How Does Synthetic Identity Fraud Work and Grow?

TL;DR

Synthetic identity fraud works by combining real, altered, or fabricated personal information to create a new identity for financial gain. Detection is difficult because the identity may not belong to one recognizable victim, and resulting losses are often recorded as credit losses rather than fraud. Credit freezes and account-opening alerts can help protect Social Security numbers.

Transcript

Good morning, everyone. Thank you for joining. Um, I'm glad that most of you are over there, so I can stand and kinda just look in that direction. I don't-- I kinda pace around when I talk, so, um, hopefully, hopefully you can keep up with me. I'm also actually, uh, we just improvised, and I'm gonna show a little demonstration at the end. Um, but m... Read More

Key Insights

• Synthetic identity fraud is the use of combined personally identifiable information to fabricate a person or entity for a dishonest act and personal or financial gain. The definition was developed collaboratively because the industry had been using multiple, inconsistent definitions.
• Personally identifiable information includes primary details such as a name, date of birth, and address, plus secondary details such as an email address, LinkedIn account name, group memberships, and hobbies. Together, these elements form a broader representation of identity.
• Synthetic identity fraud differs from traditional identity theft because the criminal creates a distinct identity instead of acting wholly as an existing person. A conventional account takeover may be noticed quickly, while synthetic activity can remain separate from a victim's normal accounts.
• Fraudsters can create synthetic identities entirely from fabricated information, combine information belonging to different people, or slightly modify genuine details. One example is pairing one person's name with another person's Social Security number and adding a fake address.
• A credit file is created when a new identity applies for credit, even if no previous credit record exists. The resulting file can appear to validate the synthetic identity, despite initially containing little information, and supports further attempts to obtain credit.
• Reported synthetic identity fraud losses were estimated at around $20 billion for the previous year discussed, compared with $6 billion when the presenter began examining the issue in 2016 and $15 billion in 2018. The presenter said losses continued increasing during 2020 and 2021.
• Synthetic fraud losses are often recorded by financial institutions as credit losses because the institutions do not recognize that fraud occurred. This classification problem means the reported estimates may understate the actual financial impact of synthetic identities.
• Children are described as 50 times more vulnerable to misuse of their Social Security numbers in synthetic identity fraud. Consumers can reduce exposure by freezing credit with each credit bureau and using services that alert them when someone attempts to open credit in their name.

Questions & Answers

Q: What is synthetic identity fraud?

Synthetic identity fraud is the use of a combination of personally identifiable information to fabricate a person or entity for a dishonest act and personal or financial gain. The constructed identity may contain entirely invented information, information taken from several people, or genuine details that have been slightly changed. Its purpose is commonly to obtain credit and generate money for the fraudster.

Q: How does synthetic identity fraud differ from identity theft?

Traditional identity theft involves a criminal acting as an existing person, such as entering that person's bank account, taking money, or blocking the legitimate customer from access. Those disruptions can alert the victim quickly. Synthetic identity fraud creates a separate identity, potentially using the victim's Social Security number with another name, so the activity may not appear in the victim's usual accounts.

Q: How do criminals create a synthetic identity?

Criminals can invent a name, Social Security number, and address, or they can assemble details from different sources. For example, they might combine one person's name with someone else's Social Security number and attach a fabricated address. They may also make small changes to real names or addresses. The result is a newly constructed identity rather than a complete copy of one individual.

Q: How does a synthetic identity obtain a credit file?

A fraudster applies for credit using the newly created identity. Although the identity initially has no credit history, the application causes a credit file to be created. That file may contain very little information at first, but its existence gives the synthetic identity a degree of validation. Fraudsters continue applying because their objective is to obtain a credit line and make money.

Q: Why is synthetic identity fraud difficult to detect?

Synthetic identity fraud is difficult to detect because the fabricated identity does not necessarily correspond to one person who will recognize and report the activity. A real Social Security number may be paired with a different name or address, leaving its owner unaware of credit applications. Financial institutions may also treat unpaid accounts as ordinary credit losses instead of identifying them as fraud.

Q: How large is the synthetic identity fraud problem?

The presenter cites an estimate of around $20 billion for the previous year discussed in the presentation. He contrasts that figure with an industry estimate of $6 billion when he began examining the problem in 2016 and $15 billion in 2018. He also states that activity rose further during 2020 and 2021, while misclassified credit losses may make reported totals too low.

Q: Who is vulnerable to synthetic identity fraud?

The presentation identifies children, elderly people or parents, incarcerated people, and immigrants entering the country as potential victims. Children are described as 50 times more vulnerable to synthetic misuse of their Social Security numbers. These victims may not actively monitor credit activity connected with their identifiers, particularly when a fraudster uses the number alongside an unrelated name and address.

Q: How can people protect Social Security numbers from synthetic fraud?

Consumers can contact each credit bureau and freeze or lock their credit, including credit associated with their children's Social Security numbers. A freeze can restrict another person's ability to use that identifier when applying for credit. People can also enroll in monitoring or alert services that notify them when someone opens, or attempts to open, a credit card in their name.

Summary & Key Takeaways

• Synthetic identity fraud uses combinations of personally identifiable information to fabricate a person or entity for dishonest personal or financial gain. Fraudsters may combine a real Social Security number with a different name and fake address, slightly alter genuine information, or invent every element while following standard identity-data formats.

• Unlike traditional identity theft, synthetic fraud does not necessarily involve someone acting entirely as a known individual. A victim may quickly notice a takeover of an existing bank account, but a synthetic identity can operate separately. Even when it uses a real Social Security number, the associated name and address may be different.

• A newly fabricated identity can establish a credit file simply by applying for credit, even when no previous file exists. That record gives the constructed identity a degree of apparent legitimacy. The problem continues growing, may exceed reported estimates because of misclassification, and can affect children, elderly people, incarcerated people, and immigrants.