Personal identity is a critical element of any marketing plan. But, what if the customer isn’t a real customer… or even a real person at all?
Identity theft is not new phenomena. But, newer tactics like synthetic identity theft — sometimes known as “frankenstein fraud” — are making it harder than ever to fight back.
Today, we’re taking a high-level look at synthetic identity fraud. We’ll see why it’s so effective, some of the tactics fraudsters use, and how AI is exacerbating the problem, but may also provide a solution.
[noun]/sin • THe • dik •ˌī • den •ˌtə •ˌdē • THeft/
Synthetic identity theft, sometimes known as synthetic identity fraud, occurs when cybercriminals combine stolen personal data to create new identities, then use those fake identities to commit fraud.
According to a report by TransUnion, synthetic identity fraud was the fastest growing form of fraud in 2024. A subset of identity fraud, synthetic identity theft is when a scammer combines stolen personally identifiable information (PII) with fabricated data to create new fake identities.
Starting with bits of real data as a base, fraudsters “invent” virtual identities by filling in the remaining details with either real information from other sources, or seemingly genuine (but made-up) data. They could also make use of any combination of the two. The synthesized ID can then be used to acquire credit, open bank accounts, steal tax refunds or government benefits, or even take out car loans or mortgages.
A typical synthetic attack could look something like this:
Essentially, the fraudster builds a fake person out of multiple parts from other identities. No wonder why some people have taken to describing these synthetic profiles as “frankenstein” identities.
That said, synthetic and traditional identity thieves have much the same goals: co-opting a victim’s PII for their own financial gain.
The fact that synthetic fraudsters don’t need all of a victim’s real information simplifies things for them. However, they still need to acquire a bit of PII, preferably from more than one source.
While tricks like phishing still work for this, that technique can be slow. Purchasing large batches of information off the dark web is usually more efficient. Personal data is plentiful and cheap, given that there were over 3000 data breaches in the US last year alone, exposing over a billion records.
While combining one or two of these factual elements can make a synthetic persona more realistic, some fraudsters don’t stop there. They may add complete backstories, including work, education, and credit histories. These can even be made public through fake social media accounts.
AI has provided synthetic fraudsters with a powerful tool. Deep fakes – computer generated pictures of the alleged consumer – can help bypass even more sophisticated identity validation methods.
That’s a basic rundown. For more information about synthetic fraud, continue on to the following chapters in the guide:
While it’s true there is no one person behind the identity, many of the data points being used come from actual human beings. That means thousands of dollars of debt could be connected to that number and come back to haunt the victim later. Even without liability for the stolen money, damage to that person’s credit rating could take years to overcome.
Children and elderly consumers are common targets. They can have their credit compromised, or even miss out on government benefits as a result. The merchants also lose goods sold to non-existent customers, and face other potential losses, such as chargeback fees.
Read MoreWhile it’s true there is no one person behind the identity, many of the data points being used come from actual human beings. That means thousands of dollars of debt could be connected to that number and come back to haunt the victim later. Even without liability for the stolen money, damage to that person’s credit rating could take years to overcome.
Children and elderly consumers are common targets. They can have their credit compromised, or even miss out on government benefits as a result. The merchants also lose goods sold to non-existent customers, and face other potential losses, such as chargeback fees.
Read MoreSynthetic credit fraud schemes are big business; exactly how big may not be known unless a criminal is caught.
Scammers have been known to use synthetic profiles to swindle millions of dollars from the federal government, commit bank fraud, and even defraud covid-19 relief programs. All told, millions of dollars are lost every year to some of the real-world scams we’ve outlined here.
Read MoreSynthetic identity fraud prevention is a must-have for deflecting financial crimes. Because the end result (a fraudulent purchase) is similar to other types of payment fraud, some of the techniques used to combat synthetic identity fraud are essentially the same as for any type of pre-transaction fraud.
Customer verification tactics like multi-factor authentication, CVV validation, and using the address verification service are basics. AI and machine learning are ideal for synthetic fraud detection, uncovering subtle trends and fraud patterns that less-sophisticated rules-based systems accept. It’s also important for you to stay current on the latest fraud trends, and keep your staff informed, too.
Read MoreEven under the best of conditions, consumer fraud is hard to detect and prevent. The combination of real and fake data means standard rules-based verification procedures often fail to detect them prior to purchases.
Naturally, there are a few red flags to watch out for. Beware of all the same things you check for with other suspected identity theft cases, along with other factors like a new or narrow online presence, or a number of credit cards with only minor differences, all going to the same shipping address.
Read More
One telltale warning sign that you may have been a victim of synthetic identity theft is if you discover a loan or credit line you didn’t apply for listed on one or more of your credit reports. If you receive calls, texts, emails, or letters about bank accounts or credit cards you didn’t open, that’s also an alarming warning sign. For merchants and financial institutions, inconsistencies in data traits or a conspicuous lack of social media activity can be a warning sign of synthetic identity fraud.
A fabricated identity combines real personally identifiable information (PII) from one or more identity theft victims with fake information, such as a name, date of birth, address, gender, ethnicity, or occupation. The result is a new, fake identity that scammers can use to commit financial, benefits, or tax refund fraud.
A sudden change or drop in your credit score, the presence of loans or credit cards you don’t recognize, or letters or other correspondence regarding bank accounts you didn’t open are all red flags that suggest you may have fallen victim to synthetic identity theft.
Consumers can regularly monitor their credit reports for signs of identity theft. Meanwhile, merchants and financial institutions can cross check public and private databases, review credit reports, search for social media profiles, and perform liveness checks to detect possible identity theft.
You can fight identity theft by filing a police report, submitting a report with the Federal Trade Commission (FTC) at www.identitytheft.gov, or by filing a complaint with the FBI's Internet Crime Complaint Center (IC3).
