By Brett Johnson, keynote speaker and consultant on cybersecurity, cybercrime and identity theft
Synthetic identity fraud is a crime committed combining real and fabricated information to create a new credit profile. Once created, the criminal can then open fraudulent accounts and makes purchases on those accounts.
The synthetic fraud backstory
In 2011, the Social Security Administration randomized all new social security numbers (SSNs). Doing so meant it was no longer possible to determine the year the social was issued nor the state it was issued in. The move was supposed to combat identity theft. For individuals issued an SSN prior to 2011, if a thief knew the last 4 digits of someone’s SSN, it was easy to get the first five numbers. The SSA plan worked. That specific type of identity fraud was stopped.
But the move created a larger problem: Criminals could now fabricate social security numbers. Following the SSN algorithm, a crook could create a nine-digit number. If, after running the number through a social security number validator the number came back as unissued, the thief could use it as an SSN to commit synthetic fraud.
How it works, now
A criminal could also use an ITIN, or an SSN belonging to someone incarcerated for a long period.
The most popular way to commit synthetic fraud is to use a child’s SSN issued after 2011. Using a kid’s SSN, a fraudster adds a name to it, an adult date of birth, an address and a phone number.
The fraudster then applies for credit. The way the credit bureau system works is: If an application is submitted, and the bureau has never seen the data before, the application will be denied. But, when it is denied, it builds a credit report in the system with that information.
The synthetic profile now has a credit report. The credit report is a new, zero-credit history, very thin file. The idea now is to pump up the credit score as fast as possible and cash out.
First step: Open Source Intelligence (OSINT)
When applying for credit, many systems look for information outside of what is on the credit report. A search is undertaken for public data related to the applicant. Listyourself.net is a free Whitepages listing service. The fraudster inputs the synthetic information into it. Two weeks later, an address and phone number is associated with the synthetic identity. The fraudster may also opt to open a Facebook, or other social media accounts in the name of the synthetic identity.
The fraudster can now open rewards accounts at grocery stores, airlines and pharmacies.
OSINT is taken care of. Now it’s time to build credit.
Most fraudsters go to CapitalOne and apply for a secured card. CapOne gives a $200 credit line for a $39 deposit. The fraudster is already profiting on the synthetic profile. The secured card doesn’t do much for the credit score, but it does give the synthetic identity a primary line of credit.
To boost the credit score, the fraudster usually relies on credit piggybacking through authorized user trade lines. It’s a legal practice in the US used by many to boost credit scores. Adding an authorized user to a credit card automatically makes that card’s specific history become the authorized user’s history after the next reporting cycle. If the card used has good credit, good debt ratio, and has been open long enough, a synthetic profile can go from a poor credit score to a high 700 score in 30 days.
Authorized user trade lines have an additional benefit. It ages a new credit profile. A card with 10 years of history added to a week-old credit profile will cause that profile to appear 10 years old.
Once the synthetic profile reaches the desired credit score, the fraudster can profit.
However, opening new accounts requires documents. Applications for credit, loans or starting bank accounts in the synthetic profile’s name often require a copy of an ID. If a fraudster cannot acquire the needed ID, or if the ID doesn’t pass verification, he will be unable to profit from the crime.
Identity documents used to commit synthetic fraud:
- A physical driver’s license with his picture but the synthetic identity’s information on it. This is presented at physical locations to open new accounts
- Online drivers license photo, scan and selfie with someone else’s picture and the synthetic identity’s information on the document
The right identity verification software can help you change the game in the fight against synthetic identity fraud by improving identity verification standards and giving honest consumers new ways to more easily do business online.