How People Commit Credit Card Fraud (And Why Your Normal Behavior May Look Risky To A Bank)

After writing recently about proposed legislation in New York where banks would have to let you redeem your accumulated points even if they decided to close your account, I wound up having several conversations with readers about the kinds of activities that look risky to a bank and may make them decide they don’t want your business anymore.

I was reminded about something I wrote two years ago based on a presentation at a credit card industry conference I spoke at: a talk by Steve Lenderman, Fraud Operations Lead for Paypal, who talked about how people commit fraud against financial institutions. He explained in particular why having a lot of authorized users, and why making mid-cycle payments to a card, can look like fraud. And behaviors undertaken by bad actors look suspicious when they’re legitimately undertaken by the rest of us.

Fraudsters create synthetic identities and it’s easier to do it than most people would imagine. They’re creating a person financially or digitally that doesn’t exist, new identifies using a combination of real data and fabricated information.

  • Social security numbers are easy for people who know what they’re doing. Prior to 2008 social security numbers weren’t randomized, and there’s still an algorithm used to create these numbers.
  • Social security numbers that get targeted most are ones infrequently used — those of children and the elderly — he recommends freezing the credit file of your children.
  • Everyone’s data is out there. Using social security numbers, dates of birth, and mother’s middle name for validation has become worthless, after the Equifax breach but even before.

Here’s how a phantom borrower is born. The scammer creates their fake identity, gets a fake ID and decides what social security number to use. They go into a store, say Target, and they’re offered a credit card at checkout. The clerk at the store isn’t looking for fraud, they’re incentivized for getting the application.

  • Applying creates a credit file.
  • They’re probably turned down for credit.
  • They go back 2 or 3 times to different issuers and do that again. Now there’s more data in the file.
  • Eventually a bank will approve with a small limit. That bank has a limited risk (because of the small limit) but the ‘person’ now exists.

There are super easy cards to get with $500 limits. Then that person gets marketed to for more cards.
The identity itself is worth more than the credit lines, so they don’t go spend the $500. Their credit lines increase as bills get paid.

The ‘person’ is able to apply for credit, open deposit accounts, purchase insurance policies, enroll in medical benefits, and obtain drivers licenses and passports.

  • The process gets sped up through authorized users. They’ll pay to be added to an existing real account as an authorized user. They use credit repair services which are viewed as ‘legalized brokers’.

  • When these new authorized user accounts report to credit bureau, they can improve the FICO score. It’s not uncommon to see accounts with 70 or more authorized users because people are selling their authorized user additions.

  • Every 10-21 days (depending on the speed of reporting) FICO scores will jump 30-60 points. So they sit on it for six months and they’ve got a 750 score. Then the authorized users start to become primary cardholders. Someone that’s an authorized user on 70-80 accounts is a future credit risk, having 10 or more authorized users on your own cards is a fraud flag.

Large banks are bigger targets than small credit unions, it’s easier to hide within millions of customers. 85% of identity theft is tied to synthetics. There’s $355 million in outstanding credit card balances owed by people that don’t exist (and this is up eight-fold over the last 5 years).

There are 6 million new credit files each year with little or no data/history. There are 20 million valid identities with overlapping social security numbers. There is no person victim to report the fraud, no real person to inquire of for collections. Most of this is treated as a credit loss and charged off.

These synthetic identities apply to rewards accounts, too. They stick it to the bank for the transactions and earn rewards doing it.

Customers do payment kiting between accounts. They take their $10,000 card, buy $10,000 worth of stuff at Macy’s, and send in a $20k payment from a checking account with $50 in it. Now they have more credit to spend at the store the next day, before the $20,000 payment bounces. This is one reason banks may flag mid-cycle payments.

There are also merchant rings that ‘cut out the middle man’ of Macy’s or Best Buy. The merchant runs a $10,000 charge and writes a check back to the cardholder for the net (mins merchant fees). Or they use fictitious merchants — it’s easy to become a small merchant with credit card processing.

Credit repair services can be used to preserve synthetic identities taking advantage of the ability to dispute inaccuracies on a credit bureau. Some institutions can’t manage to complete their investigation and respond within 30 days and so negative items come off a report. People will dispute the same items over and over until the institution fails to respond in time.

Ultimately credit reports that look like reports which have been used for fraud in the past get flagged.

About Gary Leff

Gary Leff is one of the foremost experts in the field of miles, points, and frequent business travel - a topic he has covered since 2002. Co-founder of frequent flyer community, emcee of the Freddie Awards, and named one of the "World's Top Travel Experts" by Conde' Nast Traveler (2010-Present) Gary has been a guest on most major news media, profiled in several top print publications, and published broadly on the topic of consumer loyalty. More About Gary »

More articles by Gary Leff »



  1. Great summary; it’s both impressive and scary that this is such a “long con.” How would this change if the target had already frozen their credit at Equifax, Experian, and TransUnion?

  2. Very interesting- have read a bit about this as the term “bust out risk”. Like you said, a credit profile is built up slowly, because it’s synthetic it doesn’t affect the profile of the fraudster. Then once high enough credit scores are attained, multiple cards with high credit lines are obtained within a few months, followed by running up huge charges and “busting out” as the synthetic person disappears and never pays anything off.

    This is why the credit card issuers have gotten more sensitive about multiple recent applications for credit, even with other issuers.

  3. Synthetic fraud is an issue because banks haven’t improved their algorithms enough. Look at what Palantir has done to improve ‘vetting’ of foreign nationals. There is enough data out there for banks to distinguish a real customer from a synthetic – they just need to make an effort to get and use it.

  4. It is mind boggling that CRAs do not flag duplicate SSNs across .multiple “individuals.” Or flag SSNs that were clearly issued before the person turns 18. Either the IT systems are incredibly antiquated or they just don’t care. I hope that every Congressman is the victim of identity theft so that we can finally get appropriate regulation from Washington.

  5. Thanks for the report. Interesting stuff. I have a college-aged family member and I can tell that the banks are “checking his identity” more than other young adults I’ve helped in the past. We’ve had to do things like send in copies of ID and such. No big deal, just a modest hassle. I’m now guessing this extra scrutiny is in response to the fictitious person problem you’re discussing.

    Your post also suggests that it’s a good idea not to get too many authorized users on your accounts. I’ve never “gone crazy” with this like some have to exploit (say) AMEX Offers, but I have gotten AMEX cards for all my immediate family members to qualify for more Offers. I think that’s probably fine, but it also seems like you shouldn’t get additional cards for other accounts unless you really need them. Better to be safe than sorry on this stuff.

  6. Hey, Gary…idea for a follow-up. It seems every time I travel, some account is hacked (my SPG Amex twice, my Barclay Aviator once and — most recently — $900 was siphoned out of my PayPal account). I have strong passwords, two-factor authentication wherever possible, I line my travel wallet to prevent RFID attacks, etc. What else can/should/must we do? And what are our options for WiFI access when traveling? It is so easy to think that the WiFi access offered by lounges (e.g., Admirals Clubs, etc.) are relatively “safe” — but are they? Also, interesting data point: I spent a couple hours each way recently in Doha’s Al Mourjan lounge. Not a single computer terminal had an active antivirus program. I pointed this out to the lounge’s IT “manager” on my outbound visit. On my return a week later, nothing had changed! I’d love to see a series of articles on how to protect ourselves.

  7. I wish I was there. My type of business commands me to do 2-3 MM a year with PayPal and have been with them since 2000. Their system is flawed especially when we encounter a case that is CLEARLY identity fraud. Paypal makes it very difficult to stop these folks despite numerous phone calls to their phone centers in the philippines and the US. We have clearly explained to them many times how frustrating it is compared to the old days and how they have removed many of the tools we used to rely on to make a decision on whether a person is legit or a scam ( like the old rating system they used to have). Im sure they are making a fortune, but not nearly as much as they could be making if they didn’t have some of their procedures in place in instances where there is CLEAR fraud involved.

  8. @Jim F

    Your accounts should not be getting hacked that often. Are you sure your computer is not compromised?

  9. It seems like a lot of work, a long time and a lot of organizational skills to create fake identities. if the scammers would devote the same resources to work or school, they could probably be very successful at a legitimate business.

  10. Note: many of the VPN services out there are just cons themselves. Supposedly protecting you from others, while they just monitor and sell your data themselves.

    So, before choosing one, be sure to do your due diligence. There are lots of reviewer articles it there on security websites.

  11. Gary,

    I’m not sure if you’ve written about it before, but here’s a very informative white paper from Experian about how they calculate “bust-out fraud” risk. Part of what is describes is how churners with excellent credit can end up looking like a huge fraud risk if they open cards too quickly and suffer adverse action as a consequence.

    Chase, for example, is known to run the bust-out score on new applications. So some churners, if they’re not careful, may get a swift axe and all their accounts closed.

  12. “Everyone’s data is out there. Using social security numbers, dates of birth, and mother’s middle name for validation has become worthless, after the Equifax breach but even before.”

    Could not agree more.

  13. Agree with using a VPN. I used to work for the #2 U.S. bank and worked from home. I couldn’t login to the bank systems without going through the enterprise VPN on my laptop. That’s when I signed up for a VPN for my own laptop. I also use it on my tablet and my cell phone. A VPN creates a secure, encrypted connection between your device and the site you’re trying to reach, making your activity invisible to those trying to hack your system. I also use a TOR-based browser to ensure my online activity isn’t tracked.

    As a frequent traveler, I have found two other advantages. First, I can use some streaming services overseas by setting my VPN location to a U.S. server. Second, I have occasionally found that by setting my location to say, Switzerland, that I have found better fares when booking Lufthansa and the same goes for other airlines (sometimes certain taxes are not assessed).

  14. @Gary: “Here’s how a phantom borrower is born. The scammer creates their fake identity, gets a fake ID and decides what social security number to use.”

    How do they get a SSN?

  15. This kind of stuff with identity theft is why some parents of Americans born abroad don’t always want to apply for the child’s Social Security number at the time of applying for the citizenship paperwork and US passport of the US child born and living abroad. Fortunately, US citizens without a SSA number can still get passports without having SSA number.

  16. Nick,

    Sounds good in an ivory tower, but in the real world the costs of incarceration are very high. Burning good money after bad sounds like a waste of money. Crime prevention should be the name of the game, while keeping in mind that growing the prison industrial complex is not a great way to prevent crime.

    There are other models out there to reduce the ability for fraudulent identity-based credit theft to hit lenders. Look at what the Scandinavian countries have pulled off to reduce credit theft.

Leave a Reply

Your email address will not be published. Required fields are marked *