Hi! I work for a company that processes school applications, and we've recently seen an increase in fraud reports. Individuals are receiving communications from schools (e.g., acceptance letters, information requests) despite never applying.
It appears that bad actors are submitting applications using stolen personal information (name, DOB, address).
Typically, the real individual will email the fraud team regarding the communication they mistakenly received. Our fraud team will ask that individual to verify key details (e.g., DOB, full name, mailing address). We'll match that information to the account and then disable the account. However, we're now encountering situations where the bad actor also has access to this same information (but changes the email on the account to one they have access to), which makes it difficult to determine whether we're communicating with the real individual or the impersonator.
Has anyone dealt with a similar issue? What methods or tech have you used to more reliably verify identity in situations like this?
For context, our fraud team does not have access to SSNs.