Synthetic Fraud: How to Identify, Respond To & Prevent It
Best Practices for Owners and Managers
This content is also available as a PDF.
Introduction
Apartment operators and managers are all too familiar with the effects identity fraud can have on their business, but not all instances of the problem are alike. In fact, synthetic fraud is the fastest-growing type of identity fraud, accounting for an estimated 85 percent of all identity fraud in the country.
Yet, despite the financial devastation synthetic fraud can cause property owners, its occurrence is difficult to identify during the leasing process. It isn’t immediately reported, because there is no real physical victim to report the crime.
Perpetrators of synthetic fraud create fake IDs that combine real data with falsified names. The resulting IDs, notes tech writer Angelica Krystle Donati in a 2019 Forbes article, “are easily purchased on Craigslist or other online platforms and can be used to apply for loans, credit, and other transactions,” including apartment leasing, leading to an epidemic of fraud facing multifamily operators throughout the country. TransUnion reports data breaches are up 45%, resulting in 3.7 million identity records stolen daily.
According to fraud-prevention services firm CheckpointID, Donati notes, “75 percent of management companies with fewer than 30,000 units and 100 percent of management companies with more than 30,000 units are victims of fraud. This translates into millions of dollars in annual losses for the industry from bad debts and skipping.”
It is reported that 73% of owner/managers identify fraud after the applicant moves in and over 70% identified the fraud within the first six months after move-in, leading to forced turnover well before the typical end-of-lease cycle.
While rental fraud continues to grow, fraud prevention today is merely reactive, not proactive as it should be. According to TransUnion, 95% of property management companies experience difficulties identifying, mitigating, or preventing fraud. Property management companies need advanced tools to proactively mitigate the aftermath of a determined fraudster and better protect their business.
Four Types of Identity Fraud
Though we’ll focus solely on synthetic fraud in this guide, property managers can expect to encounter the following four types of identity fraud.
First-Person Fraud
The applicant is acting for another person when renting an apartment. The applicant uses their real identity information on the application but isn’t the person who’ll be residing in the apartment. The applicant in this instance could be a family member, a friend, or someone renting for short-term rental purposes such as Airbnb lodging.
Third-Party Fraud
The applicant assumes a stolen identity and uses the victim’s personally identifiable information (PII), including name, Social Security number (SSN), and date of birth.
Identity-Manipulation Fraud
The applicant alters some of their own identifying information in a way that looks as if it could be a typo or spelling error. Common examples include an SSN that’s off by one number or includes transposed numbers, a slightly different name, or an altered birthdate.
Synthetic Fraud
The applicant creates a fake identity by fabricating all identifying information (SSN, name, date of birth), cobbling together an identity from multiple stolen sources, or doing a mix of both. Real SSNs, typically from children, the elderly or deceased people, are often used in combination with made-up names and birthdates, but even the SSN can be fabricated.
How is Synthetic Fraud Committed?
The most common format for synthetic fraud entails using a real SSN in combination with a fake name and birthdate. Often, the SSN is fabricated altogether and is purchased from a disreputable source online that sells the false SSN as a credit profile number, or CPN, for use on financial applications (such as leases).
One of the reasons synthetic fraud works so well in multifamily housing is that every inquiry sent to a credit bureau results in the creation of a credit file. Thus, if an SSN is being used for the first time, the process creates a new credit file with no negative records. The first time the inquiry is made, the response will show that no credit file exists for that identity, similar to an SSN recently generated for military personnel from overseas or a foreigner with permanent residency in the U.S.
Synthetic fraud perpetrators will also use fake paycheck stubs to make it look as though they earn enough money to qualify for the loan or other object for which they’re applying. Others will alter stubs from their actual job to make their earnings appear higher. If the applicant succeeds, delinquent payments are almost to be expected because the applicant doesn’t truly generate the required income.
Synthetic identity theft is often difficult to spot because no “victim” exists who reports the activity right away. Widespread data breaches, darknet data access and availability, EVM cards (also calles “smart” or “chip” cards) and the competitiveness of the lending landscape have likely contributed to the rise of this type of fraud.
Responding to Fraudulent Activity
Thanks to the breadth of the internet, fraudsters can gain access to infinite amounts of information. Just a quick Google search allows the quick and easy purchase of documents such as a driver’s license, paycheck stub, and birth certificate for a newly created identity. TransUnion reports that 59% of applications are submitted online versus 41% in person, making it easier to commit fraud.
One quick and accurate way to stay ahead of identity thieves is to employ technology that alerts the user when an applicant’s identifying data doesn’t add up. Resident-screening software, for example, can alert operators when an applicant might be using a fake SSN, based on a discrepancy between the date the SSN was issued and the date of birth or age the applicant provided.
So how do you inform an applicant when you suspect he or she is part of a synthetic-fraud attempt?
The Response
To stay within FHA guidelines, CheckpointID advises leasing agents to ask prospects for an alternative form of government-issued ID. The goal is to keep leasing staff from having a confrontational discussion with the prospects. In order to reduce your company’s liability and prevent a hostile situation, it’s best to provide the applicant with a blanket statement regarding their application status (i.e., state that the applicant failed to pass the background check). Keep available a denial letter, written by either your organization or your resident-screening company that complies with federal, state, and local law, to give the applicant.
A Costly Expense
|
Costs associated with synthetic fraud include:
|
|
TransUnion has reported an average cost of $4,215 for a single case of rental fraud--without the legal fees required to mitigate each fraud case. According to CheckpointID the total amount including all legal fees is an average of $7,500 per case. Lost rent accounts for the majority of this number. In states like California, where rent is high and state regulations prevent fraudulent renters from being evicted for at least 6 months, the cost of dealing with a case of rental fraud can be as high as $15,000.
The expense of synthetic fraud goes beyond monetary value. Added to the preceding tangible costs are the intangible costs of reputational damage. Fraudulent applicants who are concealing criminal histories might commit new crimes that could endanger your current residents and employees. Accepting applicants into your community who are committing synthetic fraud increases your potential liability and jeopardizes the safety of all who live and work there.
Protection Against Fraud
The information attached to synthetic IDs can run several levels deep and include public record data, credit information, documentary evidence and social media profiles that may even contain deceptive photos and historical details—all complicating your efforts to identify these prospects before they become your residents. Because this type of crime is hard to track, protecting your business against them is virtually impossible without the help of specialized software.
Synthetic identities are fabricated records of credit activities and personal information, so credit checks are ineffective in protecting your property and company against synthetic fraud. The best line of defense is to catch them early in the application process with advanced ID verification technologies. These programs work by verifying a person’s information on their ID against a library of databases.
Congress, too, is working to crack down on this epidemic and in May 2018 enacted the Economic Growth, Regulatory Relief and Consumer Protection Act. The legislation includes a provision directing the U.S. Social Security Administration (SSA) to develop a mechanism to verify SSNs upon request by a certified financial institution. The new law would allow a certified financial institution to obtain consent from a consumer electronically, which would permit the institution to verify identities more quickly and in connection with a credit transaction.
Prevention
Use Additional Verification Methods
Use multiple layers of authentication to validate the identity of a prospective resident. Additional documents may include state- or government-issued photo identification, Social Security cards, Permanent Resident Cards, passports, W-2 forms, a copy of the applicant’s most recent utility bill, a paycheck stub, etc.
Keep Your Resident Application Criteria Updated
Review and analyze your resident-screening criteria for operational processes and procedures. These criteria should be clearly stated on your company’s application for residency in accordance with company policy and state and federal laws.
Go Beyond SSNs
In a world where consumers are doing business predominately online, don’t rely solely on SSNs to authenticate a prospect’s identity. Many of your applicants’ SSNs may have been exposed during recent breaches.
Educate Your Team
Educating your teams about the potential warning signs during the application process can help diagnose fraudulent activity. It’s also important for employees to understand the best way to respond to an applicant whom they suspect has committed fraud.
Use Technology to Reduce Your Risk and Ensure Compliance and Security
Resident-screening technology not only takes the bias and guesswork out of deciding which applicants should become residents but reduces company liability as well. Resident-screening technology can use Machine Learning models to catch synthetic fraud or provide alerts when there is a potential fraud.
Sources & Acknowledgements
Jeremy Thomason, Executive, Sales. CoreLogic.
“CPNs and Their Ill Effects on Resident Screening.” NAA units Magazine, January 2019.
“Synthetic Identity Fraud.” Experian.
ID Analytics: A Symantec Company.
"This Startup Is Tackling Identity Fraud In The Multifamily Industry.” Angelica Krystle Donati, Consumer Tech. Forbes.
“How Identity Fraudsters Operate and What You Can Do to Stop Them.” Corelogic. January 2018.
Y Tran, Data Scientist, CheckpointID.
Maitri Johnson, Vice President, Multi-Family, TransUnion Rental Screening Solutions.