Identity Theft and Synthetic Identity Fraud – Explanatory Blog by – Sree Mughi Chandrasekar

Introduction

There would have been several occasions where you’d have hesitated to post a certain picture in a social media platform worried about it giving out too much personal information be it your house, car or office space, why, even our faces! You might have hesitated about sending pictures of your ID cards even if it is for verification purposes. Well, honestly, in today’s world these would be considered preventive measures rather than unnecessary fear, well, all thanks to Identity Theft.

In this blog, you’ll be learning about Identity Theft, its types and examples, one specific subdomain of identity theft- Synthetic Identity Fraud, how these work and how to prevent them.

Identity Theft

Identity theft, just as the name suggests, is the process of stealing someone’s personal information such as their social security number, credit card details, name, address, pictures and others, and using the victim’s identity to perform illegal activities like unauthorized transaction, robbery, and other kinds of fraud. This could be for committing illegal activities for monetary, political or ideological purposes.

Recently, it has become very easy to steal such sensitive information digitally as a lot of activities involving such information have been digitalised like financial transactions, ID verifications, job applications and more. Hacking into social media accounts that have no multi-level security have become very easier and, social media accounts give away lots of sensitive information like name, job, pictures and others, hence leading to an easier ID theft.

Such hacking activities not only lead to personal information thefts but also other activities such as spreading scam messages, manipulating of the victim’s pictures (such as deepfakes) and commit various other malicious activities. Even though, these don’t fall under tradition identity theft umbrella of stealing sensitive information to commit malicious activities, these are still abusing and taking over the victim’s online identity. They could be considered under an evolved identity fraud domain, but either ways, these are serious cybercrimes. These could again be having various motives like monetary, revenge, or political purposes.

Anyone can be a victim of identity thefts, but children and older people are targeted more as they usually do not have any records attached to their personal information like social security number or their records are being maintained by someone else. Identity thieves can easily manipulate such records as there won’t be much obstacles. Once these identity thieves have even one of the personal information, they will be able to retrieve the other sensitive data. Often, victims don’t even realise such sensitive information has been stolen till they see signs.

Methods of Identity Theft

Moving on to the methods employed by identity thieves:

Physical Theft: This would be through dumpster diving, stealing your purse or wallet, mail theft, through institution or government records, etc.
Technology Theft: We had already discussed of a few ways, others would be through scamming and phishing, search the hard drives of stolen or discarded computers, access computer-based public records, stealing from corporate databases, wardriving, pharming, spywares, information-gathering-malwares and viruses, etc.
Social-engineering: Through surveys and contests, fake ID verifications, and fraudulent schemes.

Types of identity thefts

Financial Identity Theft: Using the victim’s personal information, the identity thieves get financial benefits like purchasing goods, obtaining credit and loans, and other services imitating the victim. This is the most common kind of identity theft.
Social Security Theft: By stealing one’s social security number, identity thieves can apply for credit cards and loans for free, and is used for other purposes like employment verification, tax reporting, and government benefits.
Criminal Identity Theft: When criminals identify themselves as some other person when getting arrested or when they commit crimes while impersonating someone else through fake documents which leads no arrest warrants or summons in their real name.
Synthetic Identities: Here identity thieves create partially accurate identities using some stolen and some fake information. This causes them to create an entirely new few file in credit bureau, hence, getting unlimited credit from creditors as it is not easy to track them. This kind of identity threat is on rise now.
Medical identity theft: This is when an identity thief poses as the victim to get free medical care. Insurance ID theft is also very common here as identity thieves can get free medical care and exploit one’s insurance if they have the insurance card and insurance information.
Child Identity Theft: Here, a minor’s personal information, especially name and social security number is stolen and exploited by the identity thieves for various kinds of personal gain like buying houses, getting loans, etc. Since children’s social security number usually doesn’t have such information attached, it is easier for the identity thieves to start a new record. Such fraud goes undetected for many years, and is usually found when the child becomes a major. Usually, such identity thefts are committed by the people close to the children like relatives, family friends, etc.
Tax Identity Theft: Here, the identity thieves exploit the victim’s identity for financial gain. By falsely reporting income and potentially creating a tax refund, the thief is attempting to benefit from the fraudulent activity while shifting the negative consequences onto the victim.

Now that we’ve explored various forms of identity theft, let’s delve into their impacts, financial and social security identity theft cause mostly financial loses to the victim. Criminal identity theft would be causing lots of issues to the victim, as they would have to prove that they didn’t commit the crime using witnesses or other methods to get out of the crime, even if they prove they are clean, some organisations might not update it, which will cause their false criminal record to resurface during future background checks. Synthetic identities primarily affect the creditors who extend credit based on the fake identity, it might cause problems to the victim if their credit file gets linked to the victim due to the similarities some important personal information.

Medical identity theft would again be harmful, why, even lethal sometimes, as the identity thieves’ medical records get registered into the victim’s medical history, the doctors might give wrong medical procedures or prescription based on this manipulated medical record. Child identity theft, even though, will not give major issues when the children stay minors, when the children become adults they will have to face the negative consequences of the identity thieves. Tax identity theft victims may face audits, investigations, and penalties from tax authorities as there will be two sources for their tax returns, one legitimate (the victim’s) and one illegitimate (the identity thief’s). Overall, victims of any form of identity theft can face financial losses, emotional distress, legal issues, and significant time and effort spent resolving the aftermath.

Warning signs

Change in credit or debit scores,
Receiving new credit cards that you did not apply for,
Receiving notifications regarding debt collections when you should be having a good credit yourself,
Unauthorized withdrawals from your bank account,
Getting charged for purchases you didn’t make,
Tax authority notices indicating other employers you did not work for,
Not being able to use your social security number for specific verification process because it’s already on use,
Court summons or arrest warrants or criminal activities registered on your name even though you have not committed any crime,
Insurance claims or payments, or payments for doctor visits that were not by you may indicate that someone else is using your medical services,
Your shipments getting reshipped to another location or your mail arriving late may indicate someone else monitoring these activities.

Action Steps

That is why, it is always important to take immediate actions when you get notifications or calls regarding activities you did not perform or if certain authorities find suspicious activities in your account. If you get the above warning signs, investigate and if you find that a personal information theft has occurred, immediately file a report with the police and other authorities concerned with ID theft like the Federal Trade Commission in USA. Immediately contact the companies involved with this specific field like your bank in case of financial identity theft and freeze your bank accounts, contact your hospital, and health insurance providers and let them know in case of medical identity theft.

There are several identity theft protection services both in forms of websites or offices where they provide preventive measures and help mitigate the consequences of such fraudulent activities in case it happens. They watch your credit statements and other records and notify immediately if there is a change breaking the routine or if there are any suspicious activities, but these services should be chosen with care.

Synthetic Identity Theft:

Moving on to a specific subdomain of identity theft – Synthetic Identity Fraud.

We already know that, Synthetic Identity Theft is a type of identity theft where fraudsters combine legitimate stolen personal information along with some fabricated information to create a fake ID. They usually use this fraudulent ID to receive credit from creditors who extend credit based on the fraudulent identity and to perform other criminal activities. This mostly only affects the creditors, but sometimes the victim of the stolen information gets affected if this fabricated identity gets linked to theirs due to the similarities in their personal information. But still, once any of your personal information is vulnerable, you’d become a target for other kinds of ID thefts too. Synthetic identity fraud is becoming one of the most common ID theft.

Usually when creating synthetic identities, the identity thieves use a stolen potentially legit SSN (Social Security Number) along with partially fabricated or multiple individuals’ identifiable information like name, address and date of birth.

Sometimes, these identity fakers act as a victim, as the profile contains some real and some fabricated information- making a deceptive profile, which they use as a ploy to evade consequences when caught. But, sometimes illegal immigrants, since they lack a SSN, they use a fabricated or legitimate stolen SSN to create a fake ID to obtain financial benefits, they do not intend to steal money.

Synthetic identities can be created through two ways:

Manipulated Synthetics: Fraudsters fabricate some of the information in a real identity to create the synthetic identity. This could be for good or bad intentions, like illegal immigrants or people in need who have a bad credit score may attempt this to open a new credit file with the intention of paying back or it could be for stealing money and committing fraud.

But, this kind of fraud is identifiable, as the victim’s identity and this fraudulent identity will be having collisions on the shared personal information.

Manufactured Synthetics: This synthetic identity is also called as Frankenstein identity as here; the identity thieves combine the different parts of Personally Identifiable Information (PII) of multiple individuals into one fabricated identity. These frauds are hard to track outside organisations comparatively since the personal information on the fake ID card look potentially legit, even though they don’t match with one another. But recently, fraudsters have turned to using invalid SSNs that are from the same range as legit SSNs. And they use PIIs of people who are not customers of the organisations they are committing fraud from, hence no collisions. This recent kind of fraud is very hard to track.

Dangers of Synthetic Identity Fraud:

Detection of this theft is very hard as when they apply for credit, they would seem like customers with real identity. And since, in most cases it doesn’t directly affect the customer, there’s no one to alert the organisation. This would lead to:

Fraudsters have these accounts open for years which helps them rack up high credit scores which they will steal when they get the opportunity and escape with no trace to track them.
And, without enough evidence, these activities are labelled as credit-related issues, hence letting the fraudsters escape without facing their consequences, while banks face the losses.

Preventive measures for Identity Theft and Synthetic Identity Theft:

Watch your credit reports and billing statements vigilantly.
Secure your SSN and other documents at home, do not carry them outside.
Monitor your medical records.
Freeze your credit if possible as this will prevent opening new credit accounts.
Use strong passwords and multi-layer security like two-step authentication.
Be careful not to get phished or scammed.
Use alerts to notify you of any medical and financial activities performed on your name.
Always collect your mail on time.
Shred any documents or old cards that give away your personal information before disposal.
Use strong antivirus softwares on your mobile, computer, and other network and communication devices to prevent sensitive data breach.
Use digital wallets that provide encrypted online transaction with other security measures.

Also, for specifically Synthetic Identity Fraud, since financial organisations get affected the most, they should connect with other industries to analyse the identity theft trends and behavioural patterns to build a defence mechanism that is built by focussing on the core patterns of ID theft. Using such a defence will be able to protect even when the the trends changes.

Famous ID Theft Cases:

In 2010, Nicole McCabe was framed for assassination of Mahmoud Al-Mabhouh, a Hamas leader, in Dubai. Her identity was allegedly stolen by the assassination squad, the Israeli Intelligence Agency, Mossad along with others from Australia, UK, Germany, and Ireland. But due to immediate reporting of ID theft, she was let go eventually.
Kenneth Gibson, who was an IT professional from 2012 – 17, created a software that would create fake PayPal accounts from the personal data available in his company’s databases. He managed to create over 8000 accounts and, he ended up stealing 3.5 million dollars from his victims.

Conclusion:

All kinds of identity thefts are on rise, it’s very important that we stay vigilant and investigate any change-of-pattern activities immediately. It is also important we do everything we can to prevent such fraud from happening by securing our personal information as much as possible. By staying responsible, law-abiding citizens, and spreading awareness, we contribute in defending againt these fraudulent activities. We can count on our researchers to keep finding effective ways to stop these fraudulent schemes.

References:

Blog, Fraud id, Identity Theft, knowledgesteez

Home » Blog » Identity Theft and Synthetic Identity Fraud – Explanatory Blog by – Sree Mughi Chandrasekar

Hritika Malhotra

All Posts »