Synthetic ID fraud on the rise in AI era

AI is helping fraudsters generate synthetic IDs on an industrial scale, posing a growing threat to insurer onboarding and risk models. Vicki Summerhayes reports.

Once a niche scam involving individual ‘Frankenstein’ profiles, synthetic identities have evolved into a highly industrialised driver of organised fraud. By combining stolen real-life personal data with fabricated details, AI-powered criminals are now creating hard-to-detect fake identities at scale.

Rapid growth

For the insurance sector, synthetic ID fraud is a rapidly growing problem. “Across the industry the use of semi-fabricated details on policies is ever-increasing,” says Tiffany Steele, head of application fraud at Markerstudy. “With the rising availability and use of AI, ghost brokers and fraudsters can create a unique blend of genuine and synthetic risks. This makes it a challenge to establish what or who is a genuine risk, and even more so to identify the perpetrator.”

Recent data published by Synectics Solutions highlights the scale of the issue. Synthetic IDs now make up 50% of all financial services identity fraud while, in insurance, the number of synthetic identities used at policy stage has grown by 58% in one year.

“This growth trajectory is not likely to flatten anytime soon,” warns Carina Harrison, insurance fraud solutions consultant at Synectics Solutions and former head of fraud and risk underwriting at Ticker. “Our data shows several years of monthly increases. That continuous uptick poses a big challenge for the industry.”

What makes this fraud typology particularly challenging is its persistent and organised nature. With the benefits of AI, synthetic identities are now far easier and faster to create, test, adapt and re-use.

“Fraudsters are able to tweak and resubmit different identities at scale to test for gaps or weak spots,” explains Harrison. “It shows that insurers shouldn’t underestimate how well fraudsters understand the onboarding environment. They know exactly what checks happen in the background, the rule sets that trigger human interrogation, what validation processes are in place and the documentation that is likely to be required.”

[The rise of synthetic IDs] makes it a challenge to establish what or who is a genuine risk, and even more so to identify the perpetrator.

Tiffany Steele, Markerstudy

A cross-sector, cross-product problem

Synectics’ National SIRA intelligence consortium also reveals that one in three synthetic IDs is now linked to repeat offending, a trend that is on the rise. Synthetic ID reuse has surged by 40% in one year, as profiles are not just created for isolated one-off events, but repeatedly reused across the wider financial ecosystem.

Insurance has long functioned as an environment to build the credibility of fabricated identities. Fraudsters establish legitimate-looking histories, sometimes cultivating these over months or years, before moving into other high-value sectors such as lending, or extracting insurance pay-outs through staged or false claims.

“Fraudsters are often targeting one or more different environments in parallel to develop a believable footprint for synthetics,” says Harrison. “This is in line with the fraud behaviours we’re seeing more broadly. Some 22% of all fraud cases in National SIRA involve the targeting of multiple sectors or products. It’s often the same wider fraud event, with insurance only seeing one stage,” she adds.

The shift to softer targets

There are also indications that, as defences tighten in certain areas, fraudsters are pivoting to softer targets, with growing volumes of synthetic identities targeting lower-scrutiny insurance lines.

“Fraud is no longer confined to traditionally exposed lines such as motor. It is now an agnostic issue affecting every line of business. Fraudsters are adapting their tactics to exploit opportunities wherever they appear, adapting to points of weakness in the process and attacking the weakest point of defence inside an organisation,” notes Bobby Gracey, group head of counter fraud at Charles Taylor.

As a result of more advanced detection techniques and industry-wide collaborative efforts, the motor insurance sector has become increasingly difficult for fraudsters, leading them into lines of business with weaker controls and less-established data sharing. This makes it harder to spot coordinated activity.

Lower friction products, such as pet, travel and home insurance, are typically targeted as more limited onboarding checks make the end-to-end process quicker for fraudsters to start building credibility and testing boundaries.

This raises strategic questions for insurers at product level. The detection approaches adopted by motor insurers offer potential lessons for other personal lines. 

Without similar focus, insurers risk accumulating a material proportion of synthetic customers on their books. That has implications beyond future fraud losses: pricing, risk modelling and portfolio understanding can all be distorted when a growing share of the customer base is built on fabricated identities.

A recent FCA review has drawn attention to the role of insurance firms as a vital line of defence in fighting broader financial crime. In that context, firms that are failing to prevent synthetic ID fraud create a wider, ripple effect. 

“Without intelligence to reject or remove synthetic IDs, insurers are effectively cleansing that identity, enabling that threat to continue across products, organisations and sectors,” says Harrison.

Without intelligence to reject or remove synthetic IDs, insurers are effectively cleansing that identity, enabling that threat to continue across products, organisations and sectors.

Carina Harrison, Synectics Solutions

Fighting back

Insurers must break down internal siloed onboarding checks and connect customer data across the organisation. Legacy systems and fragmented policy platforms can make this difficult, but without a centralised view it becomes far harder to detect the patterns that organised fraudsters deliberately seek to conceal with low-level activity in different areas. 

By linking customer activity across products and business units, insurers can build a fuller picture of risk and detect suspicious patterns much earlier in the customer lifecycle.

Focusing on digital identity at policy inception with digital footprint analytics, real-time identity resolution and email intelligence tools is another key component of the fight against synthetic ID fraud. This can involve reviewing devices used to purchase policies and flagging email addresses that have only recently been activated, with no transactional history.

“Insurers can no longer just rely on controls at policy inception and assume that anyone who passes initial checks remains low risk,” says Harrison.

Continuous monitoring is becoming just as important as application screening, particularly given the fraudster tactic of acting like model policyholders to build clean risk profiles over a period of time.

While an individual policy may appear legitimate in isolation, a broader view often reveals connections to other applications, sectors or known fraud networks. The cross-product and cross-sector nature of synthetic identity fraud means that industry and multi-sector collaboration is vital.

“Data and intelligence sharing across different sectors can play a large role in identifying new trends and threats, highlighting organised fraud that adapts at different stages of the insurance journey,” says Markerstudy’s Steele. “Through effective controls and collaboration, insurers can piece together information about the fraudsters that hide behind the crime.”

With increasingly industrialised synthetic ID fraud exploiting the gaps that exist between products, systems and organisations, it is clear that individual providers can no longer fight this threat in siloes. 

With strong onboarding controls and continuous monitoring, insurers that can connect with real-time, cross-sector data, identify patterns and share intelligence will be far better placed to detect synthetic customers before they become established.

Sponsored content