The New Currency: Identity
In today’s digital age, identity has become the new currency. Trust is no longer confined to the protection of financial assets, it now extends to the safeguarding of personal identities. As more consumers conduct their lives online, financial institutions are realizing that protecting a customer’s identity is just as critical as securing their money.
Synthetic Identity Fraud
In this increasingly digitized world, fraudsters are constantly finding new ways to exploit vulnerabilities in financial systems. One such method that has gained significant traction is synthetic identity fraud. This form of fraud involves fabricating an identity by combining real personal information with fictional details, creating a new identity that can slip through the cracks of various verification processes. Unlike traditional identity theft, where a criminal steals and uses someone’s complete identity, synthetic identity fraud involves piecing together a new persona that isn’t directly tied to a real individual. This makes it harder for victims and authorities to detect the fraud, as no single person’s identity has been entirely compromised.
How Synthetic Identities Are Created
The process usually begins by obtaining a real government identity card number such as PAN, AADHAAR, driving license etc, often from someone who is unlikely to notice irregularities. This is most commonly done by stealing IDs from the elderly or individuals who are not active or they don’t frequently check their credit scores. Counterfeit or manipulated identity documents like driving licenses, voter IDs, or passports may be used to support the synthetic identity.
Once a valid identity number is obtained, criminals combine it with made-up information, such as a fake name, address and birthdate. To further build the credibility of the synthetic identity, fraudsters may apply for small loans or lines of credit using the new identity. Even if these initial applications are denied, the attempt can still result in the creation of a credit file for the synthetic identity. Over time, as the fraudster continues to apply for and use credit under the synthetic identity, they build a legitimate-looking credit history, making it easier to access larger sums of money.
In some cases, fraudsters will even use the synthetic identity to “piggyback” on someone else’s credit by becoming an authorized user on their account. This technique allows the synthetic identity to inherit the positive credit history of the original account holder, further legitimizing the fake identity.
Fraudsters typically use two main methods to create synthetic identities:
Manipulated Identity: This involves altering one or more details of a real identity. For example, someone with a poor credit history might modify their identity slightly to hide past financial issues. These types of synthetic identities can sometimes be easier to detect.
Manufactured Identity: This method involves combining real and fake information to create a completely new identity. For example, a fraudster might use a real PAN paired with a false name and date of birth to open new accounts that don’t belong to any real person.
The Dangers of Synthetic Identity Fraud
Synthetic identity fraud is especially dangerous because it’s harder to detect than traditional identity theft. In regular identity theft, a fraudster steals someone’s entire identity and uses it to commit fraud. With synthetic identity fraud, however, there’s often no specific person who becomes a victim, which might sound like a good thing at first. But without a real person to notice and report the fraud, it’s much harder for businesses to catch it early.
Here’s why that’s a problem:
Undetected Fraud: Since no consumer is monitoring the account, fraudsters can keep synthetic identities active for months or even years. During this time, they build up good credit, secure higher credit limits, and then max out the accounts before disappearing. Without anyone to report the suspicious activity, the fraud can go unnoticed for a long time.
Misclassified Losses: When the fraud is finally discovered, it’s often too late. Businesses may write off the account as bad credit, not realizing it was actually fraud. This makes it difficult for companies to spot synthetic identity fraud and assess if their security measures are working.
Tracking and measuring losses from synthetic identities is tricky. There’s often confusion within organizations about what qualifies as a synthetic identity and whether it’s a fraud or credit issue. In the end, the real victims are businesses and lenders /Financial Institutions, who end up absorbing the financial losses, sometimes on a large scale, without a clear way to identify or prevent the fraud in the first place.
Some Recent Synthetic Identity Fraud Cases
PPP Fraud Scheme: Two individuals in Florida were charged for creating approximately 700 synthetic identities using stolen Social Security numbers and fake names. They exploited these identities to defraud the Paycheck Protection Program (PPP) during the COVID-19 pandemic, illegally obtaining over $3 million. This case illustrates how fraudsters can manipulate government aid programs by leveraging synthetic identities to access funds intended for legitimate businesses.
TransUnion Report on Rising Fraud: A report from TransUnion highlighted that synthetic identity fraud is the fastest-growing form of fraud in the U.S., with significant impacts on public sector agencies. The report noted that states with generous unemployment benefits, such as Washington and Nevada, were particularly targeted due to their lack of income records to verify claims. This led to improper payments and loss of access to benefits for legitimate constituents.
Federal Investigations into Synthetic Identity Rings: In various investigations conducted by federal agencies, including Homeland Security, synthetic identity fraud schemes have been uncovered involving multiple individuals working together to create fraudulent identities. These cases often involve elaborate setups where identities are registered with government agencies, allowing fraudsters to extract benefits or services without detection.
Technological Countermeasures:
Indian financial institutions are increasingly leveraging advanced technologies to tackle the growing threat of synthetic identity fraud. Some of the key measures being adopted include:
1. Biometric Authentication: Financial institutions are incorporating biometric systems, such as fingerprint or facial recognition, to verify the identity of applicants. This method adds an additional layer of security, making it harder for fraudsters to use synthetic identities.
2. Artificial Intelligence (AI) and Machine Learning (ML): AI and ML algorithms are being used to detect unusual patterns in account behavior. These systems can flag suspicious activities, such as rapid credit line increases or inconsistent data, helping institutions identify potential synthetic identities before significant damage is done.
3. Multi-Factor Authentication (MFA): Using MFA, institutions require additional verification steps, such as a one-time password (OTP) or security questions, to ensure that a person is who they claim to be. This makes it more difficult for fraudsters to access accounts using synthetic identities.
4. Aadhaar-Based Verification: The Aadhaar system, India’s biometric identification system, is widely used to verify identities in financial services. By linking accounts with Aadhaar, financial institutions can ensure that the identity belongs to a real person, reducing the chances of synthetic fraud.
5. Data Analytics: Institutions are using big data analytics to cross-reference customer information with various databases. By analyzing large sets of data, inconsistencies in identity information can be flagged, helping to detect synthetic profiles.
Way Forward
It is predicted that synthetic identity fraud will continue to evolve, necessitating constant innovation in detection and prevention techniques.The Indian cybersecurity market is expected to flourish over the following five years, driven largely by the need for advanced fraud detection solutions. The need for strong identity management systems are not just about meeting regulatory requirements, they are essential for maintaining customer trust and ensuring long-term business success.
Identity verification has thus evolved into a central pillar of modern financial security. Just as money flows through the economy, so too does personal information circulate through digital networks, making it imperative for businesses to treat identity protection with the same level of importance as financial security. Robust identity management systems allow institutions to defend against increasingly sophisticated forms of fraud, while also reassuring customers that their personal information is safe. As fraudsters continue to find new ways to exploit vulnerabilities, it’s clear that identity security has become a business imperative, not just a compliance checkbox.
In conclusion, synthetic identity fraud remains a significant and evolving threat to India’s financial sector. While progress has been made in detection and prevention, continuous innovation, collaboration between stakeholders, and investment in advanced technologies are essential to combat this menace. As India continues its digital transformation, the battle against synthetic identity fraud will remain a critical focus for regulators, financial institutions, and technology providers alike.
Khushbu Jain is a practicing advocate in the Supreme Court and founding partner of the law firm, Ark Legal & Brijesh Singh, IPS Principal Secretary to Chief Minister of Maharashtra. Views expressed are personal.