Synthetic IDs: To Stop Them, Know How to Build Them
This is part two of our series on Synthetic ID’s. For part one: check out Intro to Synthetic ID’s From a Former FBI Fraud Fighter
Understand Your Options
“Geez, Kevin – thanks a million. Now I’m scared as all get-out about the multiple ways Synthetic ID’s can be used to drain my business. How do I to stop them?”
One of the best things you can do is hire a fraud consultant who can get in your business, evaluate your current fraud controls, and tailor methods for detection and prevention to your processes. I’m talking about the techniques that are not revealed in a public forum because, apparently, criminals can read. Of course, a fraud consultant is not cheap, but less costly than what the fraud will cost you. Therefore, their expertise is worth the investment.
On the other hand, the worst thing you can do – and, unfortunately, the most popular – is pretend the threat to your business doesn’t exist. This method is as effective as sticking your fingers in your ears and singing “la la la la” to drown out something you don’t want to hear.
So in-between the options of getting tailored, expert help or doing nothing, there is a friendly arena of generic things everyone can do to at least get a good start on stopping Synthetic ID fraud. And to understand what to look for, you need to have a good grasp of how a Synthetic ID is forged (pardon the double meaning).
High Level: How to Build a Synthetic ID
A quick recap on the overall lifecyle of a Synthetic ID, then we’ll get to the nitty-gritty.
- A Synthetic ID is usually “born” when a fraudster obtains a legitimate social security number (ssn) on the open or dark web. The ssn often belongs to a minor, and any fudging around with the credit and credit history is unlikely to be noticed since parents rarely check their children’s credit reports (where an astute observer might see a credit inquiry from, say, a credit card company for their 6-year old child; note to self!).
- The fraudster then builds a complete persona around this ssn, including a name, older date of birth, address (usually a commercial mail receiving agency (CMRA) such as UPS or Mailboxes, Etc.), employment, and so on.
- Now the work of “growing” begins. The Synthetic ID applies for credit and gets denied. But since the denial creates a credit report record of the new “individual,” the fraudster can now build a credit file and history (this can be done as quickly as 60 days, but it’s usually much slower for mortgages since a credit history of less than two years will be flagged by most fraud prevention software). This is the detailed area we’ll get into in a minute.
- Finally, when the ID is “full grown” with sufficient tradelines and a stellar credit score, the fraudster uses it to cash out on credit card bust outs, fraudulent auto loans, or even mortgages. Once the fraud is discovered, this burns the Synthetic ID, which is now officially “dead.”
Deeper Dive: How to Build a Synthetic ID
So, now to the nitty-gritty.
The way our credit system works in America, you have to have credit to get credit. And if you don’t have credit and still want it, you can either get secured credit (where you essentially borrow from yourself – through another company that will report your repayments to the credit bureaus – at a really high interest rate), or you need to share credit with someone who already has it so you can build up that valued credit history. Enter the “Authorized user.”
Here’s where the fraudsters go to work. They take their baby Synthetic ID, after it’s been denied credit the first time, and attach it as an Authorized User to other people’s tradelines (note: there are other methods, but this is the one most commonly employed). This can be done to an unwitting person’s credit, via sales of hacked data on the dark web, to witting parties who “rent” out their tradelines via credit-repair services, or to other Synthetic ID’s. The latter two options are preferred since there’s less chance of getting caught when you have a co-conspirator instead of a victim.
After doing this a few times, and building up the Synthetic ID’s history, the fraudster can now successfully apply for credit, make small purchases with proper repayments, and very quickly bump up the credit score to the high 700s.
How This Helps You Spot a Synthetic ID
Knowing how a Synthetic ID is built gives you a nice reverse-engineering approach to understanding how to spot one. And it starts, as you can imagine, with a careful review of the persona’s credit report. Since a great many people start their credit history as an authorized user, that alone is insufficient to suspect foul play. But consider three things that will help an astute observer: most people start building their credit history in their mid-teens to early-twenties, most do so as an authorized user on a family member’s tradelines, and most credit is built gradually.
“Ah,” you say, as the wheels begin to turn…” so if the fraudster created an older persona with a minor’s ssn, and my fancy-shmancy fraud software tells me the ssn was issued much more recently than the reported birth date on the 1003,”… keep going…”and the credit-originating tradelines with authorized users begins at, say, the persona’s mid-twenties or thirties or later,”… you’re on the right track…”and the people whose credit the persona was attached to as an authorized user do not appear to be family members,”… you’re getting there!…”and they had a sudden increase in new credit tradelines and credit limits”…. yes, yes?…”then I definitely have a Synthetic ID!!”
Sigh. No. Not quite. It’s possible that your borrower is newly arrived to the US, or had friends instead of family members help with the credit-building process, or you’re confusing maiden and married names, or they’re getting ready to get married and need higher limits for the wedding and honeymoon. Let’s just say you were right up until the point when you said “definitely.” The truth is, if the above scenario holds true, what you have is a really strong suspicion, even a probability, that you’re dealing with a Synthetic ID. And it’s a quick way to set up an initial filter.
But you’re going to need more verification, much more, before you can deny the loan for fraud. Part 3 of this series will discuss some key ways to identify Synthetic ID’s, so tune in next week!