Synthetic identity fraud is a fast-growing and costly type of financial fraud, and its threat is increasing – thanks to generative AI.

Criminals use Gen AI to quickly create synthetic identities and make these fake identities seem more like real people so it’s easier to use them to steal.

Federal Reserve payments fraud expert Mike Timoney discusses what synthetic identity fraud is and how it’s evolved. He says one of the best tools to stop thieves who use generative AI in synthetic identity fraud … is AI.

Timoney is a vice president of secure payments at the Boston Fed. Visit BostonFed.org to learn more about how the Federal Reserve is tracking the increase in synthetic identity fraud. You can also listen to a discussion with Timoney on why check fraud is rising, even as check usage declines. For more interviews and analysis of the economy in New England and nationwide, visit BostonFed.org/SixHundredAtlantic.aspx. Subscribe to our email list to stay updated on new episodes.

Jay Lindsay:

Hi, I am Jay Lindsay, and welcome back to Six Hundred Atlantic. So, let's talk about identity fraud. Specifically, let's talk about synthetic identity fraud. What's the difference? Well, we all pretty much know what standard identity fraud is. Criminals steal a real person's identity, often by acquiring their personal information, and they use the stolen identity to steal and commit fraud in that person's name. Many in the audience may have been victims of this.

Synthetic identity fraud is kind of the Frankenstein of identity fraud. Thieves steal pieces of information, maybe this guy's checking account number, this woman's driver's license number, this child's Social Security number, and they put it all together to construct a completely fake person. Then, they use that synthetic identity to steal. Thieves have even taken out life insurance policies on these fake people, then killed them off to collect on the policy.

And now generative artificial intelligence is in the mix. Gen AI is like an accelerant of synthetic identity fraud, thieves can build these identities faster and easier, and they're tougher to detect. We've got Fed payments fraud expert, Mike Timoney back with us and we're going to talk with him about it. Welcome back, Mike.

Mike Timoney:

Thanks a lot, Jay. Happy to be here.

Jay Lindsay:

So, I touched on what synthetic identity fraud is, but I wonder, maybe you can give us an example or two of what these thieves are doing and how they pull it off.

Mike Timoney:

First off, with synthetic, one of the key methods that the fraudsters have is to apply for credit. They want to get access to money. So, by applying for a credit card they establish a credit line and ultimately can commit fraud. The idea really is to try and grow the credit line. So that's, that's one. The second one is really about opening accounts. The fraudsters nowadays are opening accounts with these synthetic identities. It gives them access to the banking system. It gives them access to places where they can move money through.

Jay Lindsay:

Can you give us an idea about any synthetic identity fraud trends? Like how much is it costing us? How fast is it growing?

Mike Timoney:

Back around 2020, the number was probably in the range of eight billion. A couple years later, we were at 14 billion. And then some of the papers we wrote in the last couple of years we were around 20. So, from ... in the last five to six years we went from eight billion to 30, 30-plus billion. So, it's a big problem. It's growing fast, and it's costing us a lot of money.

Jay Lindsay:

So, let's talk about why this issue matters to the Fed because maybe it's not apparent to people.

Mike Timoney:

Well, first of all, it matters to me and my team because we're focused ... our whole role is to really try and educate and create awareness around fraud problems. So, at the elementary level, we work with the industry to try and make them aware of what's going on out there. We try to provide resources to help them understand the problems.

But from the Fed perspective, it's even bigger than that, right? Our, our mission is really to ... one of our missions at least is to provide a safe and secure payment system. Having synthetic identities in that payment system is not a good thing. That's not good for individuals as consumers. It's not good for businesses, and it's not good for anyone in our, in the districts.

Jay Lindsay:

So, we're hearing about synthetic identity fraud more now, but it's been around a while. Can you tell us a little about the history of it and how this ... it's evolved over time?

Mike Timoney:

Probably 2020 or so is when a lot of attention came to it. In my career, the first time I heard of it was in about 2010. As I mentioned, one of the things that they did initially was to open a credit card. The idea was, if I take these pieces of information and create a new identity and I apply for credit, once I get credit, I almost have achieved a proof of life, right? Because now I've given ... I've gotten a credit card that has that name on it, right? It's done. One, it's given me proof of life with the credit card, but secondly, the credit bureau now has a file on me, on that identity, right? So, now it's become real.

What fraudsters would then do is use the credit card, pay it back. Actually, it would be a good customer, Jay, and would pay it back. And the credit rating goes up, right? What happens when your credit rating goes up? Banks want to give you more money, they extend your credit, give you higher credit limits, right? So, the fraudsters could continue to do that. And it was … it wasn't a short-term scam, it's really a long term. So, grow the identity, get more credit, and ultimately the idea would be at some point: I'm going to walk away. So, I max out the credit card. Let's pretend it's 25,000. I max it out, I walk away. And, I just, I made $25,000, right?

We saw a significant shift in about 2020, 2021 when the pandemic hit. All these new programs came about, there was unemployment, PPP, small business loans, et cetera, that were giving money, aid money to people that were suffering from the pandemic. And the fraudsters that had synthetics realized that it was easier to apply for benefits than it was to try and get a credit card. So, what we saw during the pandemic years was this huge shift away from the unsecured credit to benefit fraud. And so, you know, if I was already a fraudster, and I had a thousand synthetic identities, and I was trying to use them for one type of fraud, I just switch gears, and I now use it to apply for benefits.

Jay Lindsay:

So, the pandemic ends, the funds dry up, what do the fraudsters do now?

Mike Timoney:

They look for other ways to commit fraud. So, with these identities already established they've got to figure a way to, to monetize them. So, one of the things that they do is then look ... they've moved towards opening new bank accounts. And so, they have all these established credit identities, and so they can now apply to open accounts.

One of the challenges that the industry has, and fraudsters have, is to move money. And so today what they typically do is look for what we call a money mule. Someone that they can manipulate into accepting money into their account and then moving it out. Well, that's a challenge for fraudsters. One, they have to recruit people. And two, they typically have to give up a cost for that. They have to pay the person to be able to do it. But by opening their own accounts they don't have to do that. And so, what we've seen is this huge shift into now opening accounts through online portals, and so, therefore, the fraudsters have shifted.

Jay Lindsay:

So, what are the banks doing to combat this?

Mike Timoney:

So, the smaller banks initially have got to make a decision on, “Do they want to allow account opening online?” A lot of smaller banks still require people to come in and do that. So, that’s a good … that’s one piece. For banks that have opened or switched to opening online, some of them have actually shut down their account opening portal because they've seen this dramatic increase of applications coming in, which they know are fraudulent.

Because if you were getting 300 applications a week one week, and all of a sudden it goes to 3,000, you didn't just get an extra 2,700 people that want accounts. There's something suspect with that. And so, they have to really evaluate the applications much tighter.

Jay Lindsay:

So, difficult for the banks, difficult to stop this. And we throw in generative AI into the mix, it makes it even more difficult. But before we get into that, and I want to talk about that, I want to talk about data. Because we know that AI needs tremendous amounts of data to work, and I'm just wondering, the thieves that are using generative AI, where are they getting the data?

Mike Timoney:

You've probably heard the term “data breach.” You know, if I think about the first data breach that I heard were way back in 2008 or so. Well, they haven't gone away. Here we are in 2025, and they're still happening. And in fact, in 2024 there were over 3,200 data breaches reported in the United States. That's a lot. But '24 was actually a little less than '23. And so, we're seeing 3,000-plus a year happening. To give you kind of a magnitude of that, last year between 1.6 and 1.7 billion notices were sent out to people to tell them that they had been in a data breach. So, that's where the data comes from, Jay, that all that data has been exposed. The fraudsters are stealing it and then they're using that for all kinds of nefarious purposes, one of which is to create synthetic identities.

Jay Lindsay:

I'm interested in this specific conversation about how Gen AI amplifies this synthetic identity threat.

Mike Timoney:

So, if you think about what I just said, if you have 1.6 or 1.7 billion pieces of information, multiple pieces of information, those are huge data sets. And so, from a synthetic identity fraudster, when they're creating an identity, they put together several elements to create an identity.

Well, think about the computer power with AI. It allows them really to sift that information and create much more unique type of synthetic identities. So, basically it can parse large, large data sets much faster than a human can. It can make sure that it's not duplicating types of things. It can try to leverage the learnings that it has from the data sets to make sure that it's, you know, being as varied as possible, so that they have more success rate. So, really trying to make the identity less noticeable that it's a fake is obviously one of the things it can do.

Jay Lindsay:

And Gen AI, it can learn from its mistakes, is that correct?

Mike Timoney:

Absolutely. Absolutely. So, if it creates a batch of identities and notices that they start to ... are getting caught, that they're not getting through, they may be able to identify a pattern, right? On the flip side, if they, if they're using it, they can also see where they're getting most success, right? So, if they can look for maybe there's certain types of industry or banks, et cetera, that they're not catching them, then maybe they're pushing more that direction.

Jay Lindsay:

And something else that I think is a little, honestly, freaky is how well that the Gen AI can mimic humans at times. Is that correct? I mean, the way you send a text message, how you sound.

Mike Timoney:

Oh, absolutely. In fact, some of the work we're doing right now is around what you're describing is what's often deemed a deepfake. I can take a few seconds of your voice, a few seconds of maybe you presenting somewhere, and take that and now create an individual with it, right? So, not only can I take data elements and create an identity, I can now take, you know, someone speaking or how they look and how they sound and, and tie it to those.

The other thing that I would say around … that they're using from a Gen AI perspective to help with this is some of the document processes of counterfeiting documents. So, a synthetic identity, if it has a driver's license, that's better. If it has a birth certificate, that's even better, right? So, the identity is getting more characteristics.

Jay Lindsay:

I want to talk about something that you hear once in a while about synthetic identity fraud, which is that it's a victimless crime. It is really no person there being victimized, the person's fake. So, is it a victimless crime?

Mike Timoney:

I think that's a misconception that people think it's victimless because it's not necessarily all of my data or all of your data. It may be a piece of my data, my birthdate and your Social Security number, right? But, you know, if they use your Social Security number, and they do bad things with it, and they create this identity, it's still tied to that Social Security number. And when you go to try and get a loan or try to do something you could show up with bad credit. So that's, that's a challenge, right?

There's also several groups out there that are impacted from this more than others, that are a bit more vulnerable. So, children, children under the age of 14-, 15-years-old that never use a Social Security number, they get one issued at birth, but it's really never used until later on in life, right? So, if the fraudsters get that, they can use that 14, 15 years before it may ever show up.

On the other end of the spectrum is the elderly population. They have lived their life, worked and all that, built up all their credit and, and everything to that point. They're really not using it much at that point anymore. They don't, they don't need to apply for mortgage. They're not necessarily applying for new credit cards or new cars, that kind of thing. And if you think about those, those are even more valuable because they have a high credit rating associated with them. So, you're getting a really good Social Security number.

And then, believe it or not, the incarcerated population in the United States is also victim, can be victims, because they're not using Social Security numbers, either. And so often fraudsters, if they can get that kind of information, can use those identities because if the person's in prison, they won't know they're being affected.

Jay Lindsay:

So, I want to talk about some causes for hope here in fighting Gen AI. And I think one thing that's interesting is that Gen AI can help fight Gen AI synthetic identity fraud. Can you talk about that a little bit?

Mike Timoney:

If you think about it, the fraudsters are using it for bad. Well, it was not created for bad, it was created for good, right? So, the reality is that the use of AI can be incorporated into the fraud models that are used today. But it can also create new avenues for us to be able to identify fraudsters.

Banks and businesses may ask your name, address, Social, a few other pieces of information, but they don't go as deep into some other things. And Gen AI can actually look for relationships bigger than just those few components, right?

Jay Lindsay:

So, what kind of things are we talking about here?

Mike Timoney:

I think that's where it gets unique that Gen AI gives us the ability to look at all kinds of factors, right? Lots more parameters. The depth of the ... of our identity is really what synthetics don't have. So, they typically don't have parents, right? If I get a new customer and I happen to do an identity check on them, and I don't see parents, well that's probably a good indicator. But fraudsters evolve, and they learn that. So now they give them, they give them parents, right?

But we all have a cell phone. We all have devices that we use. We have hobbies that we participate in. So, those kinds of things. Now, if it shows that you're part of a certain organization, and it shows that Jay's email address has been around for 20 years, and his cell phone number's been around for 15 years, those are good things because it shows you've been established. If I am using AI, and I see that Jay just set up a new social media account yesterday, a new email address yesterday, his phone's only a week old, that's some red flags right there. So no, I'm kind of showing you extreme cases, but the reality is AI can connect to who your friends might be, who your family members are, and go deeper to show that, yes, you're probably a legitimate person.

Jay Lindsay:

So Gen AI ... We know Gen AI can help fight Gen AI fraud. Can you talk about ways that the Fed can help do this, things that we're doing?

Mike Timoney:

So, what we continue to do is look at how to create awareness around the problem. So, we continue to do a lot of presentations to try and bring awareness to this. We continue to try to write articles to update the Synthetic Identity Fraud Toolkit that we have already. Synthetic is one of the key pieces of information that we'll continue to focus on.

Jay Lindsay:

Maybe you can characterize now as, as we wrap up, just how concerned are you about the potential for Gen AI to really ramp up the problem of synthetic identity fraud?

Mike Timoney:

So, that's a good question, Jay. I think with any technology that comes about, whether it was the iPhone when it came about or computers when we started using computers, someone will look for a way to use them for the bad, right? And so, when I think about Gen AI, yes, it's going to have a challenge for us in the fraud-fighting business to do it. But I don't think synthetic is going to be any more of a problem than it is today.

We in fraud prevention tend to be a little bit behind and a little bit more reactive. But once we get there, we're okay. So, I think the answer to your question is, I'm not overly concerned that synthetic's going to run away. I think that Gen AI is going to affect fraud in general on an upward swing. And then, ultimately, we'll use it to fight it.

Jay Lindsay:

Great. Thanks, Mike. That's interesting stuff. I really appreciate you coming back and talking to us today.

Mike Timoney:

My pleasure. Thanks. Thanks for having me.

Jay Lindsay:

You can find the Fed’s Synthetic Identity Fraud Mitigation Toolkit, including the latest information on how Gen AI is changing things, on fedpaymentsimprovement.org. You can also find information about mitigating payments fraud on bostonfed.org. We have a couple articles from Mike up that are worth your time. And check out bostonfed.org/sixhundredatlantic for more podcast interviews and seasons. An easy way to stay up to date on new episodes is to subscribe to our email lists. You’ll be notified whenever a new one drops. And please don’t forget to rate, review, share, and subscribe to Six Hundred Atlantic on your favorite podcast app. I’m Jay Lindsay, and this is Six Hundred Atlantic. Thanks for listening.