Three million 'Frankenstein’ identities pose a multi-billion Pound fraud threat to UK businesses, new research shows

12/06/2024

LONDON — The latest fraud threatening the UK could cost businesses at least a £4.2billion if appropriate steps are not taken, new research from LexisNexis Risk Solutions shows.

Synthetic ‘frankenstein’ identities exploit stolen and faked personal information to spoof credit checks and commit high-value fraud against banks and credit providers.

The study reveals there are almost three million of these synthetic identities already in circulation in the UK, preparing to strike. Hundreds of thousands more are being created each year, with volumes of the highest-risk synthetic identities increasing nine-fold (527%) between 2020 and 2023.

The analysis looked at over 72million consumer profiles in total and found 2.8million showing several high-risk signs of ‘Frankenstein cloning’, where fraudsters stitch real and made-up personal details together to create a ‘new’ identity. Other high-risk signs include seeing no trace of family connections and lots of similar-looking identities living at the same address.    

Geographic spread and saturation of highly likely synthetic identities

In the U.S. where synthetic fraud is already a major issue, businesses report an average $15k¹ loss to each confirmed synthetic fraud case. As a result, experts at LexisNexis Risk Solutions estimate that it could cost the UK economy around £4.2billion by 2027, unless firms start properly screening now, for the threat.

Most organisations’ existing fraud defences are ineffective against synthetic identities because they appear as normal, good customers until the fraud is committed. Once they ‘bust out’ with the funds, the lender is left to suffer the loss, as there’s no ‘real’ person to pursue for the debt.

Noreen Altaf, Identity Fraud specialist at LexisNexis Risk Solutions explains: “At first, a synthetic ID has little value to a fraudster, as it has no credit history, so they need to play the long game. Scammers nurture each false identity by building what appears to be a real credit profile over time, making the synthetic ID seem like a trustworthy customer – because of this the fraud threat is effectively invisible to firms’ existing fraud defences, until it’s too late.

“Once a fraudster thinks the synthetic ID has enough plausibility, they’ll aim to max out available credit lines. This might be applying for a loan or credit card for thousands of pounds, taking a PCP contract for a new vehicle, or making a high-value purchase via a buy now pay later arrangement. The fraudster has no intention of repaying this, leaving organisations to foot the bill and chasing ghosts to recover the debt.

“There is still much businesses don’t know about this relatively new and fast-emerging threat, so it’s difficult to predict the true potential cost of synthetic fraud to the UK. However, even a very conservative estimate of a £1,500 loss per fraud attack amounts to £4.2 billion in future credit write-offs for companies with synthetic identities already hiding amongst their customer base – and it could be a lot higher.”

The study found strong evidence of scammers up and down the country using ‘synthetic farms’ in rural locations and ‘synthetic factories’ in urban areas to build up the credit scores of new synthetic identities on an industrial scale, in readiness for fraud attacks.

In one example, rental cottages based on a farm in Chichester appeared to have 439 highly suspect identities ‘living’ there over the past seven years, only 22 of which showed any evidence of being real people. The identities were making hundreds of applications for credit, such as short-term and payday loans and some were also linked to a similar farm hundreds of miles away near Dundee, Scotland. 

In another case, the analysis uncovered a large synthetic fraud ring in Oxford, comprised of nine terraced properties within the same street, in which a total of 150 unique ‘identities’ appeared to be living. Only two identities showed any evidence of being real people. Between them the identities made over 450 applications for credit, using manipulated name and date of birth information in the credit application fields, consistent with synthetic fraud.

A heat map produced alongside the report shows similar activity is happening across the whole UK, from Plymouth to Norwich and Southampton to Aberdeen. Suspected synthetic farms can be seen in multiple locations across rural Wales and the Scottish Highlands.

Noreen continues: “A common characteristic of synthetic farms and factories is that they are properties where the mail can be easily intercepted by the fraudsters making credit applications. A farm, for example, might have a mailbox that’s at the end of a track, while empty buildings or shared mailboxes in cities can be exploited in a similar way.

“Synthetic fraud has been around for a while, but with sophisticated fraud modelling, we can now, for the first time, more accurately detect and put a figure on it. We believe the significant growth in production of synthetic identities seen recently is, in part, due to the success banks are increasingly having against other frauds types. Fraudsters constantly evolve their tactics to circumvent defences and synthetic fraud offers a new approach with a minimal risk of being caught, whilst offering potentially high returns. Manipulating genuine personal information, such as first names, surnames, date of birth and addresses, and mixing this with false data is a quick and easy means to con organisations into thinking they are dealing with real customers.

“Businesses need to act fast to protect themselves by investing in tools capable of spotting synthetic identities at application or onboarding stage, before they become customers. Given the length of time fraudsters have already been creating and nurturing synthetic identities in the UK – as evidenced by our research – banks, lenders and credit providers, in particular, should take appropriate action to review their existing portfolios to ascertain the extent to which synthetic identities may have infiltrated their organisations over time, before those identities get a chance to cash out.”

LexisNexis® Risk Solutions harnesses the power of data, sophisticated analytics platforms and technology solutions to provide insights that help businesses across multiple industries and governmental entities reduce risk and improve decisions to benefit people around the globe. Headquartered in metro Atlanta, Georgia, we have offices throughout the world and are part of RELX (LSE: REL/NYSE: RELX), a global provider of information-based analytics and decision tools for professional and business customers. For more information, please visit LexisNexis Risk Solutions and RELX.