The latest fraud threatening the UK could cost businesses at least £4.2billion if appropriate steps are not taken, new research from LexisNexis Risk Solutions shows.
A new study looked at over 72million consumer profiles and found 2.8million showing several signs of 'Frankenstein cloning', where fraudsters stitch real and made-up personal details together to create a 'new' synthetic identity to spoof credit checks and commit high-value fraud against banks and credit providers.
In the U.S. where synthetic fraud is already a major issue, businesses report an average $15k[1] loss to each confirmed synthetic fraud case. As a result, experts at LexisNexis Risk Solutions estimate that it could cost the UK economy around £4.2billion by 2027, unless firms start properly screening now, for the threat.
Most organisations' existing fraud defences are ineffective against synthetic identities because they appear as normal, good customers until the fraud is committed. Once they 'bust out' with the funds, the lender is left to suffer the loss, as there's no 'real' person to pursue for the debt.
Noreen Altaf, Identity Fraud specialist at LexisNexis Risk Solutions, explains: "At first, a synthetic ID has little value to a fraudster, as it has no credit history, so they need to play the long game. Scammers nurture each false identity by building what appears to be a real credit profile over time, making the synthetic ID seem like a trustworthy customer – because of this the fraud threat is effectively invisible to firms' existing fraud defences, until it's too late.
"Once a fraudster thinks the synthetic ID has enough plausibility, they'll aim to max out available credit lines. This might be applying for a loan or credit card for thousands of pounds, taking a PCP contract for a new vehicle, or making a high-value purchase via a buy now pay later arrangement. The fraudster has no intention of repaying this, leaving organisations to foot the bill and chasing ghosts to recover the debt.
"There is still much businesses don't know about this fast-emerging threat, so it's difficult to predict the true potential cost of synthetic fraud to the UK. However, even a very conservative estimate of a £1,500 loss per fraud attack amounts to £4.2 billion in future credit write-offs for companies, with synthetic identities already hiding amongst their customer base – and it could be a lot higher."
The study found strong evidence of scammers up and down the country using 'synthetic farms' in rural locations and 'synthetic factories' in urban areas to build up the credit scores of new synthetic identities on an industrial scale, in readiness for fraud attacks.
In one example, rental cottages based on a farm in Chichester appeared to have 439 highly suspect identities 'living' there over the past seven years, only 22 of which showed any evidence of being real people. The identities were making hundreds of applications for credit, such as short-term and payday loans and some were also linked to a similar farm hundreds of miles away near Dundee, Scotland.
A heat map produced alongside the report shows similar activity is happening across the whole UK. Suspected synthetic farms can be seen in multiple locations across rural Wales and the Scottish Highlands.
Noreen continues: "A common characteristic of synthetic farms and factories is that they are properties where the mail can be easily intercepted by the fraudsters making credit applications. A farm, for example, might have a mailbox that's at the end of a track, while empty buildings or shared mailboxes in cities can be exploited in a similar way.
"Synthetic fraud has been around for a while, but with sophisticated fraud modelling, we can, for the first time, more accurately detect and put a figure on it.
"Businesses need to act fast to protect themselves by investing in tools capable of spotting synthetic identities at application or onboarding stage, before they become customers. Given the length of time fraudsters have already been creating and nurturing synthetic identities in the UK – as evidenced by our research – banks, lenders and credit providers, in particular, should take appropriate action to review their existing portfolios to ascertain the extent to which synthetic identities may have infiltrated their organisations over time, before those identities get a chance to cash out."
