When identity theft results in fraud, it can be devastating for the person whose identity is stolen. For investigators and for any financial institution that was defrauded as a result, the silver lining is that these crimes are usually easy to identify. If the institution’s own algorithms don’t recognize the fraud, a complaint from the identity theft victim puts those transactions “on the radar.” Similarly, the victim’s complaint gives law enforcement a starting point for investigation.
Synthetic identity fraud, however, is a much thornier problem. A “synthetic” identity doesn’t rely on the personally identifiable information (PII) of one real-world individual. Instead, it blends PII from multiple people or fake information made up entirely from scratch to create a convincing persona. The financial industry has struggled to cope with the threat of synthetic identity theft, and so (on the whole) has law enforcement. The use of powerful, flexible new data-gathering tools may help change that. Here, we dive into what you need to know.
How Synthetic Identity Theft Works
Over the past few years, the Federal Reserve has spearheaded a drive to standardize how financial institutions define and track synthetic identities. The Fed defines synthetic identity fraud as “…the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain.”
This can happen in different ways and for different reasons. A consumer with a problematic credit history might, for example, falsify a few pieces of their own PII in order to secure credit. This is still fraudulent, even if the individual never misses another payment in their life, though it would be a low-priority investigation. In other cases, criminals might deliberately combine PII from multiple individuals in order to create a new persona that can be used to generate credit. After grooming the account to raise its limits, criminals max it out and walk away (sometimes called a “bust out” scam).
In a third scenario, much or all of the PII used to create a new persona can be falsified. They’ll often use an unassigned SSN, for example, from a block of numbers known to be currently in use by the SSA. These simply show up in most financial institutions’ credit checks as a valid number with no associated credit history, just as they would for a young adult starting out in life. These can be especially tricky for financial institutions to identify and often go unrecognized even after fraud has occurred.
Investigating Synthetic Identity Fraud
One takeaway from the Fed’s efforts at standardizing an approach to synthetic identity fraud is that the financial industry’s current focus – identifying fraud through payment patterns – is ineffective. It’s become clear that the industry should focus instead on verifying the identity itself to catch inconsistencies or other tell-tale signs of fakery. This is also how LEAs must approach the case once the consumer (or lender) has filed a report.
At first glance, it might seem that investigating a non-existent person is a fool’s game. That’s not entirely true for a number of reasons. Some synthetic identities draw on a part of the perpetrator’s real identity, for example. Identities made up of PII from multiple real people can be deconstructed and may sometimes point to a perpetrator who is connected to the victims in some specific manner.
Fully synthetic identities are more challenging to crack, given that names are easy to make up, photos can be stolen or simply generated with AI tools, and SSNs not currently assigned to a real person can be inferred and used. Even so, these aren’t a dead end for investigators, as we’ll establish.
Unraveling Synthetic Identities Using Social Media
To streamline this discussion, we won’t give much attention to consumers using partially synthetic identities to get credit. Those are relatively straightforward to identify and trace, so financial institutions are likely to pursue them through debt collection and skip-tracing channels. Instead, let’s look at the more challenging tasks of unraveling fully synthetic identities and “Frankenstein” identities pieced together from the PII of multiple real people.
Synthetic Identity Theft
A fully synthetic identity can’t really be described as identity theft, but these “Frankenstein” identities can. When a case is brought to the police, either by the lender or one of the victims whose identity has been cannibalized, the first step is to list all of the individual pieces of PII used to construct that identity. Core parts of the identity, such as the SSN, can be searched through existing law enforcement channels. Official sources, however, often contain incomplete or dated information or conflicting information sourced from different databases.
A powerful, modern search tool like Spokeo for Business, with integrated access to both regulated and open-source data, can close those gaps. By using Spokeo to methodically search the name, address, and other PII used to construct the account, you may be able to find a connection back to the information of the real humans behind them. Scrutinizing each of those individuals, through information received in the search results, may point to one of them being the perpetrator of the fraud. At a minimum, it can rule out some or all of them as suspects.
Frequently, the SSN proves to belong to a senior, a minor, or a recently deceased person. The criminal, in those cases, is often a trusted family member, friend, advisor, or caregiver. They see the opportunity to appropriate and misuse an SSN that won’t immediately be detected and act on it. Here, turning to social media can be a productive step in the investigation.
Using Spokeo for Business, search the names of people within the real SSN-holder’s circle. This will reveal their public social media accounts. Investigators can review their public posts and photos for indicators of sudden prosperity or activity that coincides with the use of fraudulently obtained credit. This, in turn, can be leveraged to generate subpoenas and search warrants.
Fraud With a Fully Synthetic Identity
Even wholly manufactured identities can give up useful data about the people who fabricated them. This doesn’t necessarily come from the primary data but typically from all the secondary details criminals use to create the impression of a real person with a normal life. These include email and physical addresses, phone numbers, and most usefully, social media platforms. Unlike the core pieces of PII that go into a synthetic identity (a name, birth date, or SSN), these require genuine, ongoing creativity.
That’s where opportunities arise for investigators because criminals (especially structured crime rings) tend to create accounts on an ongoing basis to generate a steady stream of income. This means that they’ll repeat themselves, creating vulnerabilities that police can exploit. A single phone number or email address, for example, may be used across multiple accounts. When investigators pursue the original complaint, searching that piece of identification through Spokeo for Business may reveal all of the other personas utilizing the same number or email. It will also show all public social media accounts opened with that email or phone number.
This creates a number of potential cracks in the criminal’s anonymity. Careless criminals might mistakenly use an identifiable device to open some of those accounts, for example, which can then be tied back to their real identity. Their efforts to flesh out their faux-personal accounts on social media may contain verifiable details of their real identity, which can turn a tentative ID into a firm ID of the suspect. In the case of scams targeting consumers rather than institutions, using Spokeo to search the synthetic identities’ contacts can uncover additional victims or potential victims who have not yet been scammed.
Following Up on Your Searches
Searches like these (and the examples we’ve cited barely scratch the surface of what’s possible) equip investigators with the insights and information needed to pursue cases to a resolution. In the case of scams targeting consumers, identifying previously unknown victims can help define the full scope of the suspect’s activity, giving prosecutors leverage to seek longer sentences or less-favorable plea deals. Identifying potential victims creates opportunities to work together on a sting or at least to prevent further financial losses.
For information about the synthetic account’s devices and activities, your Spokeo search results can offer reasonable grounds to seek subpoenas or search warrants targeting cellular carriers, internet service providers (ISPs), and social media platforms used by the synthetic identity. Those, in turn, should provide detailed location information or access to private posts and direct messages that aren’t otherwise available. All of these threads, which can otherwise be difficult or impossible to pull together, are made possible – and even straightforward – by Spokeo’s powerful algorithms and billions of data points.
Tackling Synthetic Identities
Synthetic identities are problematic in many ways. While this discussion focused on their use in fraud cases, they may also be used as cover for criminals selling drugs, engaging in human trafficking or terrorism, and a range of other unsavory purposes.
These identities are resistant to many conventional approaches to investigation, which highlights the need for more modern, powerful tools like Spokeo for Business. Unlike many competitive products, Spokeo for Business doesn’t require a substantial up-front investment in money or training (even tech-hating personnel find it simple to use) or significant IT support. Instead, it works on a usage-based subscription scale that’s affordable for law enforcement agencies of all sizes, and Spokeo’s US-based support team is available 24/7 to answer questions and provide assistance.
To learn more about Spokeo for Business, to see a demonstration of the product, or – better yet – to arrange a no-cost trial for your investigators, reach out to our team using the contact information on our Law Enforcement page.
Sources
The Federal Reserve: Synthetic Identity Fraud Defined
Dun & Bradstreet: Busting Bust-Out Fraud
The Federal Reserve: Synthetic Identity Fraud Defined (Long Version)
US Attorney’s Office, Southern District of Illinois: Former Employee of Retirement Center Sentenced for Stealing Identities of Elderly Residents
Lexis-Nexis Risk Solutions: White Paper: Uncovering Synthetic Identity Fraud