Fraud isn’t new—particularly in the financial services industry. Lately, however, we have seen a rise in the sophistication of attacks. To effectively detect and protect against newer, more advanced types of fraud, it’s critical to understand what they are and how they work.
Javelin's 2024 Identity Fraud Study reported overall identity fraud losses reached nearly $23 billion in 2023, a 13% increase from 2022. Part of the reason for this is the rise in synthetic identities. According to a recent survey of fraud executives by the Aité-Novarica group, synthetic identity fraud ranks as the number one threat.
What is a synthetic identity?
A synthetic identity is a fake identity that combines real personal information, like a Social Security number, with fraudulent or fabricated information, such as identity documentation. Fraudsters create and use synthetic identities to pass identity verification checks for online platforms. These insidious identities are often used to create bank accounts or apply for loans.
There are several forms of synthetic identity fraud, including:
Identity compilation: Some synthetic identities are created with both real and fake data. For example, a fraudster may use someone's social security number and date of birth, but a fake name and address.
Identity manipulation: Rather than using fake data, the fraudster may manipulate a document, such as adding a different name to a paycheck stub or a new birthday to a legitimate driver's license.
Not all synthetic identities are created with fraud in mind. Sometimes, people without access to documents or lower credit scores create synthetic identities to apply for loans or open bank accounts. In these cases, synthetic identity is simply a means to access financial services.
Regardless of intent, synthetic identities are fraudulent and are not a legitimate solution.
Why are synthetic identities becoming more common?
Several factors have contributed to the rise in synthetic identities and synthetic identity fraud. One factor is the increased amount of personally identifiable information (PII) data available on the dark web, which has made third-party synthetic ID theft easier. When fraudsters have access to more social security numbers, birthdates, and other information, there are simply more opportunities to combine and manipulate that data.
Another factor contributing to the increase in synthetic fraud is the Social Security Administration's (SSA) decision to randomize social security number (SSN) assignments. Assignment of SSNs used to rely on a formula, which made it easier for anti-fraud algorithms to spot fake numbers. While the change was designed to help prevent fraud by making the numbers less predictable, it also made synthetic identity fraud detection more difficult.
→ Want to prevent synthetic identity fraud? Get started with Plaid Identity Verification.
What happens if I'm a victim of synthetic identity theft?
Synthetic identities and the resulting fraudulent activities are a growing concern because they can be difficult for identity verification platforms to prevent. In some cases, fraudsters may spend years building up a legitimate financial history before committing fraud, making them seem like legitimate identities.
There is good news for consumers. Synthetic identities are most often used to defraud financial institutions and fintech apps, rather than individual users. If your personal information is used in a synthetic identity, you may notice changes in your credit score. Pay close attention to your credit report and report any debts you don't recognize.
Financial organizations and financial services apps can use new technologies to prevent the use of synthetic identities. We'll explore services and options in the last section.
How does synthetic identity theft occur?
Synthetic identity theft is a complex form of fraud that can occur in multiple ways. In general, fraudsters use these steps.
Gather personal information: The fraudster starts by collecting personal information, including names, dates of birth, social security numbers, addresses, and other information from data breaches, social media, and public records.
Creates a synthetic identity: Once the fraudster has enough information, they combine real and fake data to create a synthetic identity.
Build credit profile: Once the identity is created, the fraudster may spend months or years building a credit profile before taking action.
After a fraudster has built up a credit history, these bad actors implement their goal—fraud. They may take out a loan, and then use the real and verifiable elements of their synthetic identity to claim identity fraud. Or, they may take out a small credit line, pay it back, and then take out a larger loan and disappear without paying the debt.
Another common tactic is “piggybacking,” where someone adds a synthetic identity to an established credit profile, oftentimes inheriting a positive credit history.
Find out how much identity verification is worth to your organization
Prevent fraud, win users, and protect your bottom line
How big is the threat of synthetic identity fraud?
The impact of synthetic identity theft is hard to measure. Synthetic identity fraud can also be hard to detect, and once it’s discovered, there’s no standardized process for recording or recovering losses. Some banks may record the loss as a credit loss, while others may account for the loss as third-party fraud.
Estimates cited by the Federal Reserve pegged the losses at $6 billion per year, or roughly 20% of credit losses, back in 2016. In subsequent years, this threat has increased. TransUnion reported in the first half of 2023, the total exposure (meaning how much access to credit synthetic identities have) in the US auto industry alone was $1.8 billion, a 38% increase year-over-year.
How can you prevent synthetic identity fraud?
As previously mentioned, financial institutions, fintech apps, and trading platforms are the most common victims of synthetic identity fraud. For these businesses, there are several ways to fight against it.
Evaluate multiple sources of identification
Looking at multiple sources of data helps improve data accuracy. For example, Plaid looks at data source, documentary, and liveness.
Data source: Does the person know their basic personally identifiable information (PII)? Does it match an authoritative source?
Documentary: Does the person physically possess an authentic government-issued ID document?
Liveness: Can the person, using their mobile phone camera, follow a few instructions to prove they are a real person?
Leverage machine learning
In addition to verifying identity in multiple ways, Plaid runs a host of behind-the-scenes fraud checks to detect other flags that may indicate fraudulent activity.
Using sophisticated neural networks, while completing the steps above, Plaid can:
Use Optical Character Recognition (OCR) to confirm that the information included in the data source verification matches the information on the government-issued document.
Use facial matching to confirm that the face captured during the liveness test matches the photos on the government-issued ID document.
Use best-in-class selfie verification to confirm the person in the liveness check is real and not, for example, a printout of someone’s face. Plaid Identity Verification looks at factors like skin reflectivity, patterns seen on screens, signs of image manipulation, etc.
Confirm that the person has active online accounts, such as a valid email address, phone number, and social media accounts.
Use our proprietary Identity Verification Network Explorer to alert you to repeated ID verification attempts from a single IP address, device, and more.
Join an anti-fraud network
Anti-fraud networks are a collaborative anti-fraud effort between multiple institutions, including banks, fintech apps, and other stakeholders. By sharing data and resources, members of the network can mitigate fraud more effectively.
Beacon, Plaid's anti-fraud network, allows organizations to submit reports of fake identities and other types of fraud, and query against a large database of fraud reports. This helps institutions flag potentially fraudulent identities before they can commit fraud. Beacon also allows members to:
See if a user's identity data matches previous reports shared with Beacon.
Create automatic internal blocklists of fraudulent identities to prevent duplicate sign-up attempts.
Create custom Beacon programs to screen out identities on internal blocklists or from other members' fraud reports.
The future of synthetic identity fraud
Synthetic identity fraud is likely to continue growing in the coming years. Bad actors have access to increasingly sophisticated technology and more data than ever, lowering the barrier to entry.
To stay competitive and limit the risk of fraud, financial institutions, and fintech apps must remain at the forefront of fraud prevention. This means leveraging tools like robust identity verification, artificial intelligence and machine learning, and collaborating with other platforms through anti-fraud networks.
Ready to prevent synthetic identity fraud? Get started with Plaid Identity Verification or fill out the form below to speak with a Plaid representative.