Synthetic Identity Theft: Definition, Damages & Defense

Synthetic identity theft involves a hacker using a combination of fake and real information to form an entirely new identity. 

Real information might be stolen usernames, passwords, or other identifying pieces that are grabbed in data breaches and sold on the dark web. 

Hackers combine this stolen information with fake information that can pass standard security checks and then use vital components of your identity to illicitly purchase items or open bogus accounts. 

This type of identity theft is the fastest growing financial crime in the United States, costing lenders over $6 billion a year.

How does synthetic identity theft work?

Fake identities made in this type of fraud are most often used to get credit cards or loans. Unfortunately, this can mess with your credit. 

The fraudster may not use this fake identity for very long — just long enough to build up a credit history that they can exploit. They may also initially rack up lots of debt or fraudulent charges and then make a synthetic identity using other information, like yours, to pose as the victim of fraud and have their credit restored at your expense. 

Here is how a criminal creates and uses a synthetic identity:

1. The criminal combines some legitimate information with fake information, often using personal information stolen in data breaches.
2. The fraudster uses the new identity to apply for some type of credit. About 50 percent of synthetic identities are used to apply for credit online.
3. The criminal will use the fake identity to apply for credit at several institutions until they are approved.
4. They will piggyback on another account holder in good standing to get good credit fast.
5. Once they have used as much credit as they want, they abandon the accounts.

Thieves using synthetic identities are most likely to commit bust-out fraud. The identity thief typically runs several synthetic identities at the same time, building up responsible credit scores slowly. Then, when they have maxed out their access to credit on one identity, they stop paying the accounts and those become delinquent. 

To financial institutions, this does not immediately look like identity theft. Instead, it looks like an average person having normal financial difficulties. 

Since children have legitimate social security numbers and no credit score, they are 51 times more likely to be the victims of synthetic identity theft than adults. About 1 million children in just 2017 were victims of this type of fraud. 

Synthetic vs. traditional identity theft

Although synthetic identity theft can still have a negative impact on the person whose information is stolen, it is not the same as traditional identity theft. 

• Traditional identity theft: Individuals’ personal information, including physical addresses, phone numbers, social security numbers, names (including maiden names), employer information, and dates of birth, is stolen and sold as a complete package. A fraudster can use your full identity to pretend to be you, open accounts in your name that go delinquent, file your taxes to get your refund, or make purchases using your money.

  One way to check on this type of theft is to monitor your credit score, but your bank should also notify you if your accounts are inappropriately accessed. You may also hear from collections departments for delinquent accounts you never knew about. 

• Synthetic identity theft: Although inspired by traditional identity theft, synthetic identity theft uses combined real and fake information to make the thieves much harder to track.

  Many financial institutions can monitor for identity theft. Unusual purchases, loans, and other financial transactions from one person are typically a sign of identity theft. However, by making a new person, these thieves can sneak through the system.

Why is synthetic identity theft a problem?

Individuals like you can become the victim of identity theft, including synthetic identity theft, and it can mess up your credit score or lead to stolen funds. However, there are many other victims of synthetic identity theft because criminals do not use these identities just to buy designer shoes and coats. 

Here are some of the reasons a criminal might use a synthetic identity:

• Drug smuggling
• Human trafficking
• Money laundering
• Dark web activity

Financial institutions bear the direct burden of this fraud, and individuals deal with long-term identity issues, but many other people suffer because of this criminal activity. 

Detecting & preventing synthetic identity theft

Currently, it is very difficult for individuals and institutions alike to detect synthetic identity theft. Financial institutions use filters to detect fake social security numbers, but this only incentivises thieves to use real ones. 

Plus, many people with social security numbers do not have lengthy credit histories yet. They may be children, recent citizens or immigrants, or people who simply have not taken out lots of loans or extensively used credit cards. 

Banks and other financial institutions have trouble telling the difference between a fake social security number or a synthetic identity and someone who has a limited credit history for another reason. ID Analytics found that 85 to 95 percent of synthetic identities were not flagged as potentially fraudulent or high risk by major financial institutions. 

Part of detection difficulty comes from how social security numbers are assigned. In 2011, the Social Security Administration (SSA) began to randomly generate new SSNs to assign, to extend the number of possible 9-digit SSNs available. However, this means criminals can generate a unique, fake SSN and it looks real. They may also use other identifying numbers like credit report numbers to make their identities seem legitimate. 

Since this is a new type of fraud, it is difficult to detect and prevent. As an individual, your best prevention method is securing your data. If you manage computer systems for a business, follow the most up-to-date best practices for identity screening, and protect employees’ data in secure systems. 

References

Synthetic Identity Theft. (October 2021). Investopedia. 

Synthetic Identity Fraud in the U.S. Payment System. (July 2019). United States Federal Reserve. 

Child Identity Theft. (August 2021). CyLab, Carnegie Mellon. 

What is Synthetic Fraud? (March 2021). Forbes Advisor. 

Synthetic Identity: Slipping Through the Cracks. (November 2018). ID Analytics.

Synthetic Identity Theft and Fraud. Experian.