Synthetic identity fraud occurs when someone steals a Social Security number. Then they combine it with bits of legitimate personal information from different people or completely fake information to create a fraudulent identity for theft. Think of it as Frankenstein fraud since thieves piece together information from different people to create one new identity.
According to the Federal Trade Commission, up to 85 percent of identity theft nowadays is actually synthetic. Thieves use combinations of real and fake information to take out loans, get credit cards, purchase cars, collect unemployment benefits, and much more. Children are often victims of this crime since their credit can go unmonitored for years. Their credit is ruined by the time they become adults and start applying to college or taking out loans.
This threat has grown significantly in the past few years. In 2015, the Federal Reserve estimated that losses from synthetic identity theft were around $6 billion but increased to nearly $20 billion in 2020. However, according to our previous research on identity theft, many parents remain unaware of how to protect their families.
This guide explains what synthetic ID theft is and why its distinction from regular identity theft matters. We’ll show you how to protect yourself and your children from this fast-growing digital threat.
Key Findings
- Two in three American adults were completely unaware of synthetic identity theft, which makes it easier for scammers to commit their crimes without being detected.
- Children are especially vulnerable to synthetic identity theft, yet 86 percent of parents have never checked their children’s credit reports. Only six percent of parents use credit monitoring services to track their children’s credit activity.
- Parents felt their children’s data stored in social media, medical records, and school forms were most vulnerable to theft.
- Nearly 25 percent of parents weren’t taking any active steps to protect their children’s sensitive data, up from 15 percent in 2020.
Table of Contents
- What is synthetic identity theft?
- Differences between synthetic and regular identity theft
- Why children are uniquely vulnerable to synthetic identity theft
- How to prevent synthetic identity theft
- What to do if you or your child is a victim of synthetic ID theft
What is synthetic identity theft?
Think of a synthetic identity as a Frankenstein identity. As long as thieves have a legitimate Social Security number (SSN), they can do what they want and apply for loans, cars, unemployment benefits, financing, credit, and other things. Synthetic identity fraud is a long con, not a one-and-done thing.
Many people are unaware of synthetic identity theft, making it easier for fraudsters to conduct their schemes without being detected. We found that two in three American adults were totally unfamiliar with synthetic identity theft:
| How familiar are you with the term “Synthetic Identity Theft?” | |
|---|---|
| Not at all familiar | 67% |
| Not so familiar or somewhat familiar | 32% |
| Very or extremely familiar | 1% |
In a nutshell, criminals steal SSNs to accomplish synthetic ID theft. They prefer numbers issued in the past 18 years since they’re likely to belong to minors. Children typically don’t apply for loans or credit until age 18, giving criminals ten or even 15 years to wreak havoc before anyone notices.
As soon as a thief has access to a social security number, their first step is to apply for credit online. They are fine being turned down (which is likely since their fake identities lack a credit history. However, by just applying for credit, they start a credit history. At some point, a lender will offer them $500 or even $1,000 in credit. Over time, small purchases and timely payments gave them access to higher credit limits.
Once thieves have access to $10,000 to $15,000 worth of credit, a “bust out” occurs. At this stage, perpetrators disappear after a final flurry of charges. They no longer pay any debt after having done so for months or years. A vehicle is a typical final purchase before someone busts out since cars are easy to resell.
A real-life case of synthetic identity theft
Adam Arena used real SSNs with phony or mismatched names to borrow money he never planned to repay. In 2020, Arena and a partner also took the synthetic approach to swindle nearly $1 million from the federal Paycheck Protection Program. They used their $954,000 loan on vehicles, spa treatments, clothes, meals, and gym memberships.
Arena and his various co-defendants worked to legitimize the fake identities by applying for and getting phone and email accounts, library cards, and rewards cards. This legitimacy helped them qualify for credit cards (with ever-rising limits). They even created fake corporations they used to bolster the credit histories of the fake people. The corporations reported these “people” to the credit bureaus as reliable borrowers with years of timely payments. Stellar credit records helped the fake identities qualify for even more money.
How fraudsters steal SSNs
Unfortunately, thieves can find SSNs in many places, such as your email account or your favorite retailer’s database. Ransomware gangs even steal and publish student data on the dark web. Some accidentally turn over their SSNs and other information to thieves in phishing schemes. Here are some other places where bad actors access SSNs:
- Unprotected smartphones
- Unprotected computers
- Information submitted via unsecured network connections
- Your snail mail (don't let mail sit too long in the mailbox)
- Your garbage (where mail and other important documents end up; shred that stuff)
- Flash or thumb drives
- Data hacked from government, property, tax, veteran’s affairs sources
- Data stolen from banks, utility companies, retailers, credit processors, etc.
- Data stolen from health care facilities, educational institutions, various associations, and even alumni groups
- Your employer’s records and laptops
Differences between synthetic and regular ID theft
In “regular” identity theft, also called true-name identity theft, an actual person's information is used without modification. Thieves match victims’ Social Security numbers to their real names, addresses, phone numbers, and other data. Thieves use everything precisely as it is.
True name identity theft used to be more common but accounts for only 10 percent to 15 percent of identity fraud cases today. True-name fraud is the type of identity theft that measures such as credit monitoring and credit freezing can best prevent.
| Do you use a credit monitoring service? | All adults | Parents |
|---|---|---|
| No | 52% | 53% |
| Yes, for myself | 48% | 41% |
| Yes, for myself and my children | – | 6% |
Though around half of adults use credit monitoring services, they are not always effective against synthetic ID theft. If you become a victim of synthetic fraud, you’d get a fragmented file or subfile attached to your primary credit file. This means you have credit information tied to your SSN but associated with another name and address. The negative information may not belong to you, but a fragmented file can hurt your credit history eventually.
Synthetic identity theft can cause more damage than true-name theft since fraud alerts and credit freezes do not catch it. It takes longer to find out you have been victimized, and clearing your name is more difficult.
Unlike true-name identity theft, there are no direct measures to combat synthetic fraud. Each state has security breach notification laws so authorities can notify consumers if their data is hacked. However, these notifications don’t help much with synthetic fraud.
In 2018 the Economic Growth, Regulatory Relief, and Consumer Protection Act was passed to reduce synthetic identity fraud. However, its impact has been minimal so far. A key reason is that many financial institutions have not enrolled. Another reason is that the law covers only the financial industry and not other spheres, such as unemployment insurance or the federal government’s COVID-19 relief funds programs. When more financial institutions cooperate, the law should have more of an impact.
Why children are uniquely vulnerable to synthetic identity theft
Synthetic identity fraud has an outsized effect on children, lower-income seniors, recent immigrants, and people in prison. In other words, people who are unlikely to use or check their credit in the next few years are most vulnerable to synthetic identity theft.
| Which of these best describes how often you check your credit report? | Your own credit report* | Your child’s credit report |
|---|---|---|
| Every week | 12% | 1% |
| Every month | 38% | 4% |
| Every year | 25% | 3% |
| Less than once per year | 17% | 6% |
| Never | 8% | 86% |
*Includes parents and non-parents
The vast majority of adults have checked their credit at least once, but according to our research, 86 percent of parents said they had never checked their child’s credit report. Since most people don’t review their children’s credit, thieves can wreak havoc on their credit for years. This is why the consequences of synthetic identity are massive, often keeping young victims from getting started in life as adults. These victims become adults with ruined credit, making it difficult to get college loans or qualify for jobs, apartments, or mortgages. Around one in 100 parents in our study said criminals had stolen their child’s identity.
Children are also vulnerable because they’re not in control of their credit or financial information. More than 70 percent of child identity theft victims personally know the perpetrator compared with just seven percent of adult victims. Often, the thief is the child’s parent or caregiver since they have immediate access to their children’s data.
| Which of the following do you believe poses the biggest risk for your child's identity to be stolen? Select all that apply. | 2020 | 2022 |
|---|---|---|
| Social media | 53% | 46% |
| Medical records | 50% | 35% |
| School forms | 42% | 26% |
| Petty theft (e.g wallet stolen) | 29% | 20% |
| Home robbery | 24% | 19% |
| Other | 3% | 3% |
| Virtual/remote school | – | 8% |
| I don't believe there are any risks to my child's identity | 9% | 18% |
Though synthetic identity theft is a growing issue, fewer parents today felt concerned about their child becoming a victim of identity theft than in 2020. Fewer parents felt concerned about personal data leaks on social media, from medical records, or from school forms. In the case of school data breaches, parents may be less concerned as more schools have taken steps to improve their cybersecurity measures. In fact, the number of ransomware attacks on schools has declined over the past year.
How to prevent synthetic identity theft
While there are several ways to avoid synthetic identity theft, many people are not taking preventative measures to keep their children’s data safe.
| Have you ever taken any preventive measures to protect your child's identity? | 2020 | 2022 |
|---|---|---|
| Shredding documents that have sensitive information about your child's identity | 56% | 37% |
| Store documents and electronic records that have sensitive information about your child's identity in a secure place | 52% | 45% |
| Only provide your child's SSN when necessary | 58% | 66% |
| Inspect and review your child's education records | 17% | 14% |
| Request a school not disclose directory information about your child | 21% | 14% |
| Limit information posted about your child on social media | 42% | 50% |
| I have not taken any specific actions to protect my child's identity | 15% | 24% |
| Other | 1% | 1% |
In fact, fewer parents today are working to prevent identity theft than in 2020, though synthetic identity theft is becoming more and more common. Thankfully, more parents are limiting the number of times they share their child’s SSN today than in 2020.
Parents should limit the number of places their child’s SSN appears. For example, you might keep the physical card with the number in a locked file drawer and perhaps keep a password-protected computer file with the number.
Here are a few tips to protect your child’s data:
- Don’t give out SSNs whenever requested. Camps, caregivers, and schools must have a good reason to ask for kids' SSNs. Often, they do not. Leave SSN fields blank.
- Be very selective about who can access personal data. Typically, child victims of synthetic identity theft know the perpetrator. That’s why it’s important to keep your child’s Social Security card and number locked up so friends, grandparents, aunts, uncles, and others can’t wander in and easily access them.
- Shred documents that contain sensitive data.
- Wipe data from old computers, cellphones, or tablets before disposing of them.
- Check with your child’s school about their cybersecurity policies and encourage them to strengthen their standards. Also, find out how they protect your child’s data during online educational activities.
- Teach your kids what’s appropriate to share when chatting with people online: Explain to your kids that they should not share home addresses, phone numbers, SSNs, and other data online, and monitor their online activities.
What to do if you or your child is a victim of synthetic ID theft
As we mentioned earlier, synthetic ID theft can be especially dangerous because you may not find out for years that your Social Security number is tied to other identities. As long as thieves are making payments and have not yet “busted out,” you could remain in the dark. There can be some early indicators, though. For example:
- You get documents relating to unemployment benefits you never applied for.
- You (or your minor children) get credit card offers in the mail.
- You (or your minor children) receive IRS letters about delinquent taxes or get notices that your government benefits application or student loan application has been denied.
- Your credit report shows financial information you do not recognize.
If you suspect you or your child has become a victim take action quickly to reduce damage:
- Change usernames and passwords on online accounts immediately if they could’ve been compromised.
- Visit www.identitytheft.gov to get started on a recovery plan. You can choose among situations such as someone filing a federal tax return using your information or using your details to file for unemployment insurance. The website has special child, tax, and medical identity theft sections.
- Call the companies where you know fraud happened.
- Report the identity theft to the Federal Trade Commission.
- File a police report (if you choose to do so).
There are a few unique steps to take if your child’s identity was stolen:
- When contacting the company or firm where the fraud occurred, explain that someone stole your child's identity and opened fraudulent accounts.
- Say your child is a minor and cannot enter legal contracts.
- Have the company close the account and send a letter confirming your child is not liable for the account.
- Always note who you talked to and the times of your conversations.
- Send follow-up correspondence with your child's FTC Identity Theft report and birth certificate copy.
- See if your child has credit reports (the steps are on the identitytheft.gov website). If there are reports, ask for copies and follow the reports' instructions about removing fraudulent accounts.
- Request a free credit freeze/security freeze.
- Report the misused Social Security number to the Social Security Administration. You may eventually be able to get a new number if the identity theft causes ongoing problems. A new number can cause you problems, too, due to its lack of credit history.
Conclusion
Though synthetic identity theft is a growing issue, many remain unaware of its dangers. Parents should take special care of their children’s data and monitor their credit regularly to check for unauthorized use of their social security numbers. Practicing good habits in regard to internet safety and data privacy can help people of all ages prevent synthetic identity theft.
Our data
In September 2022, Security.org conducted an online poll in English of 1,004 American adults. 503 participants answered questions geared toward parents, and 501 answered questions about themselves. We compared these responses to those from a similar study we conducted in 2020.
