Finance firms failing to detect criminal “ghosts”