Fraud Management & Cybercrime , Fraud Risk Management , ID Fraud

Credit Repair Firms Driving $20B Synthetic ID Fraud Crisis

The ongoing battle against synthetic identity fraud has reached a critical point, as credit repair companies now play a major role in exacerbating this pervasive form of fraud.

See Also: OnDemand | 2024 Phishing Insights: What 11.9 Million User Behaviors Reveal About Your Risk

Synthetic identity fraud now comprises 85% of all identity fraud cases and cost businesses billions of dollars annually. In 2020 alone, financial losses stemming from synthetic identity fraud exceeded $20 billion, and experts see no signs of this trend abating, as outlined by CNN.

Individual consumers are not the only victims of fraud. Companies across many industries lose vast sums to synthetic identity fraud. For example, a report by Point Predictive found that synthetic ID costs auto lenders about $1.8 billion a year. Criminals try to steal nearly $14 billion annually using synthetic IDs, the company said.

The risk associated with synthetic identities stems from the Social Security Administration's decision's over a decade ago to introduce Social Security number randomization. The agency made the change to enhance public safeguards, but it inadvertently created obstacles for fraud detection systems, making it increasingly difficult to identify fictitious Social Security numbers.

Unscrupulous credit repair companies are adding to the problem by convincing people in debt to erase their poor credit history and create a new identity using "credit profile numbers," which are essentially unissued Social Security numbers or, in some cases, someone else's Social Security number.

Credit repair businesses are one of the “leading recruitment mechanisms for first-party fraudsters,” Jake Emry, fraud prevention SME at NICE Actimize, told Information Security Media Group. First-party fraudsters are individuals who collude in the act of fraud, and many are relying on the advice of illicit credit repair businesses to make false claims to banks and defraud merchants.

The global credit repair services market is expected to reach $4.26 billion in 2023 and projected to grow to $10 billion by 2030. Experts say only a small percentage of these companies are helping to perpetrate fraud.

In the United States, the modern credit repair industry began in the late 1990s with the passage of the Credit Repair Organizations Act. "Shady credit repair companies began marketing credit repair numbers and other credit repair scams that led to what is now called synthetic ID fraud," said Skipper Mervin, head of global product strategy, identity and fraud solutions at SAS.

How the Scam Works

Frank McKenna, co-founder of Point Predictive, outlined the steps for creating synthetic IDs:

1. The credit repair company advertises on social media that it can help customers obtain a credit profile number.
2. A consumer, believing that credit repair companies are repairing their credit, sends $80 to $200 to the company to buy a number.
3. The company sends the consumer a nine-digit number, but that number is actually a Social Security number that has not been issued or has been issued to another individual.
4. The company then tells the consumer how to apply for loans and build the new credit profile using purchased tradelines. A tradeline is a record of activity for any type of credit extended to a borrower and reported to a credit reporting agency. The firm advises consumers to change key pieces of their identity, including postal addresses and email addresses, so they can avoid detection.
5. The consumer follows the instructions to create a synthetic identity by using stolen and mismatched personal information on credit applications.

“This process probably happens thousands of times across the U.S. each and every day,” McKenna said. Advertisements for credit profile numbers, or CPNs, began to emerge prominently online and within social media channels in 2015. "It is basically a marketing term created to make people believe they are protecting their privacy when they use a false Social Security number," McKenna said.

Exploiting the System

The issue of synthetic identity fraud has persisted for years, and it reveals vulnerabilities at financial institutions that can be readily exploited by credit repair companies. Andrew Hawkins, a principal solutions adviser in the global fraud and security intelligence practice at SAS, said, "The challenge with synthetic identities lies in their diversity. The methods fraudsters employ to fabricate these false identities have varying levels of financial impact and detectability."

Fraudulent credit repair companies also take advantage of the fact the only a few lenders verify Social Security numbers with the Social Security Administration.

Credit rating agencies employ a matching algorithm using the name, Social Security number, birthdate and address to identify a consumer's credit history. "If a person uses different pieces of information other than their real PII, the credit agencies will assume they are a brand-new person. That is why credit repair companies sell the CPNs and instruct consumers to change their address and phone number and other PII is so that they can bypass the credit agencies matching keys," McKenna said.

Credit rating firms also know banks are likely to auto-approve an applicant who has a great credit score. "Also, since there is no matching victim to the PII, the bank is unlikely to match that identity to another consumer that is a victim of identity theft."

Credit repair companies also exploit tradelines that report debts and payment history to credit bureaus. They offer authorized tradelines, primary tradelines and even zombie debt tradelines that get reported to consumers' credit profiles, providing an immediate boost to their credit scores, McKenna said.

A fraud department leader at a major retail company shared his experience dealing with a disreputable credit repair business: "What we discovered was that these illicit credit repair businesses were coaching customers on various deceptive practices, including making false claims of identity theft and disputing transactions. Essentially, they were teaching many of our customers first-party fraud techniques."

Many accounts experienced multiple disputes initiated by customers, along with legitimate transactions, resulting in the investigations team becoming overwhelmed in dealing with the disputes from "frequent fliers" - customers making false claims of identity theft and new account fraud.

Stories such as these highlight the need for a holistic and cross-departmental view of fraud strategy at financial institutions to stop these first-party frauds, whether they be first-party synthetics or chronic abusers of existing methods to dispute transactions.

Emry also cited instances in which fraudulent credit repair agencies assist first-party fraudsters in falsely claiming identity theft or claiming they were victims of fraud when credit card payments come due. "One of the most common tactics is attempting to eliminate authorized charges, claiming they were unauthorized even though the customer made the charges. Addressing the vulnerabilities within credit repair businesses may appear as a seemingly minor link, but doing so could have a significant impact on the fight against synthetic identity fraud," Emry said.

How the Industry Can Respond

The financial industry has grappled with the challenge of identifying and acknowledging the threat of synthetic identity fraud for years, but some progress is being made. The Federal Reserve of Boston introduced a definition of synthetic identity fraud that is now widely accepted by financial institutions.

Lenders can take steps to detect this type of activity. The first step is verifying that applicants are who they say they are, including verification of government-issued identity documents. When done effectively with the right vendor, this step can substantially mitigate the risk of synthetic identity fraud, McKenna said.

Addressing this issue also requires a broader transformation of the way credit is extended in the United States. "It is very easy to establish a new tradeline with a synthetic ID with one of the three large credit bureaus. If that synthetic identity matures over time and is granted a good credit score, a fraudster will begin applying for more and more credit and eventually bust out," Hawkins said.

The best approach is to establish a national ID in the United States and phase out the Social Security number as the de facto national ID, experts say. "Other creative solutions would be to begin looking at different types of data as a means to determine credit worthiness," Hawkins said.

Synthetic identity fraud represents a complex challenge, requiring rigorous identity verification measures and structural changes to the credit review process. Implementing a robust national identification system and diversifying the data sources used for credit assessments are crucial steps toward fortifying the financial system against unscrupulous credit repair companies.