How Much Data Do Criminals Need To Steal Your Identity?
The scary truth is: not that much.
Identity theft is evolving. “True-name” identity theft, in which a criminal uses your personal information to pose as you, now makes up only 15-20% of cases.
Instead, the majority of identity theft is now "synthetic" identity theft. This occurs when criminals “mash up” your personal details with fraudulent information to create a new identity.
Synthetic identity theft is now the fastest growing type of identity theft [*]. Worse, it’s much more dangerous for children, the elderly, and even the average person. Instead of needing all your information, criminals only need one or two pieces to steal your identity.
Who’s at risk of synthetic fraud? And how can you protect yourself from this insidious form of identity theft?
What Is Synthetic Identity Theft? How Does It Happen?
Synthetic identity theft — or synthetic fraud — is a type of fraud in which scammers combine stolen personal data with fake info to create a new identity. (Some people call this a "Frankenstein" ID.)
The process to create a synthetic identity is a complicated. But the payoff for scammers is worth it.
Here’s how synthetic fraud works:
Criminals create a new, fake identity with your real information
Let’s say a recent data breach leaked your Social Security Number (SSN) onto the Dark Web. A criminal buys your stolen Social Security number for as little as $2 [*]. Then, they combine it with fake details such as a different name, address, phone number, and date of birth.
(This is only one of the many ways scammers get access to your sensitive data. They could also steal your mail, hack your email account, or use phishing attacks to trick you into disclosing information.)
Next, they apply for credit (knowing they’ll get turned down)
Scammers can then use this new identity to apply for a credit card. This “person’s” initial credit application will get turned down due to a lack of a credit profile or history. But, the process creates an official record of a person that doesn’t exist.
Scammers then “piggyback” on legitimate credit accounts
Next, the criminals will use that official record to get their identity added as an authorized user on another account. They can do this in a few different ways.
If they have access to other stolen identities, they can "piggyback" onto those accounts. The same goes for if they trick an unsuspecting victim into giving up their financial information.
Alternatively, a scammer will reach out to high-risk lenders. These lenders don't ask for strict background checks during the authorization process.
Once they have an account, they build a positive credit history
That authorization allows the fake account to build a real credit score. Eventually, they can open new credit card accounts, take out fraudulent loans, and apply for credit. All while using your information.
Pro tip: You can check to see if your personal information is available to hackers on the Dark Web using Aura’s Identity Guard Dark Web Scanner.
When they reach a certain credit score, the fraudsters “bust out”
The end game of synthetic fraud is to build up fake credit and then take it all out at once (called a “bust out”). At a certain point, scammers will max out their identity’s credit line and then disappear.
In some cases, the fraudster will even act as a victim and claim fraud so they can double up on the stolen amount.
Synthetic Identity Theft vs Identity Theft
The main difference between synthetic and traditional identity theft is that synthetic fraud combines real and fake information rather than stealing a prebuilt identity.
But why go to all this effort? There are a few reasons:
- Synthetic identity fraud is harder to detect. Synthetic identities aren’t tied to a real person. So fraud alerts and credit monitoring can go unnoticed for months or even years. Plus, scammers go out of their way to make payments and act like real people.
- Hackers can make many new identities from a single real piece of information. For example, a single SSN can be combined with hundreds of fake names and birthdays. Each of those "new" identities can open lines of credit or defraud financial services.
- Synthetic identities can build real credit scores. Scammers can pay off small purchases to build a solid credit score before they bust out.
As a type of financial crime, synthetic identity fraud is increasingly common. Research white papers show that this scam now accounts for 80-85 percent of all identity fraud [*] and costs banks $20 billion in losses every year. That means it has surpassed “true-name” identity fraud altogether.
But synthetic fraud isn’t just used for stealing money or benefits. Many people also use this type of fraud to gain employment or even “fix” their damaged credit history.
Who’s Most at Risk for Synthetic Identity Theft?
Anyone can become the victim of synthetic identity theft. But identity thieves target specific groups to better their chances of going unnoticed.
Modern identity theft protection tools can monitor your SSN and credit report for new accounts you didn’t approve. But criminals want their synthetic identity theft to go unnoticed. To do that, they target three groups of people: children, the elderly, and even the deceased.
Children are targeted for their clean credit histories and unused SSNs
Child identity theft is a growing problem. In many cases, scammers use a child’s SSN to commit synthetic fraud as it will be years until the child realizes their number has been compromised. Often, it will only be when trying to apply for a mortgage or student loan.
More than 1.25 million children were victims of identity theft last year [*] — and that’s only those who were reported.
Not only are children’s SSNs clean and usually unmonitored, but the federal agency’s switch to randomization in 2011 made them easier to hack. Before then, SSNs were attached to your birthdate and geography, making it easier to discover fraud.
Now, thieves can use a minor’s SSN without it being flagged.
The elderly are common targets due to being less technically savvy
Synthetic identity thieves also target the elderly, as they’re less likely to monitor their credit. If an elderly person’s SSN is leaked in a data breach, it can be attached to another name and the fraud will go unnoticed.
Pro tip: A family identity theft plan covers everyone from your elderly parents to your young children against identity theft. Aura monitors the SSNs of everyone in your family to alert you of any potential frauds like synthetic identity theft.
Even deceased people can have their identities used for synthetic fraud
There are even cases where criminals use the SSN of deceased people to create new identities. This scam is often called “ghosting” and it relies on the fact that millions of SSNs have no date of death attached to them.
Why You Need To Worry About Synthetic Fraud
On the surface, synthetic identity theft may seem like a problem for banks and lenders.
But it’s a serious issue if criminals have access to any of your Personally Identifiable Information (PII). Especially your Social Security number (SSN).
With your SSN, a criminal could:
- Apply for fraudulent loans in your name to purchase houses, cars, or businesses.
- Get access to your credit accounts and open new credit cards in your name.
- Take out benefits or scam other government agencies in your name.
- Use up your healthcare benefits and commit medical identity theft.
- Use your identity to commit crimes and create a criminal record in your name.
- Gain unlawful employment or commit tax fraud.
- Use it to take over other online accounts like your social media, email, or finances.
- Sell it on the Dark Web, and open you up to further frauds.
(Unfortunately, it's also not always possible to change your Social Security number, even after identity theft.)
For most individuals, synthetic identity theft is a symptom of a much larger issue. So how do you make sure you keep your sensitive information like your SSN safe from scammers?
How To Protect Yourself From Synthetic Identity Theft
- Be extremely careful with how you share the SSNs of you and your children. Never give it out during job interviews unless you know exactly how it’s being used (i.e., for an official background check).
- Be suspicious of missing mail, especially tax documents. Identity thieves will steal mail or use a change-of-address scam to get your sensitive documents.
- Shred any credit card offers that come in the mail.
- Use secure passwords for any online accounts with access to your sensitive information.
- Set up two-factor authentication (2FA) for all your financial accounts (but use an authenticator app like Google or Okta instead of SMS).
- Regularly monitor your credit report and credit file for new accounts opened in your name.
- Ask the three major credit bureaus to place a credit freeze on your account. This adds an extra layer of verification before any new credit account is opened in your name.
- If you have children or elderly family members, sign them up for a family identity theft protection service with SSN monitoring.
- Limit what you share on social media sites. Criminals can use these details to crack your passwords or security questions.
- Be very cautious with credit repair companies. If any company offers to help you fix bad credit with a Credit Privacy Number (CPN), it’s a scam [*].
- Regularly scan the Dark Web to see if your SSN or other sensitive information has been leaked in a data breach.
- Sign up for an identity theft protection and credit monitoring service.
Did a Scammer Create a "Frankenstein" ID With Your Data?
If you think someone's used your personal information to create a false identity, your first step is to prevent further damage.
First, mitigate the damage and protect your good credit. Contact the three major credit bureaus and place a credit freeze on your account. This stops scammers from opening new credit accounts using your credit file.
Next, report the fraud to the FTC at IdentityTheft.gov and ReportFraud.ftc.gov. and follow the steps in our fraud victim's checklist. This will help you in case the scammer tries to fraudulently file taxes in your name or steal unemployment benefits.
If you’ve lost money, know the thief, or discovered that they committed crimes in your name, you also need to file a police report for identity theft with local law enforcement.
Finally, protect yourself from future frauds with an identity theft and credit monitoring service.
With Aura, you get:
- Dark Web monitoring. We scan the unseen parts of the internet to alert you if any of your sensitive information has been leaked and is available to hackers.
- Credit monitoring in near-real time. Aura monitors your credit report and bank accounts for any suspicious activity. We’ll let you know 2X faster than the competition.
- SSN monitoring for your entire family. Aura family plans protect up to 10 people in your household including both adults and children. Keep your elderly parents and young children safe from synthetic identity fraud.
- VPN with military-grade encryption. Protect your home Wi-Fi network and devices from hackers and malware.
- $1,000,000 insurance policy. Every adult member on an Aura account is covered by a $1 million insurance policy for eligible losses due to identity theft.
Protect Yourself From Identity Theft – Synthetic or Not
In the world of cybersecurity, mitigation is the best path forward. There’s no way to completely stop identity theft. Even if you have no idea what to do if your identity is stolen, be careful about who has access to your critical information — like your SSN. A bit of extra care can quickly shut down fraudsters before they cause serious credit losses, charge-offs, and other damage to your credit report.
For added security, sign up for Aura. We’ll monitor the credit reports, bank accounts, and SSNs of you and your family to check for signs of fraud.
This way, you don’t have to worry about constantly watching your back. We’ll do it for you.