Growing threat to lenders: Synthetic identities

Auto finance fraud often is perpetrated using identity theft. But the fastest growing type of identity theft, synthetic identity fraud, is largely unknown to the public and a mounting threat for auto lenders, experts say.

Synthetic identity fraud occurs when a criminal combines real and fake information to create a new identity to open fraudulent loan accounts and make fraudulent purchases. Synthetic identities can have a real Social Security number from one person and an address, date of birth and phone number from three others, in some cases, making it extremely difficult to detect. In many cases, the fraudster uses the Social Security number of a minor, so the theft goes undetected at least until the minor establishes a credit profile, said Keir Breitenfeld, senior business consultant at Experian.

Fraudsters can even "piggyback" on other consumers' credit profiles. For a payment of a few hundred dollars, some consumers will add a fraudster to their credit file, creating a credit score for the synthetic identity, said Frank McKenna, chief strategist at fraud specialist PointPredictive Inc.

There was a time when lenders could verify standard identification data and feel confident, Breitenfeld said. "That's out the window now. It's very easy for fraudsters to assume or create an identity."

Combatting synthetic identity fraud means looking at each identification component and its history, he said. For example, lenders should be able to determine how many times an address or Social Security number has been used within a certain time frame and with how many names.

"This is the new baseline to understand the validity of the identity and what is happening with this identity," Breitenfeld said.

Synthetic identities can "flow through the auto approval process in some cases rather seamlessly," said Steve Bowman, chief credit and risk officer for GM Financial. The captive has developed proprietary technology to detect and prevent synthetic identity fraud. Suspicious data are pulled "out of the underwriting process and put into a more intense underwriting process, where we can do more verifications, gather more information and slow the transaction down," Bowman said. "We have been successful in [stopping] quite a bit of synthetic identity fraud."

A change in the structure of Social Security numbers partially drove the rise in synthetic identities, McKenna said. Before 2011 consumers from the same area had the same first three digits. The second set of digits correlated with the time frame the number was issued in that area. In 2011 the Social Security Administration began randomizing the numbers, so "it was a little less transparent to lenders if a social was valid or not," McKenna said. Fraudsters took advantage of the change by submitting random nine-digit Social Security numbers. The administration's move "was a fraud security measure, but it had an opposite effect with synthetic identity," McKenna said.

The Social Security Administration now has​ a tool that could help prevent synthetic identity fraud, to an extent. Toyota Financial Services did a successful pilot with the tool but has yet to deploy it.

The product offers consent-based Social Security number verification. So if a consumer opts in, lenders would be able to verify the name, Social Security number and date of birth against the Social Security Administration's database. Lenders would be able to determine whether a Social Security number matches the name and date of birth provided on a credit application.

Santander Consumer USA is using the tool along with strategies to verify identity using internal and external data, said Zahid Kassem, senior vice president of enterprise fraud.

There are a couple of problems with the tool, such as the price, Experian's Breitenfeld said.

It costs more than a typical credit check or identity verification through a credit bureau. It also requires consumers' written consent, "which is not aligned with the user experience these days," he said.

The three major credit bureaus — Equifax, Experian and TransUnion — are working on an initiative together to make the tool more accessible, Breitenfeld said. "That data would help the entire ecosystem as a source of truth that's not widely available today."