Think of it as the “Frankenstein” of fraud [ed. note: frankenfraud — sorry, couldn’t resist]: A criminal actor steals bits and pieces of personal data from real people — say, a child’s Social Security number, the home address of someone currently incarcerated, the birth date of a recently deceased person — then cobbles them all together to create an all-new fake identity.

This fabricated person then applies for credit cards and loans, slowly builds up credit, racks up purchases, maxes out all their accounts — then absconds.

It’s less colorfully known as synthetic identity fraud, and it is growing to record levels, according to a new TransUnion report released today. According to the leading credit bureau, U.S. lender exposure to synthetic identities now stands at $2.9 billion.

“Synthetic fraud is continuing to grow year after year,” Jason Lord, VP of product marketing for fraud and identity solutions at TransUnion, told SDxCentral.

And because it is so realistic, consisting of many parts and highly undetectable, “once synthetic fraud is through the door, it’s nearly impossible to root out,” he said.

Drastic increase in digital fraud volume

According to the report, synthetic identities have access to $2.9 billion in auto loans, bank credit cards, retail credit cards and unsecured personal loans in the U.S.

Auto loans, notably, comprise more than 60% of total exposure to synthetic identities — $1.8 billion in the first half of 2023 — representing a 38% year-over-year growth. That is followed by bank credit cards ($994 million), retail cards ($126 million) and unsecured personal loans ($57 million).

Meanwhile, the personally identifiable information (PII) used to fabricate a person or entity to exploit for personal or financial gain is typically sourced via digital fraud and data breaches, which are both on the rise.

Lord points out that there has been a 382% increase in digital fraud volume since the pandemic (due largely to the near-overnight move to digital).

Among all industries, the suspected digital fraud rate stands at 5.3%, up from 4.5% one year ago. In the first half of 2023, telecommunications had one of the highest rates of global digital fraud attempts (at 5.3%), the top fraud type being credit cards.

SSNs, IDs, account numbers up for grabs

Not surprisingly, due to the copious sensitive data they contain, the industries with the most severe data breaches include insurance, legal and financial services, according to TransUnion.

Names continue to be the most exposed individual credential, followed by Social Security numbers (SSNs), which were exposed in 69% of breaches (up from 60% last year). Driver’s licenses or other state identifications were exposed in 31% of breaches in the first half of 2023 (up from 14%) and exposure for checking or savings account numbers also doubled year over year, according to TransUnion.

Lord noted that today, data stealing has become a commercial enterprise, with fraudsters turning around and selling to other fraudsters. He pointed out that data breaches “are specifically for the data. The data is not necessarily used in that same industry.”

Fraudsters are patient, orgs aren’t incentivized

Once fraudsters piece together their fake identities, they build up their credit over time, usually starting with a low-barrier-to-entry card (such as those catering to low-income earners, people without credit, or students, for example), Lord explained.

They then continually qualify, apply for and are granted more cards, lines of credit and auto and even house loans. Sometimes they might have up to 50 identities attached to the same line of credit, Lord said.

As he put it, “fraudsters are very patient. Eventually, somewhere between 5 to 10 years, they will bust out.”

Meaning: They will max out all their lines of credit and disappear — and there’s no actual person to follow up on, so the lender simply loses out.

So why do they so often go undetected?

Financial institutions typically do simple individual identity checks — “Is this address real?” “Is the SSN real?” — Lord explained, particularly in instances of lower-risk accounts. Then, once that fake person is in the system, a credit bureau or DMV/RMV will consider them real as far as public record is concerned. When they have a credit history score, “there’s no reason to think they don't exist,” Lord said.

Unfortunately, organizations have not put the rigor required into addressing the issue, he noted. They often do not have the adequate tools to stop synthetic fraud, and they may not be incentivized to root it out or prevent it. As long as it’s making money for them, “they themselves are not feeling the pain of it.”

Call centers increasingly at risk

But organizations can’t simply continue to ignore the issue, Lord said.

Financial institutions need strong identity-proofing tools in place that are multithreaded and go beyond identifying data individually. Any single tool just used by itself is a liability, Lord said. Fraud must be looked at from different angles and in multiple steps, combining online, offline and device-based data, as well as checks and verifications of critical data such as tradelines (accounts on a credit report) and SSNs.

For instance, fraudsters use artificial intelligence (AI) tools that can “pixel-perfect fake a document,” Lord said. So, if an organization is just using a visual inspection tool, they’re at greater risk for fraud. Similarly, biometrics can be used to fake voices querying call centers.

Lord pointed out that 60% of fraud begins in the call center, with fraudsters manipulating interactive voice response or human agents into revealing personal information that they can then use for account-takeover fraud. This can be prevented through the use of advanced tools such as forensic line inspection to determine if a call is VOIP or caller ID spoofing.

Geolocation can also help determine whether a caller’s behavior matches where the call originated from. Other tools can establish device reputation (if it has been associated with fraud in the past) or whether it was recently activated and could be a “burner” phone.

Verify, but don’t create friction

Moving ahead, organizations should always be testing new fraud prevention tools, Lord said.

“A lot of fraud systems were put in place maybe over 10 years ago and have not been re-examined,” he noted. “Fraudsters know this and they take advantage of those systems.”

Just as critically, tools shouldn’t create unnecessary friction. They should be used to flag a small minority of calls that could be fraudulent, and those can then be routed to a fraud agent.

“It’s important that you only do this to a minimum of calls, you don't apply it to all calls,” Lord said.

This is because organizations don’t want to put themselves in a situation where they’re creating false positives in which “legitimate consumers are getting caught up in the net of moving forward.”

For instance, if a customer’s out for a nice meal and their credit card gets declined; they then have to spend an undue amount of time on the phone trying to prove they are who they say they are — experiences like those will make them want to go elsewhere.

In the end, he noted, “having better signals on interactions helps not only prevent fraud, but gets the best consumers through faster.”