Industry Reports: Can Credit Unions Still Trust What Looks Legitimate? Synthetic Fraud Is Changing Authentication

​By Marc Rapport
Contributing Editor

A document can look legitimate. An image can look legitimate. A voice can sound legitimate. As generative AI makes those signals easier for fraudsters to create and manipulate, credit unions face a fundamental authentication problem: Passing an individual checkpoint no longer necessarily means an identity can be trusted.

Sergio Valencia

Sergio Valencia sees that challenge across a wide swath of the credit union industry. As vice president of Authentication Risk Management at Velera, the payments CUSO supporting more than 4,000 credit unions and other financial institutions across North America, he works across authentication and authorization channels to help clients strengthen fraud prevention and risk management.

Valencia has spent about a decade with Velera. His advice to credit unions is to stop thinking about authentication as a collection of separate checkpoints.

The stronger approach, he says, is to connect identity, device, behavioral, authentication and transaction data so institutions can judge the full context of an interaction, apply additional friction when the risk warrants it, and make life harder for fraudsters without making legitimate members continually prove who they are.

He elaborates in this interview with CUbroadcast:
 
If you were advising a credit union that wanted to strengthen its defenses against synthetic identity fraud over the next 12 months, what would you tell its leaders to prioritize first?

SV: I would start by looking at authentication as an ecosystem rather than a collection of individual solutions. Map the member journey from account opening through digital access, servicing, account recovery and transactions, and understand where identity and authentication decisions are being made.

Then look at whether the intelligence generated in those environments is actually connected. 

The next priority would be strengthening the institution's ability to evaluate context around authentication – not simply whether a document, credential or other signal passed, but whether the way it was presented and the behavior surrounding it are consistent with legitimate activity.
 
Finally, make sure confirmed fraud creates reusable intelligence. If you identify a fraudulent identity, device or other indicator, that knowledge should help protect other channels and future interactions.
 
The goal isn't another authentication layer everywhere. It's making better decisions with the intelligence you already have.

From your perspective, how has the synthetic identity threat changed over the past year or two? What are you seeing now that credit unions may not have been dealing with before?

Sergio Valencia: One of the biggest changes over the last couple of years is simply how accessible these capabilities have become to the common fraudster. You no longer need highly specialized technical skills to create very convincing synthetic or manipulated documents, images, deepfakes or other signals that appear legitimate.

That significantly lowers the barrier to entry. These tools can be used to create synthetic identities and commit fraud directly, but they can also make scams and impersonation attempts against legitimate members much more convincing.

For financial institutions, that means we have to rethink how much trust we place in any one piece of evidence. A document can look legitimate. An image can look legitimate. A voice can sound legitimate.

Increasingly, the question can't simply be: “Did this pass our authentication control?” It has to be: “Does everything else we know about this interaction support that it is legitimate?”
 
The biggest change isn't that these capabilities suddenly exist. It's how accessible they've become.
 
Where are the biggest gaps in authentication today when it comes to detecting synthetic identities? Are fraudsters finding particular weaknesses in account opening, account recovery, transaction authentication, or somewhere else?
SV: One of the biggest gaps is that authentication and fraud controls have historically been built in silos.

Financial institutions and processors may have one solution supporting account opening, another for loan origination, another for digital banking, another for transaction authorization and another for account recovery. Each solution may be effective within its own environment, but they don't always share enough intelligence with one another.

That matters more than ever because we can no longer rely on one control to simply tell us whether something should pass or fail. A document may pass. A device may appear acceptable. A transaction may not look unusual on its own. But when you bring identity, device, behavioral and transactional intelligence together, the overall picture can look very different.
 
Fraudsters don't operate within the same silos our technology does, so our defenses can't either.
 
Synthetic identities are often built and nurtured over time rather than used for immediate fraud. What signals can help a credit union distinguish a legitimate member from a synthetic identity that has been carefully designed to look legitimate?

SV: There's rarely going to be one signal that definitively tells you an identity is synthetic, particularly when that identity has been carefully developed over time. The value comes from understanding the relationship between signals.

That includes identity attributes, device intelligence, network information, behavioral patterns, authentication history, account activity and relationships to other known or suspicious activity. 

We're also becoming more sophisticated about evaluating not only whether something passes authentication, but how it entered the process and how it was used. A signal can be technically valid and still be behaviorally inconsistent.
 
That's where linked analysis becomes especially valuable. If an identity, device or other risk indicator has relationships to known fraudulent activity elsewhere, that context can materially change how you view an otherwise legitimate-looking interaction.
 
Ultimately, you have to ask whether all those signals together tell a story that is consistent with a legitimate, low-risk member.
 
How should credit unions think about authentication as part of a broader synthetic identity strategy? Where does authentication end and ongoing identity and behavioral monitoring begin? 

SV: I don't think there's a clean line anymore. Historically, authentication was often treated as a point-in-time decision: someone provides the required credentials, passes the control and we establish trust. Today, trust has to be much more dynamic.
 
Passing authentication should establish a level of confidence, but what happens after matters too. Devices change. Behavior changes. Contact information changes. New relationships emerge. Transaction patterns change. That's why authentication increasingly needs to work together with identity intelligence, device intelligence, behavioral monitoring and transaction risk.
 
Rather than thinking about authentication as a series of isolated pass-or-fail events, we're now moving toward more of a continuous trust model. The question becomes: Does everything we're seeing continue to support the level of trust we've assigned to this identity?
 
AI is making it easier to create convincing identities, documents, images, voices and other signals of legitimacy. How is gen AI changing the synthetic identity threat, and which AI-enabled tactics concern you most?
SV: What concerns me most is the combination of quality, accessibility and scale. 

Gen AI is reducing the amount of expertise required to create very convincing fraudulent content. Documents, images, voices and other pieces of evidence that historically provided confidence can now be manipulated or created much more easily.
 
In some ways, AI is compressing the gap between what a legitimate person can produce and what a fraudster can simulate. That's significant for authentication because something looking or sounding authentic is becoming less meaningful as a standalone risk signal. We're already seeing increased attempts involving manipulated documentation and deepfake technology used to defeat authentication controls.
 
The answer can't simply be creating another check around the same piece of evidence. We have to understand the broader context – device, behavior, relationships, history and how the interaction actually occurred. AI is making individual signals more convincing, which makes connecting those signals more important.
 
On the other side of the equation, how can financial institutions use AI to improve authentication and synthetic identity detection? Where does AI offer a meaningful advantage over more traditional rules and risk models, and where does human judgment still matter?

SV: AI and advanced analytics are most valuable when the volume of information and relationships becomes too large to evaluate effectively through traditional rules alone. 

Rules remain extremely important. When you understand a known fraud pattern, rules allow you to act quickly and consistently. But more advanced analytics can help identify relationships, anomalies and combinations of signals that you may not have explicitly programmed a system to look for.
 
For example, individual identities or events may appear normal on their own, while the devices, behaviors or relationships connecting them reveal something very different. That's an area where technology can provide tremendous leverage.
 
But I don't view AI as replacing fraud professionals. Human judgment is still critical for understanding context, investigating emerging behaviors and determining how those discoveries should translate into new controls. The strongest approach combines technology, data and experienced people.
 
Credit unions have to balance stronger fraud controls with a member experience that doesn't create unnecessary friction. How do you strengthen authentication against sophisticated synthetic identities without making legitimate members continually prove who they are?

SV: The objective shouldn't be more authentication. It should be better authentication.

If we have a member using a trusted device, demonstrating familiar behavior and conducting activity that's consistent with what we know about them, we shouldn't automatically introduce another challenge simply because the capability exists. 
Where authentication should become stronger is when the context changes. That could be an unfamiliar device, unusual behavior, changes in trusted information, a higher-risk activity or relationships to other concerning signals. The more intelligence we can evaluate behind the scenes, the more precise we can be about when additional authentication is actually necessary.
 
That’s ultimately how you improve both security and member experience. Better risk intelligence should allow legitimate members to experience less visible friction while making it significantly more difficult for higher-risk interactions to succeed.

How is Velera working with its credit union clients to address synthetic identity fraud? What are you hearing from credit unions about their biggest challenges, and how does Velera help them strengthen authentication and identify emerging risks?

​SV: One of the opportunities we have at Velera is the ability to look at authentication and fraud risk across a broad ecosystem rather than viewing every interaction independently.
 
A major focus for us is bringing more intelligence together – identity, device, behavioral, authentication and transaction information – so we're not relying on a single solution or a single decision to tell us whether something is trustworthy.
 
We're also seeing value from linked analysis: understanding relationships between fraudulent identities, devices and other known risk indicators and using that intelligence to identify additional suspicious activity.
 
Another important area is understanding not just whether an authentication element passes, but how it was presented and whether the surrounding behavior is consistent with what we expect from legitimate activity.
 
What we consistently hear from credit unions is that they want stronger protection without creating unnecessary friction for legitimate members. That's ultimately the opportunity: use better intelligence to make authentication more precise, more connected and more adaptive.

---