Fake identities built from stolen numbers double in two years

Synthetic identity fraud has doubled its share of fraudulent applications in Canada between 2022 and 2024, according to the latest data from Equifax. The method involves criminals combining a real Social Insurance Number with a fabricated name, birthdate, and address to create a person who does not exist. The Digital ID and Authentication Council of Canada describes these constructed profiles as active threats to the financial system.

The volume of these fake personas has grown rapidly. Criminals now use artificial intelligence tools to assemble convincing identities in seconds. This speed allows fraudsters to build credit histories for non-existent people before lenders detect the error. The result is a surge in bad debt and administrative costs for banks and retailers.

Dave Lewis, global advisory chief information security officer at Toronto-based 1Password, explained that these profiles are formed from parts of several real people. He noted that the term 'digital Frankenstein' is used because the identity is stitched together from various components. The fraudster nurtures these fake profiles for months or years to establish a good credit score. Once limits are raised, the fraudster maxes out the credit and disappears.

Carl Davies, head of fraud and identity at Equifax Canada, stated that there is currently no single automatic public alert triggered when a SIN is harvested for this purpose. Because the synthetic profile uses a different name, the real SIN owner's existing credit report typically remains unaffected. Fraudulent debts rarely appear on the actual owner's file. Victims often discover the issue only when they face delays or errors while applying for their own credit.

Certain groups are more attractive targets for these fraudsters. SINs belonging to newcomers, deceased persons, and children are frequently used because their files are often inactive. Davies pointed out that children generally do not have existing credit reports. This lack of a history allows fraudsters to build credit and accumulate debt on a child's SIN for many years without detection.

AI technology has industrialized this type of fraud in three specific ways. First, it cleans and matches billions of stolen records to create coherent address histories and employer details. Second, it generates realistic headshots and deepfake videos to pass biometric checks. Third, it creates fake email histories and social media footprints to make the digital record look legitimate. Lewis said the synthetic identity now has a voice, a face, and a past.

These fake identities are used for credit card bust-outs, mule accounts for money laundering, and device financing. Criminals also use them to claim government benefits and open seller accounts on online marketplaces. To protect their SINs, experts advise treating the number like a bank password and only sharing it with employers, banks, and the CRA. Ontario residents can freeze their credit at Equifax, a process that became available on July 1. This freeze blocks new credit from being opened in their name and is free to lift. Users should check both credit bureaus once a year for unknown inquiries or name variants. If a fraud is discovered, individuals should report it to the Canadian Anti-Fraud Centre, both credit bureaus, and Service Canada. A replacement SIN is possible in proven cases, but the old one stays live in the system.

The rise in synthetic fraud places pressure on lenders to improve detection methods. Banks are adopting selfie verification steps, but AI can now hijack camera feeds to bypass these checks. The financial cost of these fake profiles continues to rise as criminals exploit the gap between real data and fabricated details. The system relies on the assumption that every customer is a real person, an assumption that is increasingly difficult to verify.