trying to build a better credit score in order for you to be able to apply to an apartment or a new bank account or a new credit line.

In that sense, you need to have a CPN or a social security number with a good credit history around that. The way to do that is to have a tradeline with positive value to it. And so essentially what the criminals will do is they will take the CPN and they will try to add the CPN as an authorized user to existing tradelines. Once they’re doing that, they help boost their credit score and their credit history and will instill more confidence in potential lenders who will then look for the identity and then will think that this is a legitimate identity, that they should work with and that’s essentially how folks bypass.

Yvette Bohanan: They’re like piggybacking on top of a legitimately good as an authorized user of that account’s activity. Wow. Okay. So, like a companion card for your credit card or whatever. You want to add someone to your account? Well, they’re just adding themselves to your account and they, they may not even put a purchase on it, right? They’re using your good name and credit. Okay.

David Maimon: They’re using your good name in order to create some history around the CPN around the synthetic identity they’re working with. And so what the CPN manufacturers will do is they will offer the CPN along with the tradelines attached to it for sale.

There’s wide range of CPN, of course, out there and profiles that you can purchase, and what determine the price at the end of the day is how old the tradeline is and the credit limit on the tradeline.

That essentially what will determine the price of a CPN that you can purchase out there.

Yvette Bohanan: Interesting. So what are the prices? How much are these things? is it a nickel? Is it a dollar?

David Maimon: No. So, we talked a lot about the fact that it takes time to build the history around that. And think about the tradelines. At the end of the day, if you’re a manufacturer of CPN, you want to make sure that you have a tradeline and you have to purchase the tradeline, you have to groom the redline for a while, right, and only then you will sell it, right? I can tell you that I just concluded a really interesting study where I did some market analysis of some of the services out there. The vendors are active on the Clearnet.

I can send you a list of websites from which you can purchase CPNs, packages for reasonable prices. They work in Facebook. You can find, of course, in Telegram and Darknet, but again, Clearnet is good enough for you to try and purchase a package. Many of the vendors I looked at during the last couple of weeks or so, they have different packages.

They have the starter package, which come with a credit score of around 680, with a, credit line which is two years old and with a max credit limit of $12,000, and that will go for between $400 to $750. I It really depends on the website, the vendor you’re working with, right, and what you’re getting with respect to the documents, right. Are you getting the fake social security card as well? Are you getting other certificates that go along with that or not? A mid-level package, which usually includes three tradelines and a credit limit is of up to $50,000 and a credit score of around 735, that will go for around, again, between $1400 to $2,500.

And then you have the highest level that will come with six or seven tradelines, aged credit limit of close to $100,000 that could get up to $3,000. There’s a wide variation there. all the prices I gave you come from the Clearnet, so you can go on your own on some of the website and check it out yourself.

But there are prices also available on Facebook, on Telegram, and then it really depends on the vendor you do business with. There’s definitely a wide variety of vendors to work with out there.

Yvette Bohanan: So this is interesting. So we’ve gone from simple identity, stolen social security number, maybe a bank account, all the way to the sort of proforma, everything you need to set up a life in a sense, right? An assumed life, in that case. One of the things that came up too when we were chatting about this was zombie debt and how it’s being used. Can you say a little bit about explaining what zombie debt is and how that kind of feeds into this whole scheme?

David Maimon: Of course I’m happy to talk about this and again, it’s quite fascinating to understand how everything is intertwined, right? So again, we talked about tradelines and tradelines are very important in the context of the CPNs because again, you want to build some history. You want to create some good credit history around the CPN and for that you need to have tradelines in good standing.

Zombie tradelines are tradelines which are uncollectible, meaning the banks or the lenders who owned the tradelines gave up of trying to collect the debt on them. And so they offer those tradelines for sale for brokers out there and those brokers are trying to make some money out of those lines so they’re selling them for pennies over the dollars. Now you, as a scammer, one of the things that in the past you did was you purchased those tradelines, you essentially tried to collect on them using very aggressive tactics. And my friend Frank McKenna talked a lot about this, he started talking about in 2022 and it’s quite fascinating to see how back then he was thinking about it and the evidence provided back then as well.

But recently we started to see folks using those zombie tradelines, along with their CPNs. So instead of purchasing a zombie tradeline and trying to collect on that, what fraudsters will do is they will take the zombie tradeline, they will pay it and then they will use their CPN as the legitimate owner or the primary owner of that tradeline. And so once the broker report that the line was paid, then it will show as a positive transaction, right, as a positive on the CPN profile, and that will help increase the credit score on the CPN.

The zombie tradelines could be purchased pretty much everywhere on the Clearnet. You don’t need to go on the dark net, you don’t need to go on telegram. There are many vendors out there who will sell you the tradelines. You don’t need to have special permission or special licenses. That’s essentially what the fraudsters do. They buy those tradelines for really cheap prices and they append them to the CPNs. Once the line is paid, it’s reported on the CPN credit history and that, again, create the facade of this is a legitimate person who pays their debt and that you should definitely do business with if you’re a lender or a bank or an apartment owner.

Yvette Bohanan: Wow. So when you’re talking within the industry about this to people who are in banks, payments, whatever. Are people shocked to hear about this? This whole thing, the CPN, the zombie debt, the piggybacking. All these things have happened discreetly, and like you’re saying, a lot of this stuff is on the Clearnet ,it’s quite surprising. But are people shocked when you pull back the curtains and you’re actually explaining this whole thing to them. What do you get? What kind of reactions are you getting here?

David Maimon: Yeah, for folks who are not familiar with those specific issues, they’re definitely shocked. But again, this is one of those things where are available out there on the Clearnet. So again, no need to really go and look for some information on the dark net and really to try and understand. There are so many tutorials out there, so many vendors out there who works with Facebook and sell this service.

So I guess what I’m saying is that if you’re a fraud fighter who is not necessarily dealing with the issue of identity verification, maybe you will not be familiar with the issue of CPN and synthetic identities to the level of details that I just described, and that’s perfectly okay, right? But if you are doing this, if you are doing identity verification, you probably will be familiarized with some of the content I just shared.

Yvette Bohanan: Mm-hmm. And pretty much anything that has to do with account opening, whether it’s a bank account, a loan, you’re listing everything that’s basically a financial vehicle here.

David Maimon: That’s right.

Yvette Bohanan: So anyone who’s involved in product management or engineering, even if your risk team, your group isn’t bringing this up to you, you need to realize it’s happening, even if they’re not talking about it. Everyone’s essentially a target for the use of these identities, these complete fake identities.

David Maimon: 100%. We’re seeing those identities being used in the context of trying to lease new apartments or rent new apartments. We’re seeing those being used in the context of opening new bank accounts or creating credit lines, those will be very good in the context of bust-out as you would know, right?

We see that those identities are being used in the context of car finances. In fact, auto tradelines are available on some of those websites as well, so you can buy a CPN with an auto tradelines attached to it already. Once you have an identity, the bottom line you can do pretty much everything. All you have to have are a bunch of documents, which again, you can purchase from the online fraud ecosystem, put your face on it and you’re good to go.

Yvette Bohanan: So I’m going to shift gears for a second since we’re on the topic of identity and synthetic identity, and all of that. On your website had a recent post about people who had H1B visas come into the country and who have since left the country, and how that information is being used now in fraudulent activity.

Can we touch on that just a little bit to make people aware of what’s happening there?

David Maimon: What we identify as assumed identity abuse is the type of abuse which involves a criminal group, usually a gang, taking over a list of Identities which had H1B visa on them. These individuals were probably here, and it doesn’t have to be only H1B, we’re talking about maybe folks with F visas, folks who came to this country to study four years, they had to have a social security in order to get paid during that time. After their four years, they left the country, went back to wherever they were, and the social security number still is still there, right, identity is still there.

And so, the assumed identity abuse is essentially what we refer to as individuals who were either selling those identities or their identities were essentially stolen and criminal gangs started using them in the context of account opening, credit card applications, loans, and so on and so forth. Essentially we’re talking about folks who were here for a period of time, did their work, did their study, went back home, and then someone took over their identity and started working with that.

What’s interesting about those identities is that when test for this type of potential fraud, you will see some gaps, usually, in the context of the use of the identity for a period of time. Imagine you’re an immigrant here in this country. You came here to study. You have four years where you have to rent an apartment. You have to open a bank account. So you will see a lot of applications coming through during that time period.

Then oftentimes what we’ll see is a gap. So we’ll see that individual sort of fell out earth, so to speak, simply because that individual went back home. And then at some point we will see things lighting up again, like someone is using the identity to rent a new apartment or open a new bank account or create a phone line. So you’ll see those gaps and that’s one of the indications we have that this, along with others, which we’ll not talk about, is one of the indication which tells us that we are talking about assumed identity abuse.

Yvette Bohanan: Wow. Yeah, so it’s like sleeper accounts where we say their bank accounts or seller accounts on marketplaces or whatever. They get opened up and then there’s like some activity, no activity, and then light up activity.

David Maimon: Exactly. Yeah.

Yvette Bohanan: Yeah. Very, very interesting. So we have to keep our radar on.

What should people be doing in the industry to get ahead of these things? How should they be thinking about this? Is there anything specific that they should keep in mind? I mean, There’s some obvious stuff here, right? Never assume, use a lot of different sources, all those good habits that we need to just use more and more when we start designing for things. But anything else on this particular topic?

David Maimon: You need to have a solution at the end of the day. You need to have a solution which will allow you to detect synthetic identities. At the end of the day, those CPNs are just synthetic identities. We’re talking about first party fraud. In order to detect first party fraud and those CPNs, you need to have a solution which will allow you to tap into multiple databases at the same time and make a conscious decision in respect to the history of the identity, whether it makes sense or not, right? So one of the things that we do is exactly that. SentiLink, we are known for our synthetic identity scores. I’ll brag and say that I think they do very good at detecting synthetic identities.

But at the end of the day, if you want to be in front of this issue, you have to have a solution which will allow you to tap into multiple databases and build this picture of the identity that you’re trying to verify over a long period of time.

Yvette Bohanan: Yeah. Cool. Alright. Well, David, it’s that special time again where we have to wrap things up. Thank you so much for spending time with us on this episode. Really appreciate it.

David Maimon: Thank you so much for having me.

Yvette Bohanan: And to all of you listening, thanks for joining us. We hope that this has shed some light on what’s going on out there in the world.

And until next time, keep up the good work. Bye for now.