Identity theft is a sneaky sort of crime. While there are plenty of common signs that can indicate your identity has been stolen, it’s up to the individual consumer to be educated and vigilant enough to notice them. But what would happen if the criminal only used part of your identity?
That’s how synthetic identity theft works. Scammers stitch together parts of real identities with outright fakery, creating plausible “Franken-identities.” This type of scam doesn’t usually have the kind of impact on your personal credit that you would experience with conventional identity theft, so it’s much harder to know if your information has been compromised.
How Synthetic Identity Theft Begins
Synthetic identity theft begins in the same way as other identity frauds, with the compromise of someone’s personally identifying information: bank or credit card accounts, a driver’s license, or — the gold standard — a social security number. That’s where the creative part starts. The scammer stitches together real information, perhaps one person’s SSN with another’s driver’s license number, and then fleshes out a persona with completely fabricated information.
You’ve probably encountered this kind of made-up identity before, in other contexts. Most of us have seen fake users (“sock puppets”) on social media or in the comments sections of busy forums, where those users spread misinformation for fun and profit or simply do a bit of trolling. It’s also how scammers “catfish” unsuspecting users on social media and dating sites.
FIGHT SYNTHETIC IDENTITY THEFT WITH SPOKEO PROTECT
Synthetic identity theft applies those same principles to fraud, patiently building a persona over a period of months or even years, before making a play that nets a serious financial payout. It’s frighteningly effective because it exploits the workings of the financial system.
How Scammers Create a Plausible History
Once the identity has been created, scammers set about bringing it to life. This may include setting up a mailing address in a specific neighborhood, setting up subscriptions, or a tour of duty as a sock puppet on social media, complete with stolen photos and lots of likes and shares from other sock puppet accounts.
The next step is to begin establishing credit, which follows the industry’s well-worn path. The fake person opens an account at a bank or credit union, using a forged ID. The newly created “person” might be added as a second user on an existing account, belonging either to a real person or a previous synthetic identity. Another tactic is to establish credit through the use of a secured, low-limit credit card or by making purchases from high interest lease-to-own vendors, car dealerships and other businesses that routinely work with consumers who have new credit.
Scammers of course are well versed in the cagey use of purchases and payments to build a good credit score in a hurry. In a relatively short time, they’re in a position to access a significant degree of credit. That’s when the payoff portion of the cycle kicks in.
When “Busting Out” Means Cashing In
Eventually, once the amount of credit available to the synthetic identity is large enough, the criminals behind the identity pull the trigger and cash out. They’ll maximize all of the available credit, at which point the identity disappears like the mirage it is. The banks and credit card companies, and eventually the collection agencies working on their behalf, find themselves grasping at thin air. This step in the process is referred to as “busting out.”
Really brazen criminals will increase their take by exploiting the very protections put into place to protect consumers against conventional identity theft. They’ll dispute the charges they themselves have used to pillage the credit account, under the terms of Section 605B of the Fair Credit Reporting Act. Credit reporting agencies only have four days to respond to a fraud claim, which isn’t usually time enough for a full investigation. They’ll usually purge those charges at least temporarily while they finish the investigation (aka “credit washing”), which gives the scammers an opportunity to once again max out their credit before vanishing.
It’s a major headache for the financial sector. An in-depth 2020 report from The Federal Reserve collated data from across the industry, concluding that synthetic identity theft was one of the largest and fastest-growing threats faced by financial institutions. Even worse, because it carefully targets (or exploits!) gaps in the system and the regulatory environment, it’s especially hard for financial institutions to detect and prevent.
Why Synthetic Identity Theft Should Matter To You
Much of the literature around preventing synthetic identity theft — like the report from the Fed — is aimed at financial institutions and government departments, who are attempting to solve the problem “from the top down.” That’s because it’s the institutions themselves that bear the direct financial costs, and the corresponding law enforcement and regulatory agencies who will be responsible for trying to close the legal and regulatory loopholes that make it possible.
Unlike conventional identity theft, you as the individual consumer are unlikely to see any direct financial repercussions, even if your ID becomes part of that synthetic identity. So why should you care or exert any effort toward making it harder “from the bottom up”?
There are two main reasons. The first is that it’s costing financial institutions billions of dollars and inevitably consumers will end up paying for it in increased fees or decreased services. The second is that the SSNs used by scammers tend to be taken from the most vulnerable people: children, the elderly and those who are homeless or living in care. The misuse of your child’s SSN, for example, could mean you’ll have to clear a ton of bad credit — perhaps even a criminal record — attached to that SSN before your kid can embark on a normal adult life. It’s not a happy prospect.
What Can You Do To Prevent Synthetic Identity Theft?
As an individual there’s little you can do to prevent synthetic identity overall, but you definitely can take steps to make it harder for your own identity — or that of your family members — to be misused.
Place a Credit Freeze on Your Childrens’ SSNs
This blocks potential creditors from pulling a credit report, making it much harder for scammers to build out a new credit history. If you have elderly parents with no new need for credit, you should talk to them about doing the same. If you’re the caregiver for a dependent adult or if you hold power of attorney for a relative, you can make that decision unilaterally (but it’s always best to discuss it beforehand with family, to be sure your motives won’t be misconstrued).
Get Dark Web Monitoring
Criminals typically buy personally identifying information in bulk on a shady corner of the internet known as the “dark web.” As part of the identity protection that comes with your Spokeo Protect membership, you can set up real-time alerts to notify you know when your information is offered up for sale there.
Place Fraud Alerts as Needed
If your personal information shows up on the dark web, placing a fraud alert warns credit issuers to verify any new credit with you personally. A standard fraud alert lasts one year, or you can place an extended fraud alert that’s valid for seven years.
Participate in SSN Verification
The Social Security Administration has introduced a service called “electronic Consent-Based Social Security Number Verification,” or eCBSV for short. If you give your consent, credit issuers can use the service to verify that the name and date of birth associated with the SSN are legitimate.
Watch for “Piggybacking”
Scammers will sometimes piggyback their new accounts onto the credit of real people, expanding your family — so to speak — with their fake persona. Scrutinizing your account statements closely is the best way to catch this and nip it in the bud.
A Final Word
The problem of synthetic identity theft isn’t going away any time soon, because billion-dollar industries — even illicit ones — tend to take on a stubborn life of their own.
Your own personal efforts to make a difference may feel like a single grain of sand on a very large beach, but that’s really the point: There are a lot of beaches and they’re all made up of those single grains of sand. If you do your part (and encourage those you know to do the same), eventually this kind of scam will become harder to execute successfully.
References:
- U.S. Federal Trade Commission – Fair Credit Reporting Act, Section 605B
- The Federal Reserve – Payments Fraud Insights, July 2020: Mitigating Synthetic Identity Fraud in the U.S. Payment System
- U.S. Federal Trade Commission – Credit Freeze FAQs
- U.S. Federal Trade Commission – Place a Fraud Alert
- U.S. Social Security Administration – Electronic Consent Based Social Security Number Verification (eCBSV) Service