Identity theft, or identity fraud, once meant crooks were churning out fake credit cards. But as that became easier to detect, a more insidious crime has evolved: the creation of completely new identities.
Known as “synthetic identity theft,” it involves fraudsters using a combination of fake information, such as a fictitious name, and real data, like a child’s Social Security number, to create fraudulent accounts.
It is a growing problem, says Eva Casey-Velasquez, president and CEO of the nonprofit Identity Theft Resource Center.
But the scope of the problem is difficult to determine because the crime can go undetected for years, she says. However, the rate of children’s identity theft was more than 50 times that of adults, according to a 2011 report by Carnegie Mellon University’s CyLab, which studied the identities of over 40,000 children. And that report was published before a change in the way Social Security numbers are issued made identity thieves’ work a bit easier.
How does synthetic identity theft work?
First, thieves assemble an unused Social Security number — typically that of a minor — along with a fictitious name and birthdate, and an address controlled by the thief.
With those pieces in hand, identity thieves apply for a credit card. While an initial application will be turned down because the “applicant” doesn’t have a credit profile, it creates a record of a “person” who doesn’t actually exist. The next step is to add that “person” to a legitimate account, or more likely several.
One way to do that is by “piggybacking” — or becoming an authorized user — on a legitimate account, perhaps that of an accomplice or a patsy, who doesn’t understand what’s going on, Casey-Velasquez says.
A second, more pernicious piggybacking involves paying a credit-boosting company for the persona to be temporarily added as an authorized user to someone else’s card — a card that has a long history and low utilization. It doesn’t include getting a physical card or a card number or having charging privileges.
In time, there will be a credit history and score for this fictitious person, making it easier to qualify for credit. Casey-Velasquez said the identity often includes an occupation and income, and as long as it seems reasonable, it can go undetected by card issuers.
Over a period that can span years, identity thieves may make small charges and pay them off, thus building a good credit score and receiving higher credit limits.
Then, when they decide the limits are high enough, they do what is called a “bust-out” — suddenly charging the cards up to their limits, paying nothing and discarding the identity.
How do thieves get minors’ Social Security numbers?
Taking over a child’s Social Security number was made easier after the federal agency’s switch to randomization in 2011. Before then, the digits were tied to birthdate and geography, so it was more difficult to use a child’s Social Security number without it being discovered.
Now a child’s number can more easily be used to establish a credit history. Minors are especially vulnerable because they are likely to have an unblemished credit history.
Some thieves have even been able to make made-up, random numbers work. Casey-Velasquez said criminals have used Social Security numbers that haven’t even been issued yet — and when that number is eventually assigned to a newborn, parents find out that the number already has a credit history. In some cases, thieves get access to a child’s stolen Social Security number.
And since address verification measures for credit applicants are often out of date, anyone with a printer can produce a fake utility bill for an abandoned property to “prove” the fictitious person lives there.
What are the uses of synthetic identity?
According to the Government Accountability Office, there are three main reasons people create these false identities:
- Identity fraud for nefarious activities: stealing money or benefits. This is the one that costs businesses the most in terms of credit card fraud.
- Identity fraud for residency or work: a false identity created to live or work in the U.S.
- Identity fraud for credit repair: the perpetrator combines his or her real name with an unblemished Social Security number to create an alternate credit history.
Who is most at risk?
Randomized Social Security numbers put children born after 2011 at especially high risk for synthetic identity theft — and the theft of a child’s Social Security number can go undetected for years.
Only later, when a victim tries to apply for credit using that number, is he or she likely to discover it has been misused. For example, a high school student applying for a student loan or a first job might find their Social Security number is already in use. Then, it’s their mess to clean up.
Anyone with a pristine credit history can be a target. Data breaches mean a lot of Social Security numbers are out there and up for sale. It’s best to assume those digits aren’t private and to try to ensure they aren’t misused.
» MORE: Child Identity Theft: How to Protect Your Child
How can you protect your child?
- Freeze your child’s credit: If this is an option in your state, consider it. Most states now require that a record is created for the purpose of freezing a child’s credit. But that protects your child from only one kind of identity theft — credit identity theft. Synthetic identities have also been used to file fraudulent tax returns and to qualify for benefits and medical care, and freezing credit won’t help that.
- Minimize exposure: Don’t provide your or your child’s Social Security number when requested on a form. In many cases, there’s no issue. If someone requires it, ask why, and how the information will be protected.
- Monitor communications carefully: Investigate anything that seems unusual or suspicious. If you or your child gets a medical insurance Explanation of Benefits that doesn’t make sense, follow up.
More From NerdWallet
