What is a synthetic identity?
Synthetic identity is a form of identity created by combining real and fake information to fabricate a new, non-existent person. Unlike traditional identity theft, where a thief steals and uses someone's actual identity, synthetic identity involves piecing together different elements of various identities to construct an entirely new persona. The Deloitte Center for Financial Services projects that synthetic identity fraud will generate at least $23 billion in losses!
What is synthetic identity fraud?
When these “fake” AI-generated identities are used to commit financial crimes by targeting financial institutions, government agencies, and businesses, it is called synthetic identity fraud.
Synthetic identity is a dangerous form of identity fraud that has the whole world in a chokehold.
Here’s a real-life example. Recently, in Toronto, Canada, 9 people were arrested for using more than 680 fake synthetic identities! They used these to open hundreds of bank accounts and credit accounts, causing damages worth $4 million.
Key factors contributing to the rise of synthetic identity fraud:
Synthetic identity fraud is the fastest growing crime in the USA, accounting for over 80% of all new account frauds. This surge can be mainly attributed to:
Rapid rise of inexpensive generative AI services: This has made generating highly realistic images, documents, and videos incredibly easy.
New age industry: AI is a relatively new industry with impacts still being understood.
Regulatory Gaps: The industry remains largely unregulated, providing opportunities for misuse. This lack of oversight allows malicious actors to exploit AI and escape synthetic identity fraud detection.
A basic understanding of AI: Anyone with internet access can leverage AI tools to fabricate digital identities. Even individuals with a basic understanding of AI can manipulate these tools to create convincing synthetic identities.
Higher difficulty in synthetic identity fraud detection: Synthetic fraud is much more damaging and has a lesser chance of being detected because of the “blend” of true and false information. The elements of true identities are enough to bypass basic scrutiny during onboarding on various fintech platforms. Credit agencies, especially, see these identities as individuals with “no previous credit.”
Here’s a snapshot of how different industries are impacted because of synthetic identity fraud:
Banking and other financial industries
Synthetic identities are used to open bank accounts that can facilitate money laundering via mule accounts, fraudulent transactions, and other illicit activities. Fraudsters use synthetic identities to apply for credit cards, loans, and lines of credit.
By initially making small payments, they build a credit history, and then default on larger loans. A significant ploy of fraudsters is to nurture these synthetic identities over time to create a strong credit profile, leading to significant financial losses when the AI-generated identity is eventually used for major fraudulent activity.
A report by Point Predictive says, the auto-lending sector has seen the harshest impact of this fraud, with a massive 98% increase in the growth of synthetic identity fraud attempts.
Health care and insurance
Synthetic identities are used to obtain medical treatments, prescriptions, and drugs fraudulently, leading to financial losses for healthcare providers and insurers.
Additionally, fraudulent insurance claims are made using synthetic identities, increasing the overall cost of healthcare and insurance premiums.
Welfare and social services
Synthetic identities are used to apply for welfare benefits, unemployment benefits, and other social services, diverting funds from legitimate recipients.
It’s also used for fraudulent applications for housing assistance and subsidies, lead to improper allocation of resources.
Gig economy
Synthetic identities are created to access gig economy platforms like ride-sharing, freelancing, and delivery services. These can be used to manipulate ratings and reviews, impacting the trustworthiness and reliability of the platform.
eCommerce
Synthetic identities are often used to make online purchases with stolen or fabricated payment methods, resulting in financial losses for retailers. Fraudsters exploit return policies or sign up for subscription services with no intention of paying after trial periods.
Related read: Unravelling the different types of fraud across different stages of a digital journey
Creation of a synthetic identity - A step by step process
Let's dive into the process:
1. Sourcing data
To begin, a fraudster first needs to source some “real” personal data. This is obtained via elaborate data breaches and the sale of these data on the dark web. Here is an interesting take on how the dark web has allowed mule accounts to thrive.
This real data provides legitimacy to the synthetic identity.
2. Building the ‘Frankenstein’ identity
Fraudsters now need to “create” an identity that will escape identity verification scrutiny. This could show up in 3 ways:
Combining real and fake information. For example, a real Social Security Nnumber might be paired with a fabricated name and date of birth.
Creating entirely fake documents (driver’s licenses, social security cards) that support the synthetic identity.
Modifying real information slightly to create new, unique identifiers that don’t match the original data perfectly.
3. Ensuring specific data points have signs of life that help build legitimacy
The fraudster now has an identity. Great. But it isn’t enough. The devastating impact of a synthetic identity comes from tiny little things that give it ‘life’. Here are some things that a fraudster does additionally that can liven up the identity.
- Creating fake social media websites with basic interactions. The idea is to match the location of the posts and stories to the mentioned location of the “residential proof.”
- They give the identity an employment history that can easily explain large gaps, inconsistencies or a lack of documentation. Think of industries like the gig economy, freelancers, etc.
- The identity needs to escape scrutiny about their familial ecosystem. Which means, let’s make them an orphan. Divorced? Single child? And so on.
- They focus on their hardware, too. They can use VPNs to hide their actual IP addresses, use different browsers to mask their trail, use multiple SIM cards to receive verification messages, or simply use apps that can generate fake phone numbers like Burner here.
- The internet also makes it easy to fabricate other qualities of this person. Fake persona generators will choose hobbies and jobs that seem in sync.
- Generative adversarial networks (GANs) are the crux of a synthetic identity. These are websites that use algorithms to generate extremely life-like AI photos. These help bypass biometric authentication and basic liveness detection measures. The website “https://this-person-does-not-exist.com/en” was the first of its kind. Here it is in action!
P.S. A GAN is a neural network that trains its algorithm on huge datasets of real images to create new hyper-realistic images. Read more about how GAN works here.
Data breaches and the dark web provide the raw materials, while blending and manipulating data ensure these synthetic identities can pass various forms of scrutiny making this type of fraud one of the hardest to detect and prevent in the global financial ecosystem!
At Bureau, we leverage AI-powered behavioral biometrics, device intelligence, device fingerprint, network intelligence and alternate data signals to successfully stop synthetic identities from gaining access to financial services.
