Synthetic Identity Fraud

Synthetic identity fraud is the creation of a fictitious person, or sometimes a fictitious business, from a mix of real and made-up personal data, and the use of that invented identity to open accounts, build credit and then borrow money that is never repaid. A typical synthetic identity pairs a genuine identification number, often one belonging to a child, an elderly person or someone with no credit history, with a false name, date of birth and address. Lenders, card issuers and fintech firms are the main targets.

The Federal Reserve, working with an industry focus group, published a standard definition in 2021: the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain. Synthetic identity fraud differs from identity theft, where a real person is impersonated, and it is harder to spot because there is often no victim watching their own accounts and raising the alarm.

Imagine someone building a fake person the way you might assemble a costume: a real badge borrowed from one person, a made-up name, an invented birthday and a rented mailbox for an address. Nobody recognises the costume as a fake, because no real person is complaining that their name is being used.

The fraudster then plays the part of a model customer for months or years. The fake person opens a small account, pays every bill on time and slowly earns the trust of lenders. When the credit limits are high enough, the fraudster borrows as much as possible across several lenders at once and disappears. The lenders are left chasing a person who never existed.

The pattern described in the Federal Reserve's mitigation toolkit and in lender case studies has several stages:

1. Assembly. The fraudster combines a real or randomly generated identification number with invented details. In the US, the shift to randomised Social Security numbers in 2011 made it harder for lenders to check whether a number fitted a person's age and state of issue.
2. Establishing a file. The first credit application is usually declined, but the inquiry itself can create a file at a credit bureau. The identity may then get a secured card, a store card or a small loan.
3. Building history. On-time payments raise the credit score. Fraud rings sometimes add the synthetic person as an authorised user on a real account with good history, a practice known as piggybacking, to speed this up.
4. Bust-out. The identity draws down every available line of credit, sometimes after paying with a cheque that later bounces to free up limits, and then stops paying.

Synthetic identities are also used to open mule accounts for money laundering, to claim government benefits and to obtain loans from pandemic-era relief programmes.

Lenders often record synthetic identity losses as ordinary bad debt, because a customer who stops paying looks like any other defaulting borrower. No real person files a complaint, and the credit report for the identity can look healthy until the bust-out. The Federal Reserve Bank of Boston has pointed out that it is not a victimless crime: when a child's or an elderly person's identification number is used, the real owner may discover the problem years later when applying for credit, a job or benefits.

Generative artificial intelligence has added new risks, because it makes it easier to produce realistic fake documents and selfie images to get through online identity verification.

Because no single check catches a synthetic identity, firms combine several signals:

• Identity data checks. Comparing the name, number and date of birth against authoritative records. In the US, the Social Security Administration's electronic Consent Based SSN Verification service, created under a 2018 law, lets permitted financial institutions confirm with the customer's consent whether a number matches the name and date of birth.
• Depth of footprint. Real people leave a long, varied trail of addresses, phone numbers, utility accounts and online activity, part of their digital footprint. A thin file that appeared recently, uses a mailbox address and shares a phone number with other applicants is a warning sign.
• Link analysis. Fraud rings reuse elements, so firms look for clusters of applications sharing devices, addresses, email patterns or numbers. Device signals from a digital fingerprint help reveal one operator behind many identities.
• Behaviour over time. Behavioral analytics and anomaly detection flag accounts whose usage changes sharply, such as a long-quiet card that suddenly maxes out, while velocity checking catches a burst of applications to many lenders.

Strong know your customer checks at onboarding remain the first line of defence, and sharing confirmed cases through industry consortiums helps other lenders spot the same identities. For financial institutions, synthetic identity fraud is one input to a broader fraud risk management programme, and suspicious cases may need a suspicious activity report.

Most published work on synthetic identity fraud comes from the US, where a single national number, a credit system that creates files from applications and heavy use of unsecured credit make the scheme attractive. Other countries see versions of it wherever lenders accept thin-file customers online and identity data can be bought after breaches. Markets with strong biometric national identity systems face less of the classic pattern but more attempts to fool the biometric checks themselves.

• Federal Reserve: Synthetic Identity Fraud Mitigation Toolkit