Expert on consumer credit laws and regulations.
Banks will have a new tool to fight synthetic identity fraud under a broad banking measure that was headed to President Trump’s desk Tuesday.
The Economic Growth, Regulatory Relief and Consumer Protection Act passed the House 258 to 159 Tuesday evening. It received Senate approval in March. The White House is expected to enact the measure.
The chief purpose of the bill is to loosen bank regulations that were included in the Dodd-Frank Act enacted in 2010 to prevent another economic crisis. Under it, only a few megabanks will have to comply with strict reporting requirements; medium-sized banks will be excused.
The legislation includes new provisions that could impact consumers, including one that could help shut down synthetic identity theft.
Under Section 215 of the measure, the Social Security Administration will provide banks with an electronic system to check the name and date of birth linked to a given Social Security number. Results should be available in 24 hours.
Synthetic ID fraud uses made-up identities combined with credit-inactive Social Security numbers to trick lenders into granting loans. The SSNs may belong to minors, immigrants or may be unassigned.
The existing system for checking SSNs requires the consumer’s hand-written signature and takes days to return results, making it cumbersome for many lenders.
“I think it’s a tremendous help and we’re very supportive of this database,” said Keir Breitenfeld, senior vice president of decision analytics at the credit bureau Experian. “It’s adding another layer of trust.”
The industry estimates losses to synthetic ID fraud of $6 billion to $9 billion a year, he said. Most of the total is categorized as credit losses, as synthetic IDs may not be exposed as fraudulent for years, if at all.
How synthetic ID works
With synthetic ID fraud, a thief makes up an identity that doesn’t already have a credit file and uses it to bilk lenders.
Sophisticated frauds may build up the false identities for long periods to obtain more credit. But eventually the fictitious borrower maxes out the available credit and stops paying, known as a “bust-out.”
Synthetic ID fraud got a boost in 2011, when Social Security started issuing randomized numbers, instead of using codes related to geography and birth year.
The switch made it harder to guess the first five digits of a SSN based on public information about the owner. That deterred identity theft and “true-name” fraud. But randomized numbers made it easier for fraudsters to concoct SSNs that appear real, as far as the lender knows.
“It replaced one problem with another,” said Al Pascual, senior vice president of research at Javelin Strategy & Research.
Synthetic ID fraud hard to pin down
How many people’s identities are compromised by fictitious scammers?
Javelin produces a widely watched report on the volume of identity theft. But when it comes to synthetic ID fraud, it’s impossible to get a handle on the numbers, Pascual said.
“How true-name fraud gets detected is when someone reports it,” he said. “In the case of synthetic, there’s no real person – the bank did a bad job of underwriting.”
Lenders might discover the fraud when debt collectors skip-trace the fictitious borrower and realize the identity doesn’t hold up, he said. But they may not find out at all – unless a real person is issued the same random Social Security number, and starts butting heads with the fictitious persona.
Minors might be prone to face hurdles as a result of synthetic ID fraud
At the Identity Theft Resource Center, some people have come forward saying their infant, claimed as a dependent on tax forms, turned out to have a double life – according to their newly minted SSN.
“They’re informed [by the IRS] that the person has already filed taxes, or they have earnings,” said Eva Velasquez, director of the Identity Theft Resource Center.
There is no requirement that lenders or credit bureaus use the existing SSA process to verify that the name matches the Social Security number before reporting a credit inquiry, granting a loan or creating a credit file.
“When I inform people that there is currently not a requirement in place, when there is an easy solution, people are shocked,” Velasquez said.
New legislation would help identify potential synthetic ID fraud
Breitenfeld of Experian said the credit bureau has no way of knowing if a lender verified a borrower’s Social Security number before it creates a credit file.
He said the speedier verification system required in the legislation should get more lenders to start checking that SSNs match borrower names. The system still requires consumer consent, but uses digital signatures instead of written or “wet” ones.
“That, in today’s mobile and online world, doesn’t work,” he said. With credit applicants expecting a rapid decision, “the last thing a lender wants is a lot of searching and hurdles to the lending process.”
The system would only tell lenders if the provided SSN matches the provided name and date of birth. That way, the system can’t be hijacked by fraudsters to get data for true-name fraud.
What to do if your SSN was used in synthetic ID fraud
What happens when a real person encounters a synthetic credit file containing his or her Social Security number?
“If a person becomes of age for credit-granting purposes – they may have an issue if their SSN is showing up associated with a quote-unquote identity,” Breitenfeld said. “That 18 year-old would have to go through a process – Experian can help with a strong verification check,” he said. After the vetting process, including providing copies of ID documents, the fraudulent credit file is suppressed.