What Is Synthetic Fraud?

by Chauncey Crail

Forbes Advisor

Tuesday March 30, 2021

Stock image
Stock image  (Source:Getty Images)

The word "synthetic" often refers to a product made to imitate something found in nature. Synthetic fraud is a complex form of identity theft in which the thing being imitated is a person. A fraudster combines a stolen Social Security Number (SSN) and fake information, such as a false name, incorrect address, made-up date of birth or new phone number to create a false identity. It's one of the most difficult forms of fraud to monitor and catch because fraudsters will sometimes take years to build good credit using a fake profile before making final fraudulent charges and abandoning the identity (called "busting out").

Seems like a lot of work to steal part of an identity and use it for a few purchases. But not all forms of synthetic identity fraud are made with intent to steal money. There are a few reasons why someone might use this more nuanced fraud to synthesize identities:

  • Criminals use synthetic fraud to steal funds, escape detection by the government or financial institutions or to facilitate drug or human trafficking.
  • Undocumented immigrants may get access to real SSNs and use fake personal information in order to live and work in the U.S. and receive benefits like healthcare.
  • Some people get into trouble and choose to assume a fake identity in order to escape persecution or a harmful assailant.
  • Complex crime rings use synthetic fraud to manage thousands of fake credit card accounts to fund luxurious lifestyles.

    According to a report by the Federal Reserve, synthetic identity fraud is the fastest growing type of financial crime in the U.S. Personal information often appears for sale on the black market, usually conducted online on the "dark web." Some dark-web-savvy individuals facilitate purchase of information like social security numbers or credit privacy numbers (a 9 digit number made to simulate a SSN). Digital thieves upload personal information like SSNs to the dark web. This info is primarily gathered from data breaches to credit institutions, banks or other companies that collect personal information.

    Synthetic identity fraudsters use a combination of real and fake information to create a new, fake identity and apply for a credit line. These criminals then work to establish good credit and take a giant payout years later.

    Typically the fraudster's first application to a credit provider returns a rejection, but enables them to keep trying by establishing a file in the system. When someone first applies for credit, the institution will query a credit bureau asking for the relevant credit file. The bureau will then respond with a lack of history because the fake identity is newly created. However, in doing so, the bureau creates a new credit file for the fake identity. This enables the fraudster a higher likelihood of success as they continue to apply to other financial institutions until they finally are approved for a line of credit.

    Next, a fraudster diligently establishes good credit by making small purchases and quickly paying them off. Fraudsters also "piggyback" on someone else's credit line (someone with good standing) by paying the person to become an authorized user (even if the fraudster receives no credit card information from the other person's account). This process of building credit can take months or even years, which is partially why it's so difficult to catch. To the financial institution, the fraudster's fake profile seems like a regular person with a job, a salary, and a home. Some fraudsters go to great lengths to appear "normal," even creating social media presences or using P.O boxes for addresses.

    Finally, sometimes years later, the fraudster "busts out" by maxing out the carefully earned credit lines and abandoning the identity without paying anything back to the institutions. They then repeat the process using a new fake identity. Some fraudsters manage multiple fake identities using multiple real SSNs, offering a rotating schedule of paydays but only exacerbates the problem and compounding the negative impact on financial institutions.

    The financial institutions will work backward to determine who the thief is after the fraudster busts out and disappears. By using real SSNs, the fraudster effectively creates a fragmented file—one that isn't quite the same as the actual SSN holder's credit file. The institutions try to trace the SSN to the actual person it belongs to using help from law enforcement and/or the credit bureaus, of course.

    Children, the elderly and the homeless are most vulnerable to fraud like this. As populations that don't use their credit as frequently (and therefore are much less likely to monitor it regularly) their numbers are likely to be the ones that can be used and abused without notice. Children have become especially susceptible since the Social Security Administration (SSA) started randomizing the nine-digit codes in 2011.

    Fraudsters can quickly find an unissued SSN by purchasing it on the dark web or by getting a lucky break using randomization software. Once unlucky children come of age and try to take out student loans or buy cars, they'll be surprised to find that they have delinquent credit histories that need to be dealt with before they can even begin building their own credit.

    Victims of identity theft are not liable for fraudulent purchases or accounts as long as they can prove they are the real SSN holder and not the thief. Financial institutions like banks and credit card providers cough up most of the cost for synthetic identity fraud.

    Online banking has made complex fraud like synthetic identity theft easier to carry out. Data breaches have made valuable personal information like SSNs more susceptible to theft and sale on the dark web. There are a few ways people can protect themselves and their children from losing control of identities:

  • Freeze credit with one or all of the credit bureaus in the U.S. This can be effective at stopping credit fraud, but it may not protect against cases of fraudulent tax filing or an undocumented worker receiving benefits.
  • Pay for an identity protection service that offers comprehensive protection and mitigation against all forms of fraud.
  • Be selective in choosing a service—not all services are built the same.
  • Keep up with communications from the IRS, banks, credit card providers, health insurance groups and any other institution that relies on a SSN or other valuable information.
  • Minimize exposure by not sharing a personal SSN or that of a child unless absolutely necessary. Learn how that information will be protected by the agencies, institutions and people collecting it. Encrypt PDFs when transmitted digitally and shred documents not being filed away in secure locations

    Comments on Facebook