Healthcare Credentialing Processes

Weak Know Your Customer process (KYC) is the main cause of failure in Financial Crimes Programs, as 90% of all fraud comes from fully verified identities. Weak identity verification and KYC controls have created a system where: ❌  Financial crimes professionals are reporting illicit activity on a victim, not on the actual perpetrator ❌ A tremendous amount of time and resources are being allocated to reports that shouldn’t have been generated in the first place Worse, it doesn't appear to be stopping bad actors. If anything the opposite. Recent FinCEN SAR filling data makes ugly reading. Most attackers have impersonated others to defraud victims. 👉 69% of identity related BSA reports indicate that attackers impersonated others as part of efforts to defraud victims.  👉 18% of identity-related BSA reports describe attackers using compromised credentials to gain unauthorized access to legitimate customers’ accounts.  👉 13% of identity-related BSA reports report attackers exploiting insufficient verification processes to advance their schemes The solution to the problem - Layering controls. 🐟 1 - Lowest friction. Collect device & behavior signals 🐟 2 - Moderate friction. One Time Passcodes (OTP), identity checks, background data checks with telco's, email providers, bank consortia, matching SSNs to DOBs 🐟 3 - High friction (when risk dictates). eCBSV -The Social Security Administration created eCBSV, a fee-based Social Security number (SSN) verification service. Doc IDV + Selfie + Liveness detection. 🐟 4 - Post account creation speed bumps. Monitor payment credentials and transactions against known good / bad identities and counterparties (+ MUCH more). Progressive KYC is critical to balance the friction of user experience with the critical need to continually improve compliance programs. Krisan Nichani wrote a great long form piece on our blog (link in comments) #kyc #aml #compliance

The most dangerous vulnerability is not malware. It is a fake credential. Let me share a story. A few years ago, I was evaluating vendors for an incident response retainer project. We had two simple requirements: 1️⃣ CISSP certifications on the team. 2️⃣ Full-time staff, not borrowed contractors. Sounds straightforward, right? But then came the red flag. The proposal proudly listed 4 CISSP holders. No one was full-time with the vendor. They were external contractors from India and Sri Lanka. On paper, they looked impressive. In reality, they failed the basics. Luckily, I caught it during due diligence. That one check saved us from signing a six-figure retainer project with the wrong partner. And here is the part nobody likes to hear. A lie in the supply chain is not an IT problem. It is a business risk to trust, time, and money. So what should your company do? Always verify. Never assume. ✔ Check certifications with the issuer. ✔ Add credential clauses in contracts. ✔ Audit who will actually be on the call at 2 a.m. ✔ Escalate when the team changes. The takeaway is simple. You can buy tools. You cannot buy integrity. One fake credential can expose everything. And the damage to your reputation? That is often permanent.   👉 Have you ever caught someone inflating their credentials in their resume? How did it change the way you trust people after that? More cybersecurity stories > Wesley Yee #weslife

Necessity is the Mother of Invention: The Birth of ItsCredible This morning, I came across a troubling news story about a 19-year-old Indian student who was arrested and deported from the US for submitting fake records, including a forged death certificate of his father, to secure admission and a full scholarship at Lehigh University. Here is the link: https://lnkd.in/dS-39Xqk It’s a harsh reminder of how crucial integrity is and the real damage that forgery can cause. Reflecting on this, I’m reminded of the necessity that led to the creation of Itscredible . Over a casual drink with my friend Bob Das in Connecticut, we reminisced about our days at Birla Institute of Technology and Science, Pilani and discussed the challenges of verifying academic credentials and the impact of fraudulent activities. I shared a personal experience where someone had forged my digital signatures, causing significant harm. This sparked an idea—what if we could create a platform that issues instantly verifiable documents? Leveraging blockchain technology, we envisioned a solution to prevent such frauds and ensure the authenticity of credentials. This idea, born out of necessity, gave rise to Itscredible . ItsCredible is now a robust platform used by various institutions, including the National Power Training Institute (NPTI), to issue digitally verifiable certificates. This ensures authenticity and builds trust. At Prometheus School, we’ve integrated Itscredible into our educational framework. We use digital credentials to recognize the unique attributes of every child, issuing their term reports and certificates through ItsCredible and these credentials stay in credentials locker called CreduLocker.com. This approach ensures the authenticity of the documents and helps us celebrate each student’s individuality and achievements in a secure, verifiable manner. Here’s how we can tackle this issue at different levels: 1. Institutional Level: Schools and colleges should adopt platforms like ItsCredible to issue digital credentials that are instantly verifiable. This builds trust and integrity within the education system. 2. Government Level: Governments should mandate the use of verifiable digital documents for admissions and scholarships. This will create a more transparent and secure process, reducing the chances of fraud and protecting the reputation of institutions. 3. Individual Level: We must emphasize the importance of honesty and integrity. Educational achievements should be based on hard work and merit, not deception. By adopting these measures, we can prevent such incidents and create a more secure and trustworthy environment for students and institutions alike. Thoughts? #integrity #education #digitaltransformation #itscredible #prometheusschool #innovation #preventingfraud

Many cyber incidents don't begin with sophisticated hacking, they begin with a compromised account. According to the FBI and the Internet Crime Complaint Center (IC3), cyber criminals continue to use Account Takeover (ATO) schemes to gain unauthorized access to financial, email, payroll, social media, and other online accounts. Once inside, they can steal funds, access sensitive information, conduct additional fraud, or use trusted accounts to target others. For organizations across New York City and beyond, the consequences can extend well beyond financial loss. A single compromised account can disrupt operations, expose sensitive information, damage an organization's reputation, or serve as a gateway for additional cyber attacks. Many account takeover incidents begin with seemingly routine actions: • Clicking a fraudulent link in an email or text message • Reusing passwords across multiple accounts • Entering credentials into a spoofed website • Falling victim to a phishing or social engineering attempt • Sharing a multi-factor authentication (MFA) code with someone posing as a trusted source Fortunately, many of these incidents are preventable. Organizations and individuals can strengthen their defenses by: • Enabling multi-factor authentication (MFA) on all available accounts • Using strong, unique passwords for every account and considering a password manager • Monitoring accounts regularly for suspicious activity • Verifying unexpected requests through a trusted communication channel before sharing credentials or approving transactions • Training employees and family members to recognize phishing and social engineering tactics Cyber criminals often don't break in; they log in using stolen credentials. A few proactive security practices can significantly reduce risk and help protect both organizations and individuals. Resources: • Account Takeover Fraud via Impersonation of Financial Institution Support: https://lnkd.in/gA-qZ6wj • Account Takeover Resource Center: https://lnkd.in/gZBpt4RA • Business Email Compromise Resources: https://lnkd.in/gTYYXzUS • Cyber Program: https://lnkd.in/eatTU3MS • Internet Crime Complaint Center (IC3): https://www.ic3.gov Together, we continue Protecting the Pulse of America, right here in New York and beyond. #ProtectingThePulseOfAmerica #ConnectCommunicateProtect #CyberSecurity #nyc

Passwords can be stolen. Devices can be spoofed. But your digital body language? That’s much harder to fake. 🧠 As fraud gets more sophisticated, behavioral biometrics is finally having its moment. We’ve relied on static credentials for years: passwords, 2FA, even facial recognition. But attackers have caught up. They’re using AI to mimic voices, hijack sessions, and bypass traditional defenses. 🤖 The real shift isn’t adding more checks. It’s moving from one-time verification to continuous context. Behavioral biometrics analyzes how you type, swipe, scroll, and navigate, how long they spend on each page, are they on a call, are they being accessed remotely, and would work here. They are building a unique, persistent profile that’s nearly impossible to replicate. It doesn’t just ask, “Are you who you say you are?” It asks, “Are you behaving like you?” This kind of signal is becoming critical: • It detects bots and synthetic identities at onboarding • Flags account takeovers as they happen • And reduces friction for the legitimate users you actually want to keep It’s especially valuable as phishing, vishing, and social engineering attacks grow more targeted, especially in financial services, where the real challenge is protecting existing wallets, not just detecting bad onboarding attempts. Passive. Adaptive. Always on. Exactly what modern fraud prevention needs. ✅ The future of authentication isn’t about adding more steps. It’s about making security invisible and intelligent. Agree?

Credential fraud isn’t a future problem…it’s happening today. I recently came across another fake union ticket. It wasn’t an obvious forgery, either. It included a raised seal and looked convincing enough that many people would likely accept it at face value. This highlights an important question for our industry… How do we verify credentials without slowing down the hiring process? Today, we largely rely on one of two approaches: trust the paper that’s presented, or call the issuing hall to verify it. Calling works, but it’s time-consuming, especially during large hiring events and storm response when speed matters. Digital verification doesn’t replace the hall…it reinforces the hall’s role as the trusted source of truth. With JNCTN, the issuing #IBEW hall maintains in control of the credential and the data it owns. Members gain a secure way to instantly present verified credentials, while contractors and employers can verify authenticity without relying solely on paper documents. We’re already working with halls that have adopted this approach, and the value increases as participation grows. A stronger verification network means faster hiring, less administrative burden, and greater confidence that the person presenting a credential is who they claim to be. As our industry continues to modernize, protecting the integrity of our workforce isn’t just about preventing fraud. It’s about building systems that are efficient, interoperable, and trusted by everyone involved. The goal isn’t to replace existing processes. It’s to strengthen them. As always, JNCTN is here to collaborate, not compete. If you see us as competition, it’s probably because you think we’re trying to replace something. We’re not. We’re building infrastructure that helps existing organizations do what they already do…better, faster, and more securely. ***Address removed to protect those involved from unintended blowback.

Candidate fraud is becoming a real challenge in today’s hiring landscape. We’re moving far beyond simple résumé embellishments. Talent teams (like mine) are now confronting falsified identities, AI‑generated résumés, coached answers, and even full proxy interview setups. Fraud is particularly prevalent in remote and high‑volume hiring, where identity is harder to verify consistently. Real World Examples: • Fake résumés and identities blocked at scale Amazon reported blocking more than 1,800 job applications from suspected North Korean operatives posing as legitimate candidates to infiltrate remote tech roles. • Deepfake job candidates passing video interviews Fraudsters are now using AI‑generated videos and audio to impersonate real people, enabling them to “attend” interviews undetected. This has become one of the top emerging fraud threats for employers in 2026. • Proxy interview schemes Some candidates hire stand‑ins to complete technical or behavioral interviews on their behalf (THIS BLOWS MY MIND 👿 ) — a trend that has sharply increased between 2023 and 2026. What happened to the simple value called integrity? • Mass‑produced AI‑generated applications Automated tools can now generate polished, fabricated career histories and “perfect” responses, enabling candidates to apply at scale while blending fake profiles with real identities. So how do we stay ahead? Verify identity earlier — catching fraud early prevents wasted time and reduces exposure. Use AI for detection — behavioral analytics, voice/face matching, and credential verification tools can flag inconsistencies. Adopt structured interviews & skills‑based tests — harder for fraudsters to fake and easier to validate. Add layered verification checkpoints — a “defense‑in‑depth” model catches fraud at multiple stages without overwhelming candidates. Fraud is evolving fast — but so are our tools and strategies. With the right structure and vigilance, we can protect our hiring processes, our teams, and the trust that sits at the center of every great hire.

🪪 Can you trust an exam result if you're not completely sure who took the exam? Automated identity verification has become a standard part of many online testing programs. But for high-stakes certifications, licensing exams, and compliance-driven assessments, automation alone may not be enough. Why? Because sophisticated fraud attempts, impersonation risks, and questionable identification documents often require context, judgment, and expertise that automated systems can't always provide. In our latest video, we explore the limitations of automated ID checks and why human-reviewed identity verification is becoming a critical component of modern assessment security. Watch to learn: 🔹 Where automated identity verification can fall short 🔹 How human review helps identify fraud and impersonation risks 🔹 Why defensible verification matters during audits and appeals 🔹 How organizations can strengthen trust in certification and licensing outcomes High-stakes decisions require high-confidence verification. When credentials carry real-world consequences, organizations need more than a confidence score—they need evidence they can stand behind. ▶️ Watch the video to learn how Integrity Advocate combines advanced technology with trained human reviewers to deliver stronger identity verification, reduce risk, and protect credential integrity. 📖 Read the full article: https://lnkd.in/epJnaUVq 🌐 Learn more about Integrity Advocate: https://lnkd.in/ev6hjDTQ #ExamSecurity #IdentityVerification #OnlineProctoring #CertificationTesting #Compliance #Credentialing #TestingIntegrity #IntegrityAdvocate #EdTech #AssessmentSecurity https://lnkd.in/ezMkaW36

"Self-register", fraudster slang for opening a bank account in a victim's name. And there's an entire supply chain behind it. The research team at Heka Global surfaced a dark web marketplace that covers both ends of the operation: 🔍 Before: A $15 lookup service to check any victim's CR (credit report) and CS (credit score), searchable by SSN, reverse SSN, even driver's license. In fraudster guides on "self-registering" accounts or cashing out loans, this step is always emphasized: get good "fullz" (full identity information), build a synthetic identity, and pre-check the credit profile to see if the identity is worth using. 💳 After: The finished product, sold openly. Self-registered Capital One, GoBank, Bluevine and Bluebird accounts, complete with login credentials, available credit, cookies, Apple Pay/Google Pay enabled, even mail recovery access. Priced $52–$199, filterable by state. That last part deserves a pause: these accounts passed onboarding. KYC checks, credit pulls, device checks, all cleared. Now they're inventory. The implication for risk teams: A clean credit profile isn't proof of a legitimate applicant, sometimes it's precisely why that identity was chosen. Catching this requires signals fraudsters can't pre-check or fake at scale: web intelligence, digital footprint, behavioral data, off-bureau data, dark web intelligence, network analysis and more. Having challenges with your onboarding fraud stack? Lets chat. P.S. Love how the FaaS provides 24 hour guaranties and FAQ pages.

Why does identity need to be a continuous signal and not a one-time check? Most fraud prevention strategies start strong but weaken over time. Mainly because too many companies treat identity as a one-time event (verify at onboarding, then assume the user stays the same). That assumption is exactly what fraudsters exploit. Bad actors don’t strike immediately. They wait. They let an account age, build trust, and then move in, whether that’s taking over an account, changing credentials, or laundering money through transactions. ◼️ Traditional fraud systems struggle because they lack context; They see each event in isolation, not as part of a larger identity story. ◼️ The best fraud prevention strategies do the opposite; They make identity a continuous signal. Here’s what leading fintechs and banks are doing differently to stay ahead: 1️⃣ Identity Doesn’t Stop At Onboarding Instead of treating verification as a single checkpoint, they establish a persistent identity that evolves over time. This allows them to compare current behavior to past patterns, making it far easier to detect anomalies. 2️⃣ Risk Signals Are Integrated, Not Siloed Point solutions for onboarding, login security, and transaction fraud often operate independently, creating gaps. A connected approach, where onboarding data informs login security and transaction monitoring, catches fraud that isolated tools would miss. 3️⃣ Anomalies Matter More Than Rules Hardcoded rules have limits. Modern risk models consider not just whether a login or transaction looks suspicious, but whether it makes sense given the user’s historical behavior. A gradual change over months is different from a sudden, unexpected deviation. When identity becomes an evolving signal rather than a static check, you get both stronger security and a smoother customer experience.