What is Synthetic Identity Theft and How Can it Occur?

Synthetic identity theft occurs when a criminal combines real and fake information to create a new identity that they can use to open credit accounts, apply for loans, and carry out other fraudulent activities. Unlike traditional identity theft, where a criminal steals an individual’s personal information to impersonate them, synthetic identity theft involves creating an entirely new identity that doesn’t belong to anyone.

To create a synthetic identity, a criminal will typically start by using a real social security number (SSN) obtained from a vulnerable person, such as a child or elderly individual, who is unlikely to be using their SSN regularly. The criminal will then combine this real SSN with fake information, such as a fake name, address, and date of birth, to create a new identity that can be used to apply for credit accounts.

The criminal will then use the synthetic identity to apply for credit, usually starting with a small amount, such as a store credit card or a gas card. Once the credit is approved, the criminal will make small purchases and pay them off on time, building up a positive credit history for the synthetic identity. Over time, the criminal will apply for more credit accounts, and as the synthetic identity’s credit history improves, they will be able to apply for larger and more lucrative credit accounts.

How Does Synthetic Identity Theft Occur?

Synthetic identity theft occurs through a multi-step process that blends real and fake personal information to create new identities. This process can be broken down into several key stages:

Collection of Real Data: The first step involves acquiring real personal information, most notably Social Security numbers (SSNs). These can be obtained through various means, such as data breaches, phishing scams, or purchasing stolen data on the dark web. Children’s SSNs are particularly valued because they are less likely to be actively monitored, making them ideal targets for this type of fraud.
Creation of a Synthetic Identity: Once a real SSN has been secured, the fraudster fabricates additional personal details to complete the identity. This might include a fake name, address, date of birth, and other personal information. The key is to blend these elements in a way that creates a plausible, but entirely fictitious, identity.
Building a Credit Profile: With the synthetic identity assembled, the fraudster attempts to create a credit profile for this identity. Initially, this involves applying for credit products, such as credit cards or loans, where the applications are expected to be rejected due to the lack of a credit history. However, these initial rejections help to establish a credit file for the synthetic identity.
Nurturing the Identity: Over time, the fraudster carefully builds the synthetic identity’s creditworthiness by obtaining and responsibly managing small lines of credit, such as secured credit cards or loans from companies that might not require extensive credit checks. Payments are made on time to build a positive credit history.
Exploitation: Once the synthetic identity has a sufficiently good credit score, the fraudster exploits this creditworthiness to apply for and receive larger loans, credit cards, and other financial benefits. This stage often involves maxing out credit lines with no intention of repayment, a tactic known as “busting out.”
Disappearance: After exploiting the financial benefits, the fraudster abandons the synthetic identity, leaving behind unpaid debts and financial losses that are difficult to trace back to any real individual. This results in significant challenges for financial institutions, as they must absorb the losses while struggling to identify and rectify the fraudulent activity.

The complexity of synthetic identity theft lies in its exploitation of the credit system and the difficulty of detection. Real SSNs give the synthetic identities a semblance of legitimacy, while the fabricated components make it hard for financial institutions to link suspicious activities to real individuals. This form of identity theft not only causes financial harm to businesses but can also inadvertently impact the individuals whose SSNs were used, potentially leading to credit issues and the need for lengthy resolution processes.

Detecting Synthetic Identity Theft

Detecting synthetic identity theft is a far more advanced level of identity theft that requires a more technical approach that leverages advanced analytics, machine learning, and vigilant monitoring of credit behavior and application patterns. Financial institutions and credit bureaus employ sophisticated algorithms to scrutinize application data, credit usage, and behavioral patterns that deviate from typical consumer behavior, signaling potential fraud.

Inconsistencies in application information play a crucial role. Algorithms are designed to flag discrepancies such as mismatched names and Social Security numbers, addresses that frequently change or are associated with commercial properties, and phone numbers or email addresses that appear in multiple applications with varying personal information. These red flags may indicate the use of a synthetic identity.

Machine learning models contribute significantly to identifying patterns that human analysts might overlook. These models are trained on vast datasets of fraudulent and legitimate behaviors, allowing them to detect subtle anomalies in credit application and usage patterns. For instance, a synthetic identity might exhibit unusually rapid changes in credit score or a pattern of moving from secured to unsecured credit at an atypical pace.

Behavioral analysis extends beyond the application process, encompassing how accounts are used after they are opened. Synthetic identities often display unique behaviors, such as making small purchases to build credit history without a genuine consumer’s typical varied financial activity. Monitoring for accounts that only engage in minimal activity to remain active or rapidly escalate their borrowing capacity can help in identifying potential synthetic identities.

Cross-referencing data is another vital strategy. By comparing information across applications and accounts, financial institutions can identify shared details that might not otherwise raise suspicion. This includes spotting Social Security numbers that appear across applications with different names or birthdates, or tracking the use of the same contact information by multiple applicants.

Collaboration among financial institutions, credit bureaus, and regulatory bodies enhances the detection of synthetic identity theft. Sharing information about known fraud patterns and indicators can help create a more comprehensive defense against this form of theft.

Implementing stricter verification processes at the point of application helps in preempting the creation of synthetic identities. This might involve more rigorous checks against government databases, the use of biometric verification, and the integration of real-time data analytics to assess the authenticity of application information.

Synthetic Identity Theft Protection

Protecting against synthetic identity theft can be challenging, as the criminals behind this type of fraud are often skilled and persistent. However, there are several steps you can take to reduce your risk:

Monitor Your Credit Reports: Regularly check your credit reports from the major credit bureaus (Equifax, Experian, and TransUnion) to ensure that there are no fraudulent accounts in your name. You can get a free credit report from each bureau once a year at AnnualCreditReport.com.
Freeze Your Credit: Consider placing a freeze on your credit reports with the three major credit bureaus. This will prevent anyone, including yourself, from opening new credit accounts in your name without first unfreezing your credit.
Protect Your SSN: Be cautious about sharing your SSN and only provide it when necessary. Store your SSN securely and avoid carrying your SSN card with you.
Be Wary of Unsolicited Credit Offers: If you receive a credit offer in the mail or by email, be cautious. Check the legitimacy of the offer and the company offering it before applying for credit.
Use Strong Passwords: Use strong, unique passwords for all of your online accounts, and never reuse passwords across multiple accounts. You can also securely store passwords with a password manager.
Be Vigilant for Signs of Fraud: Watch for signs of fraud, such as unexpected credit card charges or new accounts you did not open.

Regularly checking your credit reports is a foundational step, allowing you to spot unauthorized or suspicious activities that could indicate someone is using your personal information to create a synthetic identity. Credit monitoring services can automate this process, alerting you to any new accounts or credit inquiries in your name that you did not initiate.

Freezing your credit with the major credit bureaus—Equifax, Experian, and TransUnion—provides a robust layer of protection. A credit freeze restricts access to your credit report, making it more difficult for identity thieves to open new accounts in your name. While this doesn’t prevent all forms of identity theft, it significantly reduces the risk of new accounts being opened without your permission.

Safeguarding your Social Security number (SSN) is critical. Only share your SSN when absolutely necessary and inquire about alternative identification methods whenever possible. Be wary of unsolicited requests for personal information, whether they come via email, phone, or text, as these could be phishing attempts aimed at harvesting your data for fraudulent use.

Utilizing strong, unique passwords for each of your online accounts and enabling two-factor authentication (2FA) wherever available enhances your digital security. This makes it harder for attackers to gain access to your information even if they manage to obtain one of your passwords.

Be mindful of the information you share on social media and other public platforms. Fraudsters can use publicly available information to piece together your identity or answer security questions that protect your accounts. Adjusting your privacy settings to limit the amount of information you share publicly can mitigate this risk.

Regularly updating your computer’s and smartphone’s security software, operating system, and applications protects against malware and cyber attacks that could be used to steal personal information. Employing a dedicated and up-to-date antivirus program adds an additional layer of defense against malicious software designed to capture personal data.

Consider signing up for an identity theft protection service. These services offer a range of protections, including monitoring of your personal and financial information across various databases, alerts of suspicious activity, and assistance in recovering your identity if theft occurs.

What to do if you Suspect Synthetic Identity Theft

If you suspect that you may be a victim of synthetic identity theft, it’s essential to take action quickly to minimize the damage. Here are the steps you should take:

Contact the Credit Bureaus: Contact the three major credit bureaus (Equifax, Experian, and TransUnion) and request that they place a fraud alert on your credit report. This will alert creditors that your identity may have been compromised and prompt them to take additional steps to verify your identity before extending credit.
File a Police Report: Contact your local police department and file a report of the identity theft. This will create an official record of the crime and may help you to recover any losses incurred as a result of the theft.
Contact Your Financial Institutions: Contact your bank, credit card issuers, and any other financial institutions you have accounts with, and inform them of the suspected identity theft. They can help you to close any fraudulent accounts and may be able to help you recover any losses.
Consider Freezing Your Credit: Consider placing a freeze on your credit reports with the three major credit bureaus. This will prevent anyone, including yourself, from opening new credit accounts in your name without first unfreezing your credit.
Monitor Your Credit Reports: Continue to monitor your credit reports regularly for any suspicious activity.

Start by obtaining copies of your credit reports from all three major credit bureaus—Equifax, Experian, and TransUnion—to review for any accounts or activities you do not recognize. This step is essential for identifying any discrepancies or fraudulent accounts that may have been opened using your personal information.

Contact the fraud departments of each credit bureau to report the suspected identity theft. Request that a fraud alert be placed on your credit file, and explore the possibility of freezing your credit to prevent further fraudulent activity. A fraud alert makes it harder for an identity thief to open more accounts in your name, while a credit freeze locks down your credit entirely.

Report the theft to the Federal Trade Commission (FTC) through their website, IdentityTheft.gov, or by phone. The FTC provides a personalized recovery plan and an Identity Theft Report, which acts as an official statement about the crime and can be used to dispute fraudulent transactions and accounts.

Report Synthetic Identity Theft

Report Synthetic Identity Theft to the FTC at IdentityTheft.gov

Report Now

Reach out to the fraud departments of any financial institutions where you have accounts that might be affected. Inform them of the situation and follow their guidance to secure your accounts. This may involve closing compromised accounts, changing account numbers, or resetting passwords and security questions.

For any fraudulent accounts opened in your name, contact the creditors directly to notify them of the identity theft. Provide them with a copy of your Identity Theft Report and request the closure of the accounts. Ask for written confirmation of the account closure and the fraudulent debts discharged.

Consider filing a report with your local police department. While police may not be able to take action against the fraudsters directly, having a police report can be helpful when dealing with creditors and disputing fraudulent charges.

Document all communications and keep copies of all documents related to your case, including reports filed with credit bureaus, the FTC, police reports, and correspondence with creditors. This documentation will be invaluable as you navigate the recovery process.

Monitor your credit reports and financial statements closely in the months following the discovery of the synthetic identity theft. Look out for any new suspicious activity and report it immediately.

Consider enlisting the services of a professional identity theft recovery service if the process becomes too complex or overwhelming. These services can provide expert guidance and assistance in recovering your identity and securing your financial information.

Bottom Line

Synthetic identity theft is a growing problem that can be difficult to detect and prevent. By taking proactive steps to monitor your credit reports, protect your SSN, and be vigilant for signs of fraud, you can reduce your risk of becoming a victim. Remember, prevention is key, and it’s much easier to prevent synthetic identity theft than to recover from it after the fact.

2024 Data Sources

What is Synthetic Identity Theft? Examples and Preventative Measures