According to Allstate Insurance, in 2018 alone, 14.4 million people were victims of some type of identity theft. Most often, identity thieves use stolen personal information for illicit financial gain. They typically use the dark web to obtain the information they need, such as real names, birth dates, and Social Security numbers.
The U.S. Code (representing the consolidation of the permanent laws of the United States), Title 18, Part 1, Chapter 47, Section § 1028 deals with fraud and related activity in connection with identification documents, authentication features, and information. While there are many other additional conditions, this section deals with whoever knowingly and without lawful authority produces an identification document, authentication feature, or a false identification document.
Every U.S. state has laws on their books regarding fraud and identity theft. More than half of the states have specific restitution provisions for identity theft, and some also have forfeiture provisions for these crimes. Others have created identity theft passport programs to help victims prevent continued identity theft and subsequent fraud.
From a legal point of view, identity theft occurs when someone uses another person’s personally identifying information (PII), such as a person’s name, Social Security number, or credit card number or other financial information, without permission, to commit fraud or other crimes. When the criminals combine real and false PII to create entirely new identities, and rapidly ‘spin-up’ many of these identities using artificial intelligence (AI) and machine learning (ML), it’s called synthetic identity fraud (SIF).
To date, Indiana is the only state that has passed a law that specifically deals with SIF, or “Synthetic Identity Deception” as it is referred to in that law. More specifically, in Indiana, it is a Class 6 felony (Ind. Code §35-43-5-3.8). The offense under subsection (a) is a Class 5 (more serious) felony if: (1) a person obtains, possesses, transfers, or uses the synthetic identifying information of more than 100 persons; or (2) the fair market value of the fraud or harm caused by the offense is at least $50,000.
While there are laws on the books that cover identity theft and fraud, deception and scams, clearly SIF and AI/ML are presenting new opportunities for cybercriminals. Shutting down these criminal exploits requires the passage of new laws with expanded scope and new formulations that reflect the new ways these crimes are being committed. New laws, coupled with technology solutions, are the critical elements required to more effectively counter and ultimate solve this insidious type of financial crime.