Synthetic Identity Fraud: How It Works and How Institutions Can Catch It

Fraudsters keep finding new methods, and synthetic identity theft has become one of the more worrying ones, above all for fintech firms in Southeast Asia. Reports suggest that six out of ten banks in the region have been hit by synthetic fraud, and Aite Group forecast that losses from it would climb to USD $2.42 billion by the end of the year.

A person who never existed

In a synthetic identity scheme, the criminal does not take over someone else's identity wholesale. Instead, real details belonging to different people are combined with invented ones to build a brand-new individual. Because this made-up person carries enough information that can be verified, it looks credible. The fraudster can then use it to open a bank account, run up credit card transactions, cheat merchants and government agencies, and deceive financial institutions.

The stolen pieces are fragments rather than a complete profile: a social security number, driver's licence details, a date of birth and similar items. Mixed with fabricated data, they give rise to someone whose only reason to exist is to commit fraud and other financial crimes.

A simple case shows the mechanics. Criminal X uses social engineering, phishing or other underhanded tactics to get hold of Person Y's driver's licence details or some comparable piece of sensitive data. X does not pretend to be Y. X builds Identity Z around those details, adding other personal information. Since Z rests on verifiable data such as a social security number and a licence, X can present Z as a real, living person and use Z for almost any kind of transaction.

Why it is harder to stop than ordinary identity theft

Three features make synthetic fraud more difficult to deal with:

• No real consumer is there to notice and warn the authorities, so the fraud usually goes unreported.
• The information involved tends to be "clean", with no crimes or history of wrongdoing linked to it.
• The scheme unfolds slowly and mimics the way people normally transact, so it avoids being flagged as suspicious.

Typically the fraudsters let the invented identity "mature". It takes out a small loan, makes a modest purchase, and so on. Over time this activity gives the identity legitimacy, until it can be used for much larger transactions. At that point the criminals walk away without paying and escape without consequence. Conventional checks almost never catch synthetic identity fraud at the application stage, which probably explains why criminals are turning to it more often.

Because no individual is harmed directly, the losses fall on financial institutions and service providers, which can absorb large and frequent hits over a long period. With no paper trail leading to a real person, these institutions are often left trying to recover what they lost, frequently without even identifying the criminals.

What prevention involves

The costs can mount quickly. Pymnts, citing a recent study, reported that financial institutions lost USD $20 billion to synthetic identity fraud in 2020, and that the typical sum taken before the fraud was detected ranged from USD $81,000 to USD $97,000. Since 2020 the technique has only become more sophisticated and far more common.

Organisations therefore need rigorous controls, although there is no single fix for a problem this complex. Prevention calls for a holistic approach with several strands, all aimed at confirming that every identity is legitimate.

Manual review is one option, as long as it is supported by suitable tools. Ekata's Pro Insight is one example: a tool for manual reviews that lets organisations investigate identities with less time, effort and resources. The stronger route is identity verification and fraud prevention technology, which together can cut customer waiting times and shorten reviews while improving them. Those are the results institutions want from their anti-fraud work, and they depend on technology.

Several vendors supply such technology. Ekata, a Mastercard company that helps businesses offer smooth experiences and fight identity fraud around the world, provides risk insights powered by the Ekata Identity Engine. The engine draws on two separate and mutually exclusive data sources, the Ekata Identity Graph and the Ekata Identity Network. Ekata uses both because it checks whether the identity elements are valid and also looks at how those elements interact and behave in digital transactions.

The underlying difficulty is that enterprises rarely go beyond matching documents, and they seldom examine how the digital elements of an identity are linked. According to Ekata, its approach relies on a broad range of data and on insight into those links between identity elements, which is what allows its customers to judge an identity with greater certainty and to detect and fight synthetic identity theft.