Toyota Financial Services Lexus Financial Services Fraud Detection and

Toyota Financial Services Lexus Financial Services Fraud Detection and Prevention Overview

Fraud Overview Goals Objectives Review Fraud Types Review fraud elements used to detect fraud Review which tools to utilize to accurately detect and prevent fraud Review when and how to refer cases expediently to the Fraud Department 2

DSSO Fraud Responsibilities Identify fraud flags and risks through Oscar system and conversations with dealers Research and verify accuracy of flags via Fastdata and Stars/DMS Obtain feedback from the TFS Fraud Dept in cases where fraud is ambiguous Refer all verified fraud cases, including those not approved, to the Fraud Department 3

TFS Fraud Department Responsibilities Provide quick response to identity inquiries and problems Resolve customer escalations and complaints; walks them through the process that cleans up fraudulent activity Assist with and investigate consumer claims of dealer and broker malfeasance Provide local, helpful contacts (SSA, DMV, law enforcement) Assist with loss mitigation on fraudulent downpayment checks 4

Understanding “Fraud”

What is commonly considered “Non-Fraud”? SSNs typos that are one or two digits off from a legitimate number, or use of a valid Tax ID “Straw” purchases where a parent or relative finances a unit for another Inflated income or false place of employment, where there is no other evidence of intent to defraud Allegation that signature on contract was forged when customer does not dispute they took possession of the unit Consumer claims their interest rate was too high, etc. 6

Questions to Determine if Credit Application is Fraud Does the credit reporting agency (CRA) show previous fraud alerts? Are there any red flags on the Oscar CRA summary screen or TTY screen? Does the SSN or name pull up a previous Stars account? Does all customer information match (names/addresses/SSN)? Was there a prior application in Oscar that was declined? Does the information match with the new application? Does FastData show a different SSN than the one on the account (typo—1 or 2 digits off)? Can the applicant provide a numident letter from the Social Security Administration (SSA)? Is the letter legitimate? Has the Dealer verified the applicant’s name, address, and SSN on the application? 7

Common Fraud Resources

DSSO Fraud Reference Desk Guide Exhibit 327A is accessible through FOPP 306 and 327 It instructs DSSO personnel how to detect fraud and when to refer cases to the Fraud Dept Provides ranges for valid, issued SSNs Focuses on credit application and Credit Reporting Agency (CRA) information provided Hawk Alert—mismatch between cust name on application and CRA info Fraud and Military alerts—compliance Multiple SSNs and variances between dob and SSN issuance date Deceased alerts Multiple recent credit inquiries 9

DSSO Fraud Reference--SSN Allocations 10

Fraud Fighting Tools FastData, Oscar/TTY, Stars/DMS 11

Fraud Elements Subject to Secondary Systems Research Social Security Number Multiple Credit Profiles (Credit Header) Other valid SSN (FastData reverse search on name) Customer/Consumer Name Legal name variations (transposed middle/last) Straw purchases (Jr. vs. Sr.) Date of Birth Mismatch between year SSN issued 12

FastData Base1 Search Review Base 1 Search by SSN encompasses numerous public records, including bankruptcy, property ownership, and deceased records Since the records are raw data directly from public sources, typos are possible in the SSN, name, address This means that even though other names show under an applicant’s SSN, it may not be fraud If records are returned, you will see at the top of the screen whether the SSN provided was issued and the year of issuance FastData, along with any other research system, is not 100% foolproof in validating identity 13

FastData Credit Header Search Review Credit Header Search by SSN allows us to compare Equifax and TransUnion’s records with the name, address and SSN provided by the customer If Credit Header shows another name, fraud has been perpetrated at some point e.g. Multiple Credit Profile Credit Header has fewer false positives than the Base 1 Whether the SSN was issued and year of issuance are returned, similar to Base 1 If the owner of an SSN has submitted a fraud alert to the credit bureaus, such an alert will appear here 14

Oscar TTY Format Screen—SSNs, Fraud Alerts, DOB 15

Oscar--Credit Report Fraud Alert 16

Reseach Systems Summary SSN Validation Always reference DMS Credit Application Credit Header: 2 names likely fraud Credit Screener: Use second to view past tradelines if necessary Date of Birth Look for mismatches between credit application, STARs, Credit Header issuance date Names Look for transposed first and last names, as well as relatives 17

“Verified” Fraud 18

TEXT WITHOUT BULLETS Legal Fraud Definition: “A false representation, concealment, or nondisclosure; where there is knowledge of falsity and an intent to defraud, i.e., to induce justifiable reliance; which results in damages.” 19

Fraud Types False Representation: Identity Theft “Perpetrator knowingly utilizes another’s personally identifiable information, without permission, for the purpose of obtaining a TFSfinanced unit.” Concealment: Identity Assumption “Perpetrator knowingly invents a counterfeit personal identity for the purpose of obtaining a TFS-financed unit and concealing their true identity.” Nondisclosure and Intent: Fraud Ring "Perpetrators, with the agreement, knowledge, and participation of others, submit their valid personally identifiable information for the purpose of obtaining a TFS-financed vehicle on behalf of a 3 rd party who intends to sublease the unit, wash the unit’s title, or illegally export the unit.” 20

Common Elements of Identity Theft and Identity Assumption Social Security Number (SSN) Issued Issued Issued Issued to another person recently to a minor before Date of Birth to a deceased person Tax ID Tied to a consumer’s name instead of a business Tax ID corresponds to a real consumer SSN Business Identity Theft No guarantor No corporate resolution or other falsified paperwork Common business name e.g. United Finance” 21

Fraud Case Studies Real cases in the fight to prevent and detect fraud

Identity Theft Case Study—Previously approved app 23

Identity Theft Case Study—Oscar Red Flags 24

Identity Theft Case Study—Previous Fraud Account and Customer using Minor’s SSN Accounts 020562FA541 and 020562FH951 have SSN 575991977 which was issued in Hawaii in 2004. SSA verified number is owned by a minor. Anthony Wint has also used a few different aliases such as "Valentine Wint" under SSNs 576-99-5000, 575-99-1814, and 576-99-1977, also issued in 2004 in Hawaii. He has used the same mail drop location under both names at 35 E MAIN ST APT 125 AVON CT 06001-3805. Others include RICARDO WINT AND RICHARD H WING. Other Identity Theft acct 0286187767 using SSN 650286174 victim is Nga Pham. 25

Identity Assumption 800 or 900-series SSN SSN never issued No credit history No Credit Screener or FastData records 26

Example of Identity Assumption Fraud synopsis: verified id assumption, ssn on acct never issued by the SSA. first payment default, acct past due 200 days. IGS and RS unable to locate car or cstr. contact#s are disconnected. Per fast data confirmed that SSN 764-93-7675 used by customer Eleandro Londe is invalid " never issued by SSA" completed 5039 to zero out SSn and 3189 to delete the trade line. Will follow up. HQFD Dulce Arias ext 69212 27

Fraud Rings

TEXT WITHOUT BULLETS Fraud Ring Definition The perpetrators, with the agreement, knowledge, and participation of others, submit valid personally identifiable information for the purpose of obtaining a TFS-financed vehicle with the intent to sub-lease the unit, wash the unit's title, or illegally export the unit 29

Fraud Ring Overview Fraud Rings are often the hardest fraud trend to spot as the valid identity information of a 3rd party is usually submitted Fraud Rings such as Transients or Eastern European use stolen as well as legitimate identities Forged documents such as paystubs and tax returns Common Rings include Duty Free (subleasing) LA-Seattle (exportation) Transient (ID Theft and ID Assumption) Subleasing: The 3rd party disappears, and the main perpetrators resell or sublease the car to another person Illegal Exportation: The ring illegally exports the unit as “household goods” 30

Fraud Rings and Identity Theft Transient and Eurasian Fraud Ring 31

Fraud Ring Identity Theft Transients change or rearrange the first, middle, and last names in order to conceal their identity, creating multiple credit profiles in the process Transients often have legitimate social security numbers for each of their names, but also will simultaneously engage in ID Theft and ID Assumption for other financial accounts To support false identities (ID Assumption), Transients change states of residency frequently and obtain driver’s licenses in multiple states at the same time (which is a felony) Once one credit profile/identity becomes too hot, they simply dump it for a different one and move on The TFS Fraud Dept maintains a repository of fraud ring names and addresses to check against 32

Red Flags: Employment with roofing, paving, or landscaping companies -- please note that not all such companies are associated with fraud—look for multiple indicators 33

Co-buyer or references often were the same names on several different (but related) fraud deals, also bought from the same dealership 34

Payment stubs or recommendation letters contain misspellings, and/or from the same source. Here, we have three letters from the same employer, but the letterhead is different on all three. 35

All of the driver’s licenses belonged to members of the same family, and ranged over many different states. In many cases, out of state driver’s licenses were presented to salespeople even when the buyer claimed they had a local address. 36

Eurasian Fraud Ring Entire U.S. being hit: Southern California, Chicago, Las Vegas, New York, Philadelphia, Atlanta, Nashville, etc. Elements: Inflated income that cannot be verified Residence and business address are the same on credit application Employment involves export/import businesses, as well as Construction Companies Number of years in business does not match the time SSN issued “Authorized User” on 3rd party's credit card account leading to an inflated FICO score (680 or better) SSN recently issued (in last 5 years) or State were SSN issued does not match address history Credit bureau alerts: 90-Day fraud alerts and address discrepancy alerts 37

LA-Seattle Fraud Ring 200 units and 4M in fraudulent TFS Accounts 38

LA-Seattle Common Elements Los Angeles and Seattle-area applicants Illegal exportation and drug trafficking is the MO, with some subleasing having occurred Half the accounts have Identity Theft or Identity Assumption—SSN were stolen within immigrant communities where the victim was originally from Pacific Rim or Asia Prior tradelines with multiple finance companies POEs are high-level (president, CEO) and income is inflated Credit app indicates they rent instead of own prop Broker deals (Han Kook Motors, Eden Motors, ) Authorized user added to inflate credit scores 39

LA-Seattle Fraud Ring—Common Address and Inflated Income 40

LA-Seattle Fraud Ring: Rental and Common Names 41

42

43

Lessons Learned—Fraud Types What is the type of fraud that involves valid information (e.g. SSN) and illegal exportation? What is the type of fraud that involves a fictitious identity? What is the type of fraud that involves an invalid form of payment? What type of fraud stems from stolen information? 44

Lessons Learned Summary Review the Oscar CRA TTY format screen and summary screens thoroughly for alerts Check applicant’s previous Stars acct notes Refer to DSSO FOPP Deskguide Ask your Team Lead/Supervisor Email or call the Fraud Department 45

Fraud Department Contact Information Toyota Financial Services Fraud Department Transfer extension: 40997 Fax: 1-866-445-3135 Number to provide customers: 1-866-4208723 Email: TFS [email protected] MailDrop: WF22 Central Recovery Collections and Skip: 1-800-826-9467 46