Detecting and Defeating Synthetic ID Theft

Much to my editor’s chagrin, I missed the submission deadline for this column by a couple days because I attended the National Vehicle Leasing Association’s annual conference in Clearwater Beach, Fla. when I was supposed to be feverishly writing. But I’m back in my office, and what I heard at the conference informs what I’m writing now.

During one of the coffee breaks, I spoke with a vendor who told me the story of a local BMW dealership who lost a $140,000 car to synthetic ID theft. The dealership did not submit a claim for the loss to its insurance company because it did so when this happened last year, and the insurance company jacked its premiums by more than the amount of the loss!

One of the conference speakers was FBI Supervisory Special Agent Brian Herron of the FBI’s Tampa Field Office Cyber Crimes Task Force. His presentation touched upon – you guessed it – synthetic ID theft. I detected a theme, and I am running with it.

Understanding Synthetic ID Theft

Synthetic-identity theft occurs when fraudsters combine real data, such as a legitimate Social Security number, with false information, like a fictitious name and date of birth, to create a new credit profile. Over time, the profiles can be nurtured into seemingly legitimate identities with strong credit scores. Car dealerships are appealing targets for this type of fraud because vehicles can be quickly converted to cash through resale or trafficking, and synthetic IDs can appear trustworthy during the credit application process.

Warning Signs and Red Flags

To effectively detect synthetic-identity theft, dealership personnel must be trained to recognize subtle indicators that something isn’t right. Common red flags include:

• Credit profile discrepancies: A newly established credit file with a high score but minimal account history or unusual patterns in transactions
• Thin credit files: A synthetic ID might show a limited number of transactions or accounts that were all opened within a short period.
• Inconsistent documentation: Mismatched names, addresses, or Social Security numbers that don’t align with credit bureau records
• Mail-drop addresses: Use of P.O. boxes or commercial mail-receiving agencies instead of residential addresses
• Multiple applications: Submitting multiple credit applications to different dealerships in a short span can indicate synthetic activity.
• Lack of negotiation: If you’re an ID thief, what incentive do you have to drive a hard bargain?
• Abnormal sense of urgency: ID thieves want dealership personnel to hurry up, cut corners, and not pay attention to detail. The bigger the hurry, the more concern you should have.

Tools for Detection

To combat synthetic-ID theft, dealerships can adopt a multilayered approach that blends technology with human vigilance:

• Identity verification software: Utilize third-party platforms that analyze identity components for inconsistencies. The systems cross-reference applicant data with national databases and flag mismatches.
• Enhanced driver’s license scanning: Synthetic-ID thieves also use fake driver’s licenses that can pass the security features of most mobile driver’s license scanners. On average, driver’s licenses have about 35 security features to include infrared, ultraviolet, chip, photo and overlay patterns, etc., that mobile scanners can’t perform. To confirm both the license and the person, we recommend eLEND Solutions’ ID Drive program (and no, I don’t get a commission).
• Knowledge-based authentication: Asking applicants specific questions based on public and private records can trip up synthetic identities, which lack detailed historical data.
• Remote delivery protection: To avoid the protections that may exist at the dealership location, synthetic-ID thieves may insist on remote delivery. In such situations, and in-store, for that matter, we recommend MavSign. Its biometric ID verification is second to none. And no, I don’t get a commission here, either.

Strengthening Dealership Procedures

Beyond technology, internal controls play a crucial role in reducing risk. Dealerships should:

• Train finance and sales teams: Staff should understand what synthetic-identity theft is, how it differs from traditional fraud, and how to identify the signs.
• Implement a dual-verification process: Require secondary verification for all applicants who trigger certain fraud risk thresholds.
• Adopt a fraud response plan: Establish a clear protocol for escalating suspicious applications, reporting confirmed fraud cases, and minimizing loss.

In short, dealerships should follow the Red Flags Rule, which they are already required to do. More on that next time.