Digital Doppelgängers: Synthetic Identity Red Flags

You’ve likely already heard about synthetic identity fraud. As the US Federal Reserve describes it, “it’s the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain.

Primary elements used to create synthetic identities include name, date of birth and other government-issued identifiers while secondary ones can help substantiate or enhance the validity of an identity but cannot establish an identity by themselves (e.g., mailing or billing address, phone number, email address or digital footprint).”

Who cares? 

Synthetic identities have been around for at least 25 years, they’ve just taken on new meaning recently with the rapid rise of AI and the ability for AI-enabled synthetic voices to ask for, and get PII. As was showcased on TV show, 60 Minutes, where the ethical hacker and CEO of data protection firm Social Proof Security, managed to get 60 Minutes’ correspondent Sharyn Alfonsi’s passport number using a deep fake voice. 

In fact, according to recent research from UK based non-profit, anti-fraud organisation, CIFAS, ”Identity fraud now accounts for almost 70% of [the 409,000] cases filed to the National Fraud Database. In 2022, 409,000 cases were reported with…nearly 40,000 cases indicating money mule behaviour – where an individual lets someone else use their bank account to transfer money, often keeping some of it for themselves. The key age range for mule activity continues to be 21-25 years, with social media remaining a key enabler in the recruitment of mules.” 

It’s so prevalent now that a whole fraud ecosystem has popped up with specialist roles for each stage of the fraud; ID stealing, bank account opening with synthetic identities, and money syphoning on behalf of criminals. 

Why now?

The reasons are numerous:

• The fast pace of AI (it’s cheap and easy to create synthetic identities)
• The cost of living crisis (making people more susceptible to scam promotions)
• Chronic enforcement skills shortage (government level and business-based compliance teams)
• An online shopping shift (fuelled by the pandemic)
• Aging technology (easier to hack) and
• Increasing data breaches are all helping criminals easily fabricate identities for criminal acts.  

Red flags.

So what should you look for? Based on guidance from ACAMS, The Federal Reserve, CIFAS and other government agencies we’ve created this (non exhaustive) list:

Unusual identity information patterns (indicators of fabricated or manipulated data)

• Repeated use of addresses, government IDs or dates of birth to create multiple accounts
• Use of temporary, disposable, or seemingly fabricated email addresses
• Use of virtual phone numbers, burner phones, or VoIP phone numbers
• Inconsistent or unusual name combinations
• Repeated authorised user on multiple accounts, especially people who live in different cities or have different surnames.
• Illogical identity information e.g. identity has a passport number issued after 2011 but date of birth before 2011.
• Email address is not consistent with applicant name
• Fractured identities e.g the identity seem to be cobbled together from multiple real identities, resulting in inconsistencies across different data sources.

Address and location discrepancies (mismatches between stated location and other data)

• Inconsistencies between provided address and other personal information e.g. area code of telephone number does not match the geographic location of mailing address provided 
• Use of postal boxes, vacant address, or non-residential address

Employment and income anomalies (stated employment or income raises suspicion)

• Employment or income information cannot be verified
• Stated income seems disproportionate to age, background, or occupation
• Unexplained wealth or income sources, especially from high-risk countries

Online presence and document anomalies (lack of expected digital footprint or document issues)

• Little or no online presence or social media footprint
• Identical online presence or social media footprint 
• Mismatched voice biometrics or behavioural biometrics during application
• No records found in identification databases

High-risk associations (connections to high-risk entities, industries, or activities)

• Use of sanctioned countries or territories
• Connections to politically exposed persons (PEPs)
• Associations with high-risk industries (cash-intensive, unlicensed businesses)
• Connections to offshore entities, shell companies, or secrecy jurisdictions

Third-party data mismatches (discrepancies with external data sources)

• Discrepancies between provided information and third-party data
• Inability to verify information against public records, especially high-risk countries
• Adverse media mentions linking identity to financial crimes or fraud

Credit File Anomalies (inconsistencies or patterns in credit data)

• Discrepancies in personal information (name, date of birth, government ID number)
• Credit file too thin or too thick for the person’s stated age e.g. age is 52 but credit file is thin.
• Sudden spikes or drops in credit utilisation inconsistent with typical behaviour
• Large amount of unsecured debt (which requires less documentation than a mortgage, for instance)

 What’s a compliance professional to do?

For those of us working in AML roles, here are some ways to combat synthetic identity fraud:

1. Enhanced Customer Due Diligence (CDD): Ensure you have in place rigorous CDD measures, including gathering and verifying information from multiple reliable sources, conducting adverse media checks, and screening for politically exposed persons (PEPs) and other high-risk associations
2. Beneficial Ownership Verification: Strengthen your procedures to identify and verify the ultimate beneficial owners of accounts and entities, especially those with complex ownership structures or ties to high-risk jurisdictions.
3. Transaction Monitoring for Red Flags: Configure transaction monitoring systems to detect red flags specific to synthetic identity fraud, such as unusual geographic patterns, mismatched transaction descriptions, or rapid cycling of funds.
4. Suspicious Activity/Matter Report (SAR /SMR) Analysis: Analyse annual reports from local financial intelligence units (FIUs) and industry reports for patterns and typologies related to synthetic identity fraud
5. Information Sharing: Participate in information-sharing initiatives to exchange typologies, indicators, and best practices for combating synthetic identity fraud. FINTRAIL is a great example. 
6. Update your Risk Assessments: With synthetic identity in mind, look at your risk assessment questionnaires and consider adding questions or assigning higher risk ratings to customers, transactions, or activities exhibiting synthetic identity fraud indicators, and applying enhanced due diligence accordingly.
7. Continuous Training and Awareness: Provide regular training and awareness programs to AML/CFT staff on the latest synthetic identity fraud typologies, red flags, and detection techniques.