What is synthetic identity theft, and how can you prevent it?

Synthetic identity theft is one of the fastest-growing and hardest-to-detect forms of fraud today.

Unlike traditional identity theft, where a criminal steals and uses someone’s real personal information, synthetic identity theft involves piecing together real and fake details to create an entirely new “person.” This makes it especially dangerous: victims may not realize their identity has been misused for years, while banks, lenders, and businesses struggle to spot the fraud.

Understanding how synthetic identity theft works and what steps you can take to protect yourself is the first line of defense against it.

Please note: This information is for general educational purposes and not financial or legal advice.

How does synthetic identity theft work?

Synthetic identity theft differs from traditional identity theft because the victim doesn’t notice the fraudulent activity immediately. Criminals usually start this type of theft by acquiring a legitimate Social Security number from someone who won’t notice it being used. These often belong to a child, a senior, or someone who doesn’t regularly use credit.

The Social Security number provides an anchor for the new identity. Criminals then pair that number with fake names, dates of birth, phone numbers, and addresses.

After creating their synthetic identity, the criminal begins the slow process of establishing credit. They might start by applying for small lines of credit or secured credit cards. The trick is that even if the first applications get rightfully rejected, credit bureaus create a file for the Social Security number.

Once they get accepted by a single company, the fraudster can build a positive payment history by repeatedly applying and making timely payments on their credit.

Over months or years, the fraudster slowly gains better credit and opens more accounts. Eventually, their “good behavior” earns them a large line of credit, which is when the plan comes to fruition. Here, the scammer performs a “bust-out” by maxing out every credit line and taking as many loans as they can, vanishing after the money hits their account. Because no real person is attached to the debt, lenders absorb the losses.

Common uses for synthetic identities

Synthetic identities are versatile tools for fraudsters and enable them to commit a wide array of crimes. Here are a few of the crimes associated with synthetic identities.

• Financial fraud: Criminals open credit cards, personal loans, or massive lines of credit. They make small purchases and timely repayments to build credit, then take out larger loans such as car financing or mortgages and run up debt before disappearing.
• Government benefits: With a synthetic identity, a criminal can apply for fraudulent tax returns, unemployment claims, and disability applications. This allows them to siphon government funding that is meant for those in need.
• Healthcare and insurance scams: By obtaining a fake identity, someone could get medical treatment or prescriptions, or even take out large insurance policies, under a fake alias. This can lead to the misuse of pharmaceutical drugs and cost the insurance company and hospitals money.
• Money laundering and organized crime: Modern criminals use synthetic identities to launder money, rent housing, lease vehicles, or finance organized crime rings or criminal activity without triggering background checks. Essentially, criminals can pose as someone else for a long period of time to avoid their real identity raising red flags.
• Immigration and credit repair: Some individuals, including those seeking to access services otherwise unavailable to them, may attempt to use fabricated profiles.

Who are the main targets of synthetic identity theft?

Criminals deliberately choose Social Security numbers belonging to people who aren’t likely to notice any fraudulent activity for years. Children are most often targeted. Because children don’t use credit and parents are less likely to check their reports regularly, they are prime targets for synthetic identity theft.

Criminals take advantage of Social Security number randomization, a system introduced in 2011 that removed geographic and group identifiers from credit checks. This system makes it harder for lenders to determine if someone is in a specific age group based on their Social Security number; therefore, it also makes it harder to verify that the borrower is an adult.

The fraudster obtains someone’s SSN (typically through data leaks or by stealing it themselves), and uses it to create fake accounts, then run off after taking massive loans or maxing their credit. By the time the child applies for student loans or their first credit card, they discover a long history of debt and delinquency tied to their identity, with no clear perpetrator.

Older adults, the homeless, and people in prison are also frequent targets. Criminals often select Social Security numbers belonging to these groups for the same reason they target children. These groups are less likely to monitor their credit. Some scammers have also used the identity of deceased people.

Detecting synthetic identity theft

Synthetic identity fraud is difficult to detect because fake identities often pass standard verification checks, build legitimate-looking credit histories, and only default after months or years of successful activity. Despite this, there are some red flags:

• Strange credit changes: If you notice credit activity that doesn’t match your actual usage, someone might be manipulating your credit score. This is also true for rapid credit changes or activity.
• Unknown accounts using your info: If you find a strange account using your information, it could indicate a synthetic identity built on some of your personal details.
• Unexpected communications: If you notice a suspicious email, bill, or receipt for services you didn’t purchase, someone may be using your information secretly. Synthetic identity theft often leaves a digital trail of inconsistency.
• Inconsistent tax reports: One of the most conclusive red flags of identity theft is inconsistent tax reports. If you notice any discrepancies in your taxes, you should take action.

How to prevent synthetic identity theft

Preventing synthetic identity theft requires long-term vigilance; an attack may not be carried out for months after your data is obtained. Here are the major prevention tips that you should know.

• Monitor your credit: Regularly check your credit for unexpected changes. Consumer protection agencies provide resources to help with this.
• Freeze your credit: Credit bureaus offer the option to freeze your credit file, which can make it harder for new credit accounts to be opened without your consent.
• Freeze your children’s credit: Unlike adults, children don’t need active credit for everyday life. Experts often note that freezing a child’s credit can help reduce risk, since children usually won’t need to apply for credit. To freeze a child’s credit, you’ll need to provide proof of guardianship.
• Keep your private information private: Only share your Social Security number when legally required.
• Use identity theft protection services: ExpressVPN Identity Defender is available to ExpressVPN U.S. subscribers, and it provides real-time alerts to changes to your credit score, scrubs your personal information from data brokers, sends alerts if your info appears on the dark web, and includes up to $1M in insurance coverage to help offset certain costs associated with identity theft.

What to do if you’re a victim of synthetic identity theft

If you discover that someone is using your Social Security number to create a synthetic identity, it’s important to act quickly.

Start by filing a report with your local government body in charge of theft, such as the U.S. Federal Trade Commission’s IdentityTheft.gov website. Reach out through their official channels or hotline to create an official theft report and recovery plan.

Next, place a fraud alert or credit freeze. This can make it harder for new accounts to be opened in your name.

Notify your bank and credit card issuer to close or flag fraudulent accounts. Some lenders and insurers may require that you fill out an official police report, as this helps all parties confirm the theft and may help to catch the scammer.