Identification Documents are vital in today’s world. After all, they’re how you prove that you’re really you. Recently I’ve been asked for ID when visiting the doctor and picking my son up from summer camp. And, of course, credit union staff will often ask a member to present ID when conducting financial transactions. Given the importance of IDs, it’s likely no surprise that criminal actors who want to impersonate your members may go to great lengths to create convincing counterfeit ID documents.
The types of IDs can run the gamut. America’s Credit Unions has heard of impostors using counterfeit passport books. Passports are generally thought of as the “gold standard” of ID documents because they’re issued by the federal government, contain a photo, and can only be obtained after a lengthy application and document verification process. Thus, some frontline staff may feel less inclined to scrutinize a passport book. Unfortunately, criminal actors are now using that to their advantage. Additionally, the Financial Crimes Enforcement Network (FinCEN) published a notice in April 2024 advising institutions of the use of counterfeit passport cards. A passport card is similar to a passport book in that it is a photo ID issued by the federal government, but it is a card (not a book) and has more limited uses for international travel. Passport cards have become popular with impostors in part because frontline staff tend to be less familiar with them and therefore less likely to spot a fake. Finally, criminal actors may use other types of ID that are less familiar to frontline staff – such as out-of-state driver’s licenses or even counterfeit foreign IDs (such as Mexico’s Matricula Consular).
Credit unions may want to train their staff in spotting the red-flags of a potentially counterfeit ID. Here are some things to keep in mind:
Behavioral Indicators
- Asking for Account Balances. The FinCEN notice on counterfeit passport cards notes that criminal actors may appear overly interested in learning the balances of the account. This is likely intel-gathering so the criminal can determine how much money they can potentially steal. America’s Credit Unions has heard from credit unions who have described this behavior when dealing with criminals impersonating their members.
- Unable to Recall Personal Identifiers. When a counterfeit ID is suspected, frontline staff may want to ask the suspected fraudster to recall personal identifiers – such as the name, address, date of birth, etc. While this can help spot an imposter, it is not foolproof – we have heard of some criminals who had memorized their victim’s personal identifiers.
- Transaction Type. Imposters may be likely to do the following: opening a new account (including a joint account with a person whom the member had no prior relationship) shortly after presenting a suspected counterfeit ID; withdrawing large amounts of cash, purchasing monetary instruments, conducting large wire transfers; presenting checks payable to cash and/or conducting transactions at multiple branches in a short period of time.
Inspecting the ID
Credit unions may want to train their staff on how to spot counterfeit ID documents, including how to spot telltale signs on the document itself. Staff may want to check whether the photo and signature on the ID match the person presenting it. It should be noted, however, that criminals may create counterfeits that include pictures of themselves and/or their signature, so a photo or signature match does not necessarily mean the ID is legitimate – but a mismatch could at least serve as a red-flag for possible fraud.
The FinCEN notice regarding passport cards provides a list of “technical” red-flags which can be useful when identifying counterfeit passport cards. These technical safeguards include checking if the text on the card is flat (legitimate passport cards have raised or tactile text), looking for issues with the photo (legitimate passport cards are laser-engraved and the photo should appear in grayscale) and checking for a holographic seal of the U.S. Department of State.
When checking an out-of-state driver’s license, it may be useful to check a government website for the state in question. While not written for credit unions, many states have websites for sellers of alcohol – such as this one from Pennsylvania and this one from Virginia – that describe how to spot a fake ID.
Practical Tips
So, what can a credit union do to mitigate the risks of accepting counterfeit IDs? Here are some practical tips:
- Empower Staff to Escalate. A credit union recently told us about an instance involving a counterfeit ID that was thwarted because the teller wasn’t confident in the validity of the ID and decided to check with a manager. Even the mention of checking with a manager caused the fraudster to attempt to abandon the transaction and leave the branch. Credit unions may want to ensure their frontline staff feel empowered to take a moment, review the ID and then check with a manager if they still are not convinced of the ID’s validity.
- Include Rare IDs in Your Procedures. As mentioned above, some IDs are rarely used by the public – such as Passports, Passport Cards and foreign IDs – which might make it harder for staff to spot a fake. Credit unions may want to review their procedures on accepting ID documents and include specific procedures for these types of IDs.
- Share Information with Your Peers. If your credit union has discovered the use of a counterfeit ID, you may want to consider sharing that information with other credit unions or institutions in your area. Credit unions that register for information sharing under Section 314(b) of the USA PATRIOT Act can share information with other registered institutions. Additionally, some credit unions choose to share less-detailed information through local roundtable or council meetings. Keep in mind, however, that credit unions are prohibited from sharing that a Suspicious Activity Report (SAR) has been filed, even when sharing information under Section 314(b).
- Notify Authorities. A credit union that has encountered a counterfeit ID may want to consider the amount involved in the transaction (or attempted transaction) to determine if a SAR is required under section 748.1(d) of the NCUA regulations. Even if a SAR is not required, a credit union can choose to voluntarily file one to alert law enforcement. Additionally, fraud involving a U.S. passport or visa can be reported by emailing PassportVisaFraud@state.gov.