Repeat fraud

The same fraudster, identity, or device attacking again after being caught, or moving on to attack other organizations.

A person blocked at one bank may simply try another, often with a new name or documents.

Fraud committed by an actor, identity, or device that has already been involved in a prior fraud attempt, whether at the same organization or at others. An actor is the person or group behind the activity.

Repeat fraud takes several forms:

• Return attempts, in which a declined applicant applies again with changed details.
• Cross-institution attempts, in which the same actor targets several institutions in turn.
• Reused identities, in which the same synthetic or stolen identity is used again.
• Reused devices or faces, in which the same device or face shows up under several names.

A typical pattern looks like this:

1. A fraudster attempts to open an account at one institution and is caught.
2. Days later, the same face appears at another institution under a different name.
3. The second institution sees only a new applicant unless it can learn what happened at the first.

Signals that can reveal repeat fraud include the same face, the same device, shared contact details, and similar behavior across applications.

Detection depends on how widely an institution can see:

• Within one institution, duplicate detection and identity graphs can catch repeats.
• Across institutions, a network-based approach can catch actors who move between them.

Repeat fraud sits next to terms that are easy to mix up:

• Duplicate detection finds repeat applicants inside one institution's own records.
• Fraud ring is a coordinated group, while repeat fraud can be a single actor.
• Network-based fraud detection looks across institutions to catch repeats that no single institution can see.