Many fraudsters act with speed and urgency because their tactics — like credential stuffing and card testing — depend on it. Act too slowly, and they’ll be found out before they can strike.
For other fraudsters, though, the approach is different. Rather than striking fast, scammers sign up for new accounts using fake identities. Then, they act slowly and methodically to gain the trust and build up credit with the banks they con.
Only after amassing substantial credit limits do fraudsters finally strike, maxing out their credit and disappearing without a trace. This type of scam, aptly named a “bust-out” scheme, is so prevalent that it’s estimated to account for up to 15% of the average bank’s unsecured bad debt.
In this article, we take a closer look at bust-out fraud. We’ll examine what it is, how fraudsters carry it out, and discuss the damage this scam can cause. We’ll also take a closer look at how you as a merchant can detect bust-out scams and prevent them from harming your business.
Bust-out fraud occurs when scammers use synthetic identities to open up credit cards with issuing banks. Fraudsters will then establish trust and credit by repeatedly borrowing and paying down their cards. The bank, viewing the scammer as a responsible credit user, will allow a higher credit on the account in question over time.
After securing a high credit limit, the fraudster will suddenly “bust out” by maxing out all their credit cards at once, then disappear with no intention of repaying their debts.
Read MoreGetting a firm figure here is difficult. But, bust-out fraud is estimated to cause anywhere from several hundred million to upwards of $6 billion in annual losses.
Merchants are especially vulnerable to bust-out fraud, since fraudsters may choose to purchase expensive products from sellers once they bust out. Issuers who do not want to eat the losses themselves may file chargebacks to forcibly unwind the fraudulent transactions, which could result in chargeback fees for retailers, as well as lost revenue and inventory.
Read MoreBust-out fraud is a sophisticated, multi-stage scam that often takes months — or even years — to play out. The first stage of the scam almost inevitably involves the use of fake or synthetic identities to open up one or more credit cards.
After securing credit under false pretenses, fraudsters will then act as if they are normal cardholders. They’ll make small purchases, routinely pay off their credit cards, and occasionally request credit limit increases.
Finally, once they’ve amassed a substantial amount of credit, fraudsters strike by running up all of their cards to their maximum credit limits. Scammers may attempt to launder this money into offshore bank accounts, or purchase high-value goods that are easy to resell.
Read MoreA single bust-out fraud attack can cost financial institutions and merchants upwards of several million dollars.
Whether fraudsters use their fraudulently established accounts to make purchases or obtain cash, the outcome is the same: scammers illicitly enrich themselves at the expense of honest merchants and financial institutions.
Read MoreBust-out fraud is challenging to spot because the warning signs are clustered at account creation. If those are missed, red flags may only appear again as fraudsters are getting ready to vanish. By that point, it’s probably too late.
Nonetheless, paying close attention to users who provide inconsistent or missing information at signup, or those with a higher number of active lines of credit, can help you keep tabs on potential bust-out fraudsters.
Buyers who exhibit sudden changes in purchasing behavior or activity could also be gearing up for the bust-out stage. Here, the use of behavioral analytics can help you catch bad actors before they begin to do damage.
Read MoreMuch of the responsibility for preventing bust-out fraud lies with financial institutions. As a merchant, your options for fraud prevention at checkout are limited, since bust-out fraudsters have all the information they need to make their purchases look legitimate.
Instead, your best bet is to implement a rigorous onboarding process. Specifically, require all users to create accounts before checking out, and introduce intentional friction by deploying multi-factor authentication — with biometrics as at least one factor — at signup.
Read More
An example of a bust-out credit card scheme is a scenario where a scammer uses a synthetic identity to open a credit card account, uses it normally to build up credit, and then finally maxes it out and disappears.
With bust-out fraud, criminals use stolen or counterfeited data to obtain a credit card, then use those credentials to build a good credit score and open more accounts. At some point, they max out the cards and disappear.
Since credit cards come with limited or no liability for theft, issuers will need to reimburse cardholders. However, they typically try to recoup those costs from merchants. If the cardholder files a chargeback over the stolen funds, everything will fall on the merchant.
Most bust-out scams are built around stolen Social Security numbers, typically acquired through phishing or purchased in bulk off the dark web.
With diligence, some cases can be stopped by banks or card processors. The fraud is nearly impossible to recognize on the merchant level, but monitoring purchases for unusual activity may help detect fraudulent activity.
Sudden changes in activity, inconsistent information, over-ordering, requests for expedited shipment, or excessive return requests can all be warning signs that a scammer may be about to “bust-out.”
eCommerce merchants can prevent bust-out by instituting strict identity verification at onboarding by using tools like biometric authentication and liveness checks. In addition, sellers should deploy machine learning behavioral analytics and require multi-factor authentication (MFA) verification at checkout.
