Synthetic Identity Fraud Is Growing, Federal Reserve Says

By Lisa Rabasca Roepe

One of the fastest-growing financial crimes, synthetic identity fraud, often is undetected by banks and consumers — costing U.S. lenders as much as $6 billion a year, though experts said that losses might be much higher because schemes are miscategorized as credit losses.

That’s because synthetic identity fraud uses real information, such as a stolen Social Security number, with fictional information — a name, address or birth date — to open new lines of credit.

Over time, fraudsters can build up lines of credit, only to max it out and then walk away, forcing banks to write off millions of dollars in losses, according to the Federal Reserve.

“Those costs get passed onto consumers,” Jeremy Grant, founder of the Better Identity Coalition (BIC), told Digital Privacy News. “The money is often used to support unsavory activities — such as drugs, money laundering and terrorist-financing.”

What’s the Difference?

In comparison, traditional identity theft uses a person’s real information to get access to a bank account or to apply for a credit card or line of credit in the individual’s name.

It often doesn’t take long before the consumer notices that they’re locked out of their bank account or their credit report includes an unfamiliar account or loan.

Michael Timoney, vice president of secure payments at the Federal Reserve Bank of Boston, told Digital Privacy News: “Before we published our first white paper on synthetic identity fraud last July, a surprising number of financial-institution executives said they’d never heard of this type of fraud and didn’t think it affected their business.”

Scope of the Problem

Synthetic identity fraud is easier to evade because consumers typically do not notice any unusual activity, Timoney said. Fraudsters often will use the SSN of a child, senior citizen or homeless person — generally someone who is not paying attention to credit ratings.

This makes synthetic identity fraud harder to detect.

According to New York consulting firm Auriemma Group, synthetic identity fraud cost U.S. lenders $6 billion in 2016.

“The money is often used to support unsavory activities.”

Jeremy Grant, Better Identity Coalition.

But no accurate number is available because banks often miscategorize synthetic ID fraud as a credit loss, Timoney said.

“We found that there are a lot of synthetics out there, and banks are often unaware they have them in their portfolio,” he told Digital Privacy News.

For instance, it’s not unusual for fraud rings to establish thousands of synthetic IDs and then default.

The largest detected to date racked up bank losses of $200 million from 7,000 synthetic IDs and 25,000 credit cards, according to a January 2019 report from McKinsey & Co., the New York management consulting firm.

“Once identity is established, they often can be good customers,” Timoney said. “They use it and pay it back — and it never seems like anything is wrong until they decide they aren’t paying.”

How to Stop Them

Until recently, banks had no way of validating whether a synthetic fraud ID — a SSN, name, address — was genuine or fake, BIC’s Grant said.

Now, the Social Security Administration (SSA) is offering its electronic Consent Based SSN Verification Service (eCBSV) to financial institutions.

This allows banks to verify whether a name, SSN and date of birth combination matches the agency’s records and whether the applicant is deceased.

SSA only provides a “yes” or “no” answer verifying a match through its verification service, which began as a pilot program this summer, Grant said.

His organization has proposed that SSA, state motor-vehicle departments and other government agencies confirm a person’s identity at the individual’s request.

The SSA’s electronic program is financed by industry fees and is open to any company that is a financial institution or service provider, Grant told Digital Privacy News.

The Fed’s Timoney called eCBSV “a good first step.”

“It’s not going to solve the problem,” he noted, “but it puts another weapon in the arsenal.”

Other Precautions

Banks should determine how often a SSN has been used to apply for credit; how many identities have the same number; whether multiple applications were received from the same cellphone number, mailing address or IP address — and whether multiple authorized users are on the same account, Timoney advised.

For instance, if the same SSN is used eight times with a different name, that’s a red flag, he said.

Consumers also can watch for signs of synthetic ID fraud.

For instance, if your 5-year-old son is getting preapproved credit applications in the mail or collection notices, Timoney said, someone very likely is using his SSN to commit fraud.

“There are a lot of synthetics out there, and banks are often unaware they have them in their portfolio.”

Michael Timoney, Federal Reserve Bank of Boston.

One way to prevent a stolen SSN from being used to obtain a new line credit is to notify the three credit bureaus — Equifax, Experian, TransUnion — and freeze your credit.

“The reality is our children all get a SSN,” Timoney told Digital Privacy News.  “We often put the card in a box and lock it away, but there are things people should do to lock their SSN.”

Lisa Rabasca Roepe is a writer in Arlington, Va.

Sources (links external):

How Fraudsters Create Synthetic IDs

According to the Federal Reserve:

  • Fraudsters create an identity using a stolen Social Security number and then apply for credit at a financial institution.
  • Even if the institution rejects the application, a credit bureau automatically creates a new credit profile because the applicant is considered “new.”
  • The profile then becomes the synthetic identity’s so-called “proof” of existence.
  • Fraudsters then apply at different institutions until an application eventually is approved.
  • Once fraudsters establish a credit account with the synthetic identity, the goal is to quickly increase the identity’s credit availability by cultivating a high credit score — and then cashing out with the largest payout possible.

Lisa Rabasca Roepe