Thieves hit on a new scam: Synthetic identity fraud

In fall 2020, 43-year-old Adam Arena and a dozen suspected co-conspirators were indicted in New York on charges of trying to swindle banks out of more than $1 million through a scheme known as “synthetic identity fraud.”

They combined real Social Security numbers with mismatched or phony names to create new identities, according to investigators. Prosecutors began the investigation in 2018 and charged them with 108 counts of illegal financial activity, mostly borrowing huge amounts of money they never intended to pay back, according to investigators.  

The scheme was so fruitful that in May 2020, according to prosecutors, Arena apparently did it again.

This time, investigators say, the Arena and a partner used synthetic identities to bilk the federal government out of nearly $1 million from the Paycheck Protection Program, designed to help people who had lost their businesses or employment due to the pandemic. The duo used a fake ID to get a $954,000 loan and spent it on two vehicles, spa services, clothing, restaurant meals and gym memberships, according to prosecutors.

In the first fraud case, Arena pleaded guilty and was sentenced to four to 12 years in prison. Arena also pleaded guilty to the Paycheck Protection Program fraud and is awaiting sentencing.

Synthetic identity fraud schemes have proliferated in the past few years, becoming the largest form of identity theft in the nation, according to the financial company FiVerity, which in a report last year put the losses at an estimated $20 billion in 2020. About five years ago, the Federal Reserve estimated the losses at $6 billion.

In addition to the Paycheck Protection Program rip-offs, fraudsters have used synthetic identities in many unemployment benefit scams, leaving states scrambling to try to recoup the erroneous payments. This type of fraud has been used in more prosaic crimes as well, law enforcement officials say, such as to buy cars or furniture.

With tax filing season in full swing, the IRS is warning taxpayers to look out for documents pertaining to unemployment benefits they never received. Those documents may indicate someone else filed for unemployment insurance using their information.

In a warning on its website, the IRS said there has been a “surge in fraudulent unemployment claims … by crime rings using stolen identities. Criminals are using these stolen identities to fraudulently collect benefits across multiple states.” The agency urged anyone who gets an IRS form that erroneously indicates they received money to contact the Department of Labor.

Except for unemployment fraud, synthetic identity crimes usually are not confined to one state, forcing law enforcement agencies to cooperate, according to former Suffolk County (New York) District Attorney Tim Sini, who led the county’s part in investigating Arena, who has lived in both New York and California.

“This was a collaboration between the Suffolk County District Attorney’s office, Suffolk County Police, Social Security and the Secret Service,” he said in a recent phone interview. “Often times, it’s the financial institutions that are on the hook for liabilities, but make no mistake about it, those costs are at least indirectly passed on to the consumer in the form of higher interest rates and fees.”

In addition, he said, consumers who have had their Social Security numbers stolen can be affected, even years later, when they apply for credit. Most of the synthetic identity schemes steal Social Security numbers from people who aren’t using credit, such as children, recent immigrants or lower-income older adults who may not have credit cards.

The theft may not be discovered until a person—perhaps a student applying for a college loan or their first credit card—is rejected because there is a record of a previous default. In the intervening years, the fraudster may have built a “person” with a real Social Security number and a fake name, address and other identifying information.

Sometimes the crook lets those fake accounts simmer for years before “busting out,” the term law enforcement officials use for pulling the trigger on the fake person’s account and charging up to the limit on a credit card, for example, and then defaulting.

“They exist nowhere except in a credit profile,” said Sini, who is now a lawyer in private practice with the firm Nixon Peabody.

One reason that the scheme is popular is that it’s “very lucrative,” as evidenced by the huge amounts involved, said Eva Velasquez, CEO of the Identity Theft Resource Center, a nonprofit group that helps banks and individual victims of ID theft.

The thieves go for what she called the “long con. They build synthetic IDs, then they will do care and feeding. Then, they max out all of the available credit and don’t pay the bill.”

Arena and about a dozen others created the synthetic identities using Social Security numbers of children, recent immigrants, dead people, older adults and people in prison, according to the Suffolk County District Attorney’s office.

Prosecutors said Arena and his partners had amassed fake credit limits worth hundreds of millions of dollars.

They applied for fake phone and email accounts as well as rewards and library cards to “legitimize” the fake identities before securing loans mostly through credit cards. Then, prosecutors said, Arena created phony corporations that reported the made-up people to credit reporting agencies as reliable borrowers, backdating the reports to make it look like they had years of excellent credit.

A federal law enacted in 2018 designed to curb the problem has had little effect, Velasquez said. One reason is that financial institutions have been slow to enroll in the program specified by the law.  

Another challenge has been how to define the term “synthetic identity fraud.” The Federal Trade Commission defined it in 2021 as “the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain.” Law enforcement agencies now use that definition to prosecute the theft.

The new law covers only the financial industry, not government benefits such as the COVID-19-related funds or unemployment insurance. “It’s a good start,” Velazquez said. “As with all things identity, there’s no silver bullet.”

According to the National Conference of State Legislatures, all 50 states have security breach notification laws that require businesses or governments to notify consumers if their personal information is hacked. This year, at least 17 states have introduced or considered measures that would amend those laws, NCSL said in a blog post, but none appears to address synthetic identity fraud directly.

Jason Kratovil, head of public policy at SentiLink, a financial firm that helps banks and institutions with identity fraud cases, said synthetic identity fraudsters are most likely to apply for credit from card companies within the first year of signing up for the card, and that the average loss per card for high credit limit accounts is $13,000. “Identity theft is a ‘smash and grab,’” he said. “They leverage the identity as quickly as possible.”

Kratovil said the federal law, once it is fully ramped up, should make a dent in the fraud.

“Certainly, the [law] is going to make it much harder once it’s utilized with more frequency by the financial industry; the program is now just opening up for all comers. The challenge for the financial industry is raising awareness."

That is the challenge states face as well, and many attorneys general have hotlines or tip sheets for consumers who think their identity may have been compromised or are trying to prevent it.

New Mexico Attorney General Hector Balderas, a Democrat, said in a phone interview that in his state, identity thieves often use fake identities to procure credit to buy automobiles. Often, the fraudsters spirit the cars over the border and, by the time car dealers catch up, the vehicle is long gone.

In addition to ferreting out fraud, Balderas said his office concentrates on helping consumers who have been victimized. The state, along with at least nine others, issues “identity passports” that allow victims to confirm they are the true holder of their own identity. That helps head off false arrests, he said, such as when a victim is pulled over for speeding and the officer finds an outstanding warrant for the identity thief.

He advised consumers to guard their personal information carefully. “Your wallet and your purse could be a crime scene any day of the week,” he said. “Every consumer needs to hone their skills to play defense.”