Synthetic Identity Fraud
© 2014 FrontLine Security (Vol 9, No 2)

You’re a hard-working, tax-paying citizen who has never been in trouble with the law. You have always paid your bills, and used credit wisely. Moreover, your employment record is solid. As a result, you think you have a good credit rating. In fact, you don’t, but not because of anything you’ve done or neglected to do. A fabricated person, someone who has never existed except in government and credit bureau databases, has damaged your credit record without your knowledge. What connects you to the fake individual is your government-issued identity number (e.g., SIN in Canada, SSN in the U.S.) which, unbeknownst to you, was stolen. When you apply for a credit card or mortgage, your application is rejected. You’re one of many victims worldwide of synthetic identity fraud.

According to the Royal Canadian Mounted Police’s online National Identity Crime Strategy document, synthetic ID fraud is “the combination of fake and real consumer identifying information or all false information to create a new fictional or partially fabricated identity. This type of identity crime is challenging to detect.”

Synthetic identity fraud has reportedly been growing at an exponential rate. Earlier this year, John Russo, vice-president and legal counsel for Equifax, one of the largest credit agencies in North America, told CBC News that the crime is the “top one thing to worry about” as far as his employer is concerned. The CBC also noted that a few years ago, “there may have been 100 to 200 synthetic identity fraud investigations a month [in Canada]. Now it’s thousands.”

Toronto Police Detective Constable Mike Kelly, who has investigated synthetic identities and related criminal activities since 2009, told Canada’s public broadcaster: “The term we’ve been using is infinite mischief. There’s literally no limit to the types of things, the amounts of things, the amount of damage that can be caused to each sector that you can possibly think of – banks, government bureaucracies, police agencies, insurance, car lenders. Everybody.”

Vancouver police seized hundreds of IDs and credits cards in various names from a Surrey apartment on 19 March 2014. (CTV)

True name vs. Synthetic identity fraud
The website of the U.S. Office of Victims of Crimes describes identity theft and fraud as “crimes in which an impostor gains access to key pieces of personal identifying information such as a Social Security number and driver’s license number and uses them for personal gain or to commit other criminal activities. In the case of true name identity theft, the thief goes beyond stealing the victim’s assets and actually assumes his or her identity. Identity theft may begin with a lost or stolen wallet, pilfered mail, a data breach, a computer virus, [e-mail] phishing, a scam, or paper documents thrown out by an individual or a business and retrieved by a thief (dumpster diving).”

The difference between true name fraud and synthetic identity fraud is existence; the fictitious identity doesn’t exist. With true name fraud, the victim can complain to the police. For example, as Russo explained to the CBC, “I’m able to look at my credit report and see [that] something suspicious is on my credit report that doesn’t belong to me. Whereas the fictitious identity is more lucrative because there’s no one there to complain.”

Frauds costing billions
How lucrative is synthetic identity fraud? According to experts, the amounts can run “up to a billion dollars a year” in Canada. The Federal Bureau of Investigation declined to comment about the financial impact of the crime in the United States, when contacted by FrontLine Security, but in December 2013, Business Insider, a news publication based in New York, reported that “identity theft cost Americans $24.7 billion in 2012.” In Britain, The Guardian online reported that the overall expense of stolen ID’s to the country is £1.7 billion (CAD$3.1B).

According to Stephen Coggeshell, Chief Technology Officer of San Diego-based ID Analytics, 85 to 90% of fraud stemming from identity theft is synthetic in nature.

Bankers’ concerns
FrontLine Security asked the Canadian Bankers Association (CBA) about the impact synthetic ID fraud has on the organization’s 59 members, including foreign bank subsidiaries and branches. Maura Drew-Lytle, CBA media relations and communications director, said in an e-mail: “Synthetic identity fraud is nothing new and has been around for a long time. What is new is people recognizing that it is an issue. Keep in mind, people use synthetic ID for many reasons: to hide from the authorities/police, creditors or family, or to commit a crime.”

Drew-Lytle pointed out that “there are no bank customers victimized by synthetic identity fraud; the banks themselves are the victims.” She also explained that “there could be any number of victims of this sort of fraudulent activity. Someone may create a false identity to take out a credit card or a loan, but they may also do so to obtain health care services, in which case the provincial government is the victim, or get a cell phone at the expense of the cell phone company.”

Federal regulations oblige bank employees to accept certain documentation such as a driver’s license when customers say they want to open an account. “When a bank employee is presented with these genuine government-issued identity documents,” Drew-Lytle wrote, “they have no way of determining if the individual is legitimate or attempting to commit some sort of crime.”

Not hard to get fake ID
In March 2014, the CBC reported that “thousands of driver’s licenses with fake names are circulating in Ontario.” Detective Constable Kelly revealed that “if you talk in hushed corners and ask people honestly what they think, people will give you numbers from the tens of thousands to the hundreds of thousands.” His own ballpark estimate of bogus driver’s licenses in the province was 200,000.

Last October, RCMP officers in Surrey, B.C. raided a house which was described in a detachment news release as “a credit card and identity theft ‘factory.’” The online document said that inside the residence, Mounties found “hundreds of stolen and fake cards and pieces of identification, including credit cards, gift cards, SIN cards, BCID cards, BC Driver’s Licenses, Care [provincial health system] Cards, birth certificates, and Canadian passports. Investigators also seized stolen mail, cheques, and identification, as well as documents that contained stolen personal identification and information on them.”

A CBC News report in December 2012 said that “a sophisticated fake ID market is openly thriving in Canada’s largest city [Toronto], with shops selling cards as novelty items that are just different enough from government-issued identification to evade police scrutiny.” Many websites market “fake IDs” and “novelty identification.”

In the U.S., countless young Americans reportedly use fake driver’s licenses in order to get into drinking establishments. The National Minimum Drinking Age Act of 1984 stipulates that the legal drinking age is 21, and yet, a 2007 University of Missouri study found that nearly one in three undergraduates in the U.S. Midwest owned ­falsified identification by the end of their second year.

Threat of terrorists using synthetic ID “ignored”
The potential for terrorists to use synthetic IDs is of particular concern to law enforcement officials. Det. Const. Kelly explained such fraud in relation to terrorism to the CBC as follows: “Think of the potential of having an apartment and a vehicle and a phone, all registered in different names. You can come and go as you please. You have the ability to open businesses and transport large volumes of materials in trucks with appropriate permits and license designations. And then at the end of the day, when people like myself and police agencies go to investigate who’s behind it all, there’s a puff of smoke and there’s nobody there.”

As Dr. Kalyani Munshani, an expert in financial crime who has taught at York University’s Osgoode Law School in Toronto, told CBC News earlier this year: “Using ­synthetic identities, safe houses can be established, cars can be rented, heavy vehicles can be bought, international travel can be facilitated, restricted goods can be bought without any flags being raised. This is not a conventional crime. This is more towards terrorism, I believe, not just merely revenue generation.”

Dr. Munshani emphasized that synthetic ID fraud in the sphere of terrorism is a “game changer” that “requires immediate attention. This is extremely serious, and it’s been ignored for way too long.”

With no comment from the FBI about U.S. efforts to combat this level of crime, FrontLine Security approached the RCMP about what Canada has been doing about synthetic identity fraud from a counter terrorism perspective. Corporal Laurence Trottier responded in an e-mail that the force “routinely meets with its international and domestic partners to facilitate the cross-border cooperation and sharing of information in respect of identity crime.”

Blair Watson is a FrontLine contributing editor based in Calgary.
© FrontLine Security 2014