Synthetic Identity Fraud (SIF) is fraud involving the use of a fictitious identity. Fraudsters typically create false or “synthetic” identities by combining stolen or fictitious Social Security Numbers (SSNs) with false personal information. They create these new identities for a variety of reasons, such as obtaining credit cards and loans, opening deposit accounts, and obtaining driver's licenses and passports.

El SIF es significativamente diferente del fraude de identidad tradicional. En el fraude de identidad tradicional, un estafador se hace pasar por otra persona real y utiliza su crédito. El fraude de identidad tradicional suele denunciarse con relativa rapidez, ya que la mayoría de las víctimas se dan cuenta cuando se realizan transacciones no autorizadas en sus cuentas. El SIF, en cambio, puede pasar desapercibido durante meses o años, ya que no hay una víctima inmediata.

Typically, fraudsters will use a real Social Security number (SSN) and pair it with a name not associated with that number. Synthetic identities are often constructed using stolen SSNs belonging to children since they have been issued since 2011 and the fraudulent use of their SSNs probably won’t be discovered for years — until the legitimate SSN owner is applying for credit or employment sometime in the future. Children’s SSNs are 51 times more likely to be used in synthetic fraud schemes than adults. More than one million children were victims of identity theft or fraud, including SIF, in a single year.  When a child whose SSN has been compromised becomes “credit active”, they will face an uphill battle proving:

a) que el SSN les pertenece realmente; y

b) que no era la persona a la que se le imputaron las actividades.

Although used less frequently than children’s SSNs, fraudsters may also use SSNs of elderly people, people in prison, homeless people, and sometimes even people who are deceased. In other cases, a fraudster may create a completely fake identity with a non-existent SSN, name, date of birth, and address.

Algunos estafadores toman medidas adicionales para que sus identidades sintéticas parezcan legítimas. Solicitan números de teléfono, crean cuentas de correo electrónico y de redes sociales, son activos en las redes sociales utilizando sus identidades sintéticas y, en algunos casos, piratean y añaden sus identidades sintéticas a las bases de datos públicas utilizadas por las instituciones financieras para verificar la información de identidad.

En algunos casos, los estafadores pueden crear una empresa artificial. Una vez creada la empresa, el defraudador crea identidades falsas para los empleados.

Applying for credit at a bank - Once the fraudster has created a synthetic identity, they apply for credit at a bank. Since there is no credit history, they will generally be turned down the first time, but by applying, a credit profile is created for the synthetic identity. The fraudster then applies to other lenders until one of them approves them for a small amount of credit. As an example, they may get a credit card with a limit of $500. They use the credit card for a few months, paying it off each month, to establish good credit. They will then apply for credit cards with higher limits or other types of credit.

Piggybacking on a legitimate account - Fraudsters actively recruit credit card holders with good credit to add an authorized user to their account. This authorized user is a synthetic identity. The fraudster doesn’t attempt to use the synthetic identity while piggybacking. They just let it sit idle for 2-3 months. This gives the credit reporting agencies time to report on the credit of the synthetic authorized user, and the credit rating they receive is generally based on the credit rating of the credit card holder. Once the synthetic identity has received a favorable credit rating, the fraudster will remove it from the account of the original credit card holder and will use the synthetic identity to apply for its own credit cards and loans.

The Pay-Off - Fraudsters may use their synthetic identities’ bank accounts, credit cards and loans responsibly for months or even years in order to build up their credit score and history. After paying off balances regularly over a period of time, their credit score improves and they can apply for a higher credit limit. At a certain point, they max out the credit cards and loans with no intention of repaying them. This is known as credit bust-out fraud or sleeper fraud.

Algunos defraudadores utilizan sus identidades sintéticas para "reventar" más de una vez. Llevan al máximo las tarjetas de crédito y los préstamos de sus identidades sintéticas, y luego alegan que fueron objeto de un robo de identidad para convencer a las instituciones financieras de que anulen los cargos y reabran las líneas de crédito.

Being patient and playing the long game can be very lucrative for fraudsters. One fraud ring in New Jersey built up 7,000 credit profiles in a scheme that created over $200 million in fraud losses.

Conozca a su cliente (KYC) es un término general utilizado para la verificación de la identidad de los clientes antes de desarrollar cualquier relación comercial con ellos. Para cumplir con las leyes de CSC, las instituciones financieras (y otras) están obligadas a desarrollar procesos de identificación de clientes y a verificar a sus clientes de forma regular.

Las comprobaciones KYC son un punto de partida, pero a menudo existen lagunas en los protocolos KYC de los prestamistas. Un estudio reciente descubrió que solo la mitad de las solicitudes de crédito con identidad sintética se realizaban en línea, lo que indica que un número importante de defraudadores son capaces de pasar las comprobaciones KYC incluso cuando presentan la solicitud en persona.

Between weak KYC protocols and traditional, manual processing procedures, once accounts are opened, synthetic identities can go undetected for months or years. To complicate matters further, synthetic identity profiles generally have strong credit scores, so there tend to be fewer red flags during credit underwriting and credit checks.

Hay una serie de banderas rojas a las que hay que prestar atención mientras se procesan las solicitudes de crédito o se supervisa la actividad de los clientes. Algunas pueden identificarse manualmente; otras pueden requerir procesos de análisis de enlaces o sistemas de análisis de fraude. Centrarse en una sola característica puede dar lugar a falsos positivos o a la identificación errónea de ciertos tipos de clientes legítimos, como los inmigrantes recientes con un historial crediticio corto. Es importante buscar entre múltiples características y fuentes de datos para identificar las identidades sintéticas.

The Social Security Administration (SSA) recently launched a new service, electronic Consent Based Social Security Number Verification (eCBSV), for financial institutions to help with fraud protection data. eCBSV allows financial institutions to verify if an individual’s SSN, name, and date of birth combination match Social Security records. The SSA introduced the original Consent Based Social Security Number Verification (CBSV) service in 2008. This service enables paid subscribers, upon written consent from the SSN holder, to verify that a name, SSN, and date of birth combination matches (or does not match) the SSA’s records. However, this service is paper-based and does not offer real-time verification.

The fee-based eCBSV works largely the same way as the original service, but will allow individuals to provide consent electronically rather than with a “wet” signature, and will allow financial institutions to validate the information in real-time.  eCBSV returns a match verification of “Yes” or “No.” If its records show that the SSN holder is deceased, eCBSV returns a death indicator. The eCBSV service only allows for customer information validation for new accounts.  

The service was initially rolled out to select institutions in June 2020 and is being made available to more financial institutions from 2021 on.

En un reciente foro de la Oficina de Rendición de Cuentas del Gobierno (GAO), los expertos en la materia destacaron la importancia de compartir información, tanto a nivel interno como en el sector de los pagos.

Within your company - It is recommended that financial institutions work to break down internal barriers to facilitate sharing of information across product lines. Synthetic identity fraudsters usually open multiple accounts at the same institution. If a synthetic identity has a credit card, it may also have a direct deposit account, car loan, mortgage, and/or line of credit. If the identity busts out on one account, it is likely to bust out on other accounts around the same time. Connecting all accounts owned by the same synthetic identity helps minimize losses.

Among financial institutions - Section 314(b) of the USA Patriot Act allows participating financial institutions to share customer information with one another in support of their own due diligence, compliance, and reporting requirements. Section 314(b) also allows for sharing of information that relates to money laundering and terrorism. Some instances of SIF may be for these purposes, but it is a bit of a legal gray area.

Hable con su asesor legal antes de compartir la información de identidad sintética sospechosa fuera de su empresa.