What is ‘synthetic identity fraud’?

You’re listening to a Frequency Podcast Network Production, in association with City News.

Jordan You understand what identity theft is. By now, everyone does. Somebody gets a hold of your information, whatever information, and impersonates you. They run up your credit card or they max out your checking account, or they buy hundreds or thousands of dollars worth of merchandise online and ship it somewhere else. The kind of identity theft we’re talking about today, though, goes well beyond that. With typical identity theft, you might find out when you check your bank account or credit card statement, or you get emails about an Amazon shipment you never asked for.

This kind of identity theft reveals itself when you get notice telling you that you’ve fallen behind on your mortgage payments and you don’t have a mortgage. This is the world of synthetic identity fraud, where your information is used not to impersonate you exactly, but to create a brand new person with your purchasing power. And as we see an increase in hacks that leak our personal data, this fraud becomes more and more prevalent. And it’s very, very difficult to know that it’s happening until that other you is deep in debt. So how does this scam work? What should you watch for and what should you do immediately if you find out that you’ve got a mortgage or a car loan out there somewhere in your name and somebody wants to collect?

I’m Jordan Heath-Rawlings. This is The Big Story. Jennifer Fiddian-Green is an investigative forensic accountant, a certified anti-money laundering specialist. She is the leader of the National Risk and Forensic Advisory Practice at Grant-Thornton LLP. Hey, Jennifer.

Jennifer Fiddian-Green Hello.

Jordan Thanks for joining us today.

Jennifer Fiddian-Green Very happy to be here today and support fraud awareness.

Jordan Okay, so let’s begin with this then. I know that this encapsulates a whole variety of different scams. We’ve covered some of them on this show in the past, but what would you characterize as identity theft?

Jennifer Fiddian-Green It’s a good question because there is so much in this space and people can get really interested, but also kind of confused and you can get overwhelmed pretty quickly. So we hear a lot as individuals and our friends and our family walking around society. We hear a lot about credit card theft and debit card. And we hold up very close to us because it’s my credit card and my debit card. And when my card data is used and there’s charges that weren’t mine that can feel a lot like identity theft. So for me, I draw some lines, and they’re not super hard lines, but kind of credit card theft is fraudsters, it’s scammers, it’s thieves, using that data and they’re committing fraud. But I call that credit card theft similar, to the debit card.

The difference for me with identity theft, and that’s what we’re going to talk about today, is when they use my data. So they might be using some of my credit card data, they’re using my name, they’re using my address, they’re using my profile information. And if they use that, if we call it that profile work up and they go out into our world, our economy, our society, and they’re creating a new account. So they’re getting a new credit card or they get a new debit card or some type of service account, maybe they’re getting a phone account. We’re going to talk about lending and mortgages. I think that to me is very right on target–identity theft. And it’s linked, it’s close, the credit card, the debit card threats, those all feel very close to identity theft. But it’s for me, really, when my identity information, my information, my name, my social insurance number is used to go out there and steal something, get value. That to me is really some strong lines around that for identity theft.

Jordan Is that why you’ve sort of shifted and some people I’ve seen have shifted to calling it synthetic identity fraud? Is that what we’re looking at here? Is that something different?

Jennifer Fiddian-Green It’s something different. And again, all of this is evolving. Things continue. Sometimes they move at a really rapid pace. But synthetic. So now we’ve got this new word–synthetic identity theft. It’s been around for a little while, but I’m going to share my understanding of what synthetic identity theft is. It’s actually been around for a long time because we’ve got lots of really industrious, creative fraudster, scam artist kind of people out there that we need to combat. Right. We need to put them down. So identity theft–if somebody uses my information, they go out there and they do stuff they shouldn’t do. Synthetic identity fraud. What’s that? So now synthetic. We’re knitting together some things. We’re putting stuff together. It might be my name, Jennifer Fiddian-Green, my real social insurance number, but they changed my name a little bit. Maybe it’s just Jennifer Fiddian. They changed my address, the profile that they build using, they have some of my real information.

So we do have identity theft here. They’re taking my real social insurance number, for example. But they are synthesizing or they’re putting a lot of made up, false, fraudulent, untrue information with that real stuff. Put it all together. We’ve got a synthetic identity that’s built off some of that core very valuable, the real stuff, the good stuff. And they take that profile out into our world, out into our economy, and they use it to access value, right, to the kinds of things that we’re talking about. But when we have the institution, the company on the other side, who actually lets that synthetic identity into their business, and the fraudsters aren’t going to pay the bills, right? That’s what we’re talking about here. The fraudsters are gone. They’ve taken the value. They took the money. They took the phone account. They’re gone. They’re not going to pay the bill. Now the business starts looking around and they start taking really good look at this and they find the core of that good information. And this is the problem with this crime. They end up finding the real me and saying, “hey, Jennifer Fiddian, why aren’t you paying your bill?” And I say, “well, that’s not really me. You let a synthetic identity into your business,” but the weight of the crime ends up on me a little bit. Even though I don’t actually lose some money, the business is coming to me looking for it. So synthetic. Right. We’re taking some real, some fraudulent. We’re putting it together. The fraudsters are doing this.

Jordan Do we know right about now the scale of this problem?

Jennifer Fiddian-Green Jordan, it’s big and it keeps on growing. Unfortunately, I’ve been doing this work for a long time now. And I think I thought that this was something that we could get ahead of. We haven’t we can all Google and we can see that the numbers are increasing. Our neighbours to the south, they have more current data than us in Canada. You will see that some of the current information. I think we have some data that’s got 2020 next to it. It’s happening to over 1.3 million of us. And we’re talking about billions of dollars. But what I really want to share on the call today, because there is some helpful information, because there’s so much to navigate. And how big is this? And what’s happening is C.P.A. Canada and I’m a C.P.A. I’m a charter professional accountant of Canada. They started a while ago doing an annual survey of Canadians regarding fraud because there’s so much it’s hard to understand. It’s hard to navigate. So this annual survey and the latest one came out earlier this year. So we have a 2022 survey of fraud in Canada, and we don’t have the overall quantum of this. We know from this survey that almost half of Canadians are saying that they have fallen victim to some kind of a scam. So that’s a lot, right? That’s big and that this continues to be something that needs to be on our radar screen to protect ourselves.

Jordan So let’s talk about synthetic identity theft and what it looks like. And we’re going to use this conversation to hopefully try to give people some tips. But maybe first, your whole practice is about recognizing and preventing this kind of stuff. Have you ever had to deal with synthetic identity theft personally? Have you witnessed it, dealt with it in any of your clients or businesses?

Jennifer Fiddian-Green I have most of my practice. I actually regularly work with businesses and organizations and government and nonprofit. So the identity theft piece is more on the how can I prevent this and not let those fraudsters into the business? Right. How can we have those kinds of processes? But the reason I got really interested in this, and it’s a while ago now, is because it happened to me personally.

So I’m a forensic accountant. I’m a fraud investigator. It’s what I do. And I was a victim. So I’m here to say my hands are up. It can happen to anyone. I always thought that I was someone who was careful about changing my passwords and not letting my private information get into the wrong places, trying to do the things that hopefully all the advice, all the tips that we hear of trying to do all of those things. I got a call one day at work from a debt collector, an individual, very nice individual. His name was Jeff, actually. And his job was to follow up on a mortgage that wasn’t being paid. It had gone into over three months overdue. There hadn’t been any payments on it. And he found me online. He Googled my name because the profile that they had lent the person, the name that they had lent money to was the same name as mine. And he Googled me and he found out where I worked. And he called into the front desk and got put through to my office. And he was pretty good at doing his job. And he said, “Ms. Fiddian-Green, you’re not paying your mortgage, and this is serious business. You need to pay your mortgage.” Well, I was pretty upset pretty quickly because I didn’t owe anybody any money. I certainly didn’t owe him any money, his business.

So it took a little while, but he and I got connected and figured out there’s something going on here, and it wasn’t me and it wasn’t him. So we figured out that it was a fraudulent situation. And so what this looked like was my real name, my real social insurance number. So the real deal, one that I’ve had since I was a teenager, my first job, my real social insurance number. But everything else on that file that a mortgage lending company had lent a mortgage to–funds, it was about $270,000. Everything else on that file was fake. It wasn’t real. I saw the file. I went, you better believe that I got connected. This was before COVID, long before COVID, face to face to figure. I wanted to see what file they had on me, and he wanted to see me and make sure I was the real me and I wasn’t the fraudster trying to get away with this. And so there on that file, I could see that there were three years of tax return information that had been provided to this mortgage lending company that thought they were doing all of the right things to make sure they were going to lend money to somebody who could pay it back. All of it was false. It had my name on it, but everything in there, the income numbers, the address, the history of everything was made up, and it was fake. And sort of long story short, I investigated my own case. So I’ve seen what this looks like. I was able to see that over about a three, four day period, a criminal group had used my name and worked it at different lending companies to get through their onboarding process to access lending. And they got more than a few hundred thousand dollars next to my name. And then I had to do the work to get my name disentangled from that.

Jordan Did they ever get caught?

Jennifer Fiddian-Green So my case, as I investigated it and I did report it to law enforcement, they were able to link it to another case, to a case that they were investigating that had a whole quite complex identity theft ring going on. And yes, there were charges laid in my case, and there was one individual who was convicted. So we did get a prosecution. It didn’t end up being more than that. But yes, I think more people involved, but some charges stuck against one individual.

Jordan You mentioned that that was 16 years ago. So this stuff has been going on for a while. What has happened in the past few years, if anything, in terms of technology, government policy that has made this so widespread? Now, as you mentioned, it keeps increasing.

Jennifer Fiddian-Green Certainly it’s digitization. So we’re going to need some time, I think, as a society to understand, but we have not fully evolved to the methods that we need, as to how we understand who we’re dealing with and the truth of that. We’re still in that transitioning phase. And perhaps these fraudsters, these groups, are taking advantage of that.

I was at a conference yesterday. It was an industry conference. The topic was A.M.L.–anti-money laundering. And there was a good portion of the day some really inspiring and innovative people at the front of the room talking to us about this digitization and about how, because we’re seeing it in the A.M.L. space as well, we’re seeing how do we really know who’s on the other end, when on the other end, the customer is completely onboarding online, there’s no in-person. There’s not even any screen time. Right. Everything is through an online platform. How do we know we’re really dealing with a real person and not a criminal, not an identity thieve, not a bot, right? We’re hearing about this in all sorts of ways. We’re hearing about it with the whole Twitter. How many real customers are there? How many bots are there?

And so I think that I am learning, I think we’re all learning that there are tools, there are technologies that are going to help us with that. There’s some really good ones, but we’re not using them yet. So we’re in this space where we all have how many apps, how many websites, how many online retailers, how many accounts we have, and everything is digital. We’re still memorizing passwords. The survey that C.P.A. Canada said that we still have people who are trying to memorize the passwords and change them every other month in their head. All of that is not working well enough yet. So I think, Jordan, we’re in this transition time, just like COVID boosted us, kicked us into digitization, and we’re connected. We now need the next kick to really evolve to the tools that are going to protect us, because we’re not really protecting ourselves yet. So look, I’m somebody who’s learning in this space that’s not really my area. But if you want to open up an account with a financial institution, very few of us are going to our branch now, right? You’re going to your screen and doing it. And that’s created opportunities for these scam artists to find our vulnerabilities. Right? So we’ve got to be on guard.

Jordan Is there any way for the average person to recognize that they might have fallen prey to this kind of scam? What should they watch for?

Jennifer Fiddian-Green Okay, well, just give yourself a moment to think about anything that comes unsolicited to you. Give yourself permission to just shut it out. Delete the email, close the app that pops up. If it’s coming unsolicited, it could be good, it could be real, but it could also be fraudsters hunting us. Because we are being hunted, we are being targeted. There’s no doubt about it. Just know that. Okay. So whether it’s an email, whether it’s a text, something on our iPhone, just train yourself. Start to train yourself. That unsolicited? Ignore it. Whoever that is, really needs to connect with you. They’re going to be insistent in the first instance, maybe even in the second instance, get it off your radar screen and don’t respond to it. So that’s more about a protection.

And how do you know if it’s happening to you? The other thing that I tell people, and I think it is really important, it continues to be really important in our world, is we all have a credit profile. We have good credit, we have bad credit, we have okay credit, that credit profile in our economy and how we structured ourselves, how financial services work for us as individuals, that credit profile, is super important. So when these identity thieves take my profile, whether it’s my full profile, or the synthetic one that they make up, and they go out and they want to access services, they want to access a lending account or set up a new credit card account, they need to access that credit profile. And so having access to that is key because the lender is not going to lend money to anyone, real or fake, unless they know there’s good credit. Right? So what they’re really stealing is they want to access our credit profile so we can check in on our credit profile and we can do it regularly.

I don’t think that we should be overly stressed and anxious and go in and check daily, but we could check a couple of times a year. So this is the Equifax in the TransUnion, like these two groups. Those are the two big ones in Canada, and most financial services organizations are plugged into each of those. And that’s kind of what I learned when I was investigating my own case is kind of how all of these dots connect and how financial services needs to have access to that. So check that. You want to get that credit profile and check it. You want to look, you want to see if there’s anything unusual in there, anything that doesn’t make sense. And if there is, you don’t want to ignore it.

So there’s two, I’m giving you two messages there. The number one is anything unsolicited. You can ignore that. Like if anybody’s coming to you and saying, hey, check this out, or I want this or I need this from you, if you didn’t solicit that you weren’t expecting it, push it away, ignore it. But if you go check your credit file and you see stuff on there, the back page of your credit report lists all the different groups that access your credit file. And if you see stuff on there that you didn’t initiate, you’re saying, what is this bank doing? What is this company? Why are all these groups checking out my credit profile? I don’t want you to ignore that, because that’s a warning sign and we’ve got to get on it.

Jordan What do you do if you are checking your credit rating and you see something like that? What’s your next step? Call the police. Call the business. What?

Jennifer Fiddian-Green Well, I wouldn’t call the police immediately because we’re kind of on the front end of something. But we can call Equifax and TransUnion. We can put a fraud alert on our file, put notice, really, it’s almost like a red flag on our file. So we can ask Equifax and TransUnion. You can do it over the websites today. If you go visit their websites, they’re going to have fraud information right from the get-go because there’s so much of this going on. So we can put an alert on so that if any, whoever checks my file again will be alerted, hey, you better do some good due diligence here, because the person whose profile this is put a fraud alert on so we can do that, and that’s preventative and we’re protecting ourselves.

But what I would want to do and I do get calls, I still get a couple of calls a month from people are saying, “hey, this happened to me, what do I do?” When I’m looking at that list and I see some names of institutions or banks or retail lending companies, and I don’t know why those people are checking it out. I call those groups, call them. That’s what I did when I investigated my case. I called them and I said, “why were you looking at my credit?” I want to know because I’m me and I didn’t give you permission to look at it. And if it’s a real look, if they really did look at mine and if they really did look at my credit and they did something as a consequence of that, like they lent money, they’ll have a file with my name next to it. And that’s how I learned what happened. I got all of these stories and I had to keep going because I had to investigate it. But for somebody who is trying to be ahead of this and prevent it, we put that fraud alert on those files. We can check if there’s something there, and we can actually, I don’t like this. I feel very principled about this, and you can ask me about it, but we can pay Equifax and TransUnion to monitor our credit file for us. And if something funny happens, they can push it to us. So we can pay that.

I’m a little bit upset. I’m going to share it. But personally, I’m a little bit upset that I need to pay Equifax and TransUnion to do that. I want to encourage and challenge and support Equifax and TransUnion to do that as part of their business model. I don’t think that I need to pay them again to do that.

Jordan So let me ask you the final part of this then. It happens, none of the prevention worked, you were tweaked to something that popped up on your credit score, and you found out that something had been taken out in your name. And you get to where you are, and all of a sudden somebody you don’t know is saying, “hey, you owe us the interest on this loan, or you owe us the payment for whatever.” What do you do? How do you reclaim your identity? Is there a better process for that now than there was 16 years ago when this kind of thing was happening to you? Are the authorities used to this by now?

Jennifer Fiddian-Green Yeah. I think the short answer is yes. I think we’ve all learned a lot. We’re all much more aware. I think what happened to me, I had to kind of break through this, like people didn’t believe me, right? Now, if it happens to you, there’s going to be a lot more support, much, much more easily, much more quickly. So that’s a good thing, right? That’s a good thing. We keep getting better at this kind of stuff, and we have to keep going so we can shut more of this down.

So I think if it happens to you, take a deep breath. I want you to understand that you were a victim of identity theft, but you should not be incurring any financial loss, okay. The financial loss is actually the institution that accepted your profile when the identity thieves put it forward. You, as the individual, your identity has been stolen, and that is not okay, right? And maybe if you need access to your credit tomorrow, your credit might be compromised because there’s a loan out there that’s not going to be paid. But you shouldn’t lose any money. And that’s something that I think as a society, it’s taken us a while. I want you to be a confident victim, if it happens to you. Right. So if you get a call from a bank, like me, and the bank is saying, “hey, you’ve got to pay your debt,” say “no, clearly. Show me your file. That wasn’t me. This is me. And you’ve lent money to these who use my name, but you didn’t lend money to me.” So be a confident victim. Be helpful, because that institution or that group is going to have to file paperwork and do things, and they’re going to need your help to do that. So help that process. And they’re the ones that lost the money, not you, right?

So how do we get it to law enforcement? We can report it to the Canadian Anti Fraud Center. I think you can do it online. You can also call. And the more that we can do this and you give the details of what happened to you and the parts that you know, we give ourselves a chance. It’s the Canadian Anti Fraud Center. We give ourselves a chance for our law enforcement agencies, with the help of the Canadian Anti Fraud Center, to pull everything together. Because I truly believe that, in my case, my name, if we can think about it, if you can kind of zoom out, my name was maybe on a list of 100 names, I don’t know, 500 names. We hear about these data breaches. And if you can just sort of think about these thieves having a list of names, I think they worked that long list of names, right? They weren’t just working my name. These are smart, technologically savvy, very entrepreneurial, organized crime groups doing this. They’re not just going to sit down and say, “I’m going to do everything I can with the Fiddian-Green profile today.” They’re working a whole list of names at the same time. And so if we’re going to our law enforcement and we’re giving them one by one, it’s so hard for us to put all of this together. But if we can all get incidents reported and we give a chance through this fraud center for our law enforcement to see a bit of a bigger picture view. Right. Because the chances of building a case to go on the one thing it’s hard. Right. But suddenly, if that starts accumulating, saying, no, there’s a whole wave or a ring here, there are 25 cases or there are 100 cases. We give our law enforcement a chance to get at this and to focus on energy and resources.

Jordan Jennifer, thank you so much for taking the time to explain all this. I’m really hoping it helps some listeners.

Jennifer Fiddian-Green Okay, great. I hope I was helpful and there’s not too much in there. It’s a lot, it’s a lot to take in and digest. And I think we’ve got to do more soo it’s not the victims who are carrying the weight of this crime.

Jordan Jennifer Fiddian-Green, investigative forensic accountant and an anti-money laundering specialist. That was The Big Story.

For more, head to thebigstorypodcast.ca. Find us on Twitter at @TheBigStoryFPN. You can always talk to us. Questions, comments, concerns, random rants late at night. Love to read those in the morning. Email us[click here!]. Call us, drunk dial us. No, don’t do that. It’s a really bad idea. But do ask us a question or suggest a topic. You can reach us at 416-935-5935 and you can find this podcast anywhere you get your podcast. You can get it on a smart speaker by asking it to play The Big Story podcast. And if you do like this podcast, forget about doing something online. Tell a friend in real life that they should listen.

Thank you for listening. I’m Jordan Heath-Rawlings. We’ll talk tomorrow.

Back to top of page