$3M FanDuel fraud case shows why online gambling needs biometric IDV, liveness

Federal authorities have charged a pair of 29-year-old men from Connecticut with defrauding online gambling platforms, primarily FanDuel, of $3 million using identities stolen from approximately 3,000 victims. The case encapsulates the urgent need for gaming and gambling platforms to ensure they have modern identity verification with biometrics and liveness detection in place, Jumio SVP of Product and Technology Reinhard Hochrieser tells Biometric Update.

The two individuals were arrested in early-February and charged with 45 counts of criminal activity related to identity fraud, identity theft. They used background checking services like TruthFinder and BeenVerified to obtain personal information they then used to pass questions used for identity verification to open the fraudulent accounts, according to an announcement from the U.S. Department of Justice.

Bleeping Computer reports that the two men also created accounts on popular gambling platforms Draft Kings and BetMGM over the several years they allegedly carried out the scams.

Knowledge-based authentication (KBA) has been understood to contribute to fraud vulnerability for years.

Secure onboarding means layers and networks, not KBA

So how did these attacks, at this volume, without benefit of sophisticated biometric spoofs or deepfakes, succeed?

“We’re not likely to learn exactly what happened unless FanDuel specifically discloses it,” Jumio’s Hochrieser told Biometric Update in an email. “However, organizations need to be aware of common vulnerabilities in this space.”

Basic onboarding solutions dependent on knowledge-based authentication can be easily bypassed, he notes, so “gaming operators need to implement an identity intelligence solution that is all encompassing.”

“This includes biometric verification that pairs a valid government-issued ID with a selfie, uses liveness detection to confirm the person is physically present, and leverages an identity network,” Hochrieser says. “This layered approach ensures that a fraudster who uses stolen IDs will ultimately fail those onboarding checks. It also increases the probability of understanding if a stolen credential was used elsewhere in the network, allowing an operator to identify these fraud patterns before damage occurs.”

Asked about the role of background check services in the attacks, Hochrieser says: “Background check services themselves are not the reason for the scaling of identity-based attacks. However, these platforms have the potential to be abused by fraudsters to contribute to those attacks if organizations are not implementing layered, intelligent identity verification solutions. Fraudsters can exploit these services to bypass static and basic identity checks. That should be a wake-up call to the whole industry that layered forms of defense – like requiring both an ID and a selfie to verify a user – are mandatory in the modern threat landscape. A sophisticated onboarding solution moves beyond these static checks and can automatically flag if the same credentials, such as the name and date of birth, are being reused to open multiple accounts. This can trigger an alert for suspicious activity, stopping fraudsters in their tracks before they can do further damage.

Hochrieser argues that awareness of the need for up-to-date identity verification has risen among the leaders in gaming and gambling industry, with face biometrics and liveness detection now in place for the majority. In some cases, these decisions are being encouraged by regulations.

“However, there are some businesses in the gaming space and beyond that are more concerned about conversion and friction than securing their onboarding solution. This fear that robust checks will lead to player drop-off can present a blind spot that fraudsters can easily exploit.

More coordinated fraud activity is likely ahead, according to Hochrieser, making enterprise cooperation on fraud critical.

“If the scammers collaborate and travel in packs, the industry needs to respond similarly. Instead of treating these attacks as isolated events, sharing fraud intelligence collectively can help disrupt fraud networks.

“Modern solutions can now also allow organizations to fight fraud while still easing the onboarding process for legitimate users. Secure onboarding doesn’t have to be a tedious process; a sweet spot does exist of keeping the bad actors out and ensuring low friction for users.”

Article Topics

biometric liveness detection  |  biometrics  |  digital identity  |  fraud prevention  |  gambling  |  identity theft  |  identity verification  |  Jumio  |  onboarding  |  selfie biometrics