Fraud in Focus

Executive Summary

During the pandemic, fraud skyrocketed as government agencies attempted to get critical funds quickly out the door to people in need. Domestic and international crime rings took advantage of outdated verification methods – that relied on credit-header data or knowledge-based authentication – to flood government agencies with fraudulent applications. Not only were billions of dollars lost, but real applicants were blocked from the services they needed because they could not be validated by legacy systems, and sometimes fraudsters got to their benefits first.

Now, fraudsters view government agencies as easy targets and are continuing to exploit their vulnerabilities. According to reports from the Government Accountability Office, fraud costs the federal government up to $500 billion annually.

Criminals are using the stolen identities of Americans to pilfer federal and state government programs at record pace. New, AI-enabled technologies allow bad actors to use increasingly sophisticated fraud tactics to siphon billions away from programs, hitting people at their most critical and often vulnerable moments: in the aftermath of a natural disaster, after becoming unemployed, or when launching their own small business.

And these attackers are not just individuals looking to put a few thousand dollars in their pockets – they are often sophisticated, organized crime networks that steal massive amounts of funds at scale. Researchers from Socure have tracked fraud rings originating in China, Russia, and around the world. And these criminals are getting more sophisticated, deploying techniques, such as the creation of synthetic identities, faster and in greater volume than ever before.

As Washington prioritizes efficiency, one of the most significant opportunities to reduce government waste, fraud, and abuse remains under-addressed: strengthening our digital identity verification systems.

For far too long, fraud has been seen as the cost of doing business in government. But this is a fallacy. With advanced technologies, government can deliver a seamless experience to real people while combating fraud and protecting taxpayer dollars. Across the country, some government agencies are beginning to adopt advanced digital identity verification methods that combine artificial intelligence with machine learning to verify all aspects of identity – and they’re seeing immediate impact. These adopters have reduced the presence of bot attacks, and fake accounts.

This report sounds the alarm on fraud in government programs. The message is clear: fraudsters are attacking government programs with relentless speed, using stolen and fake identities, across state borders and within agencies, often driven by complex crime networks that are difficult to entirely track down and stop.

As government services have become increasingly digital, the need for accurate digital identity verification has never been greater. In order to change the status quo, we must first understand how perpetrators of fraud operate.

Key Findings

This report uncovers a variety of fraud patterns used by domestic and international fraudsters against public sector agencies. Key findings include:

• U.S. government programs are attacked by international fraud groups originating from China, Russia, Poland, India, South Africa, Philippines, and several other nations.
• In conducting this research, Socure uncovered dozens of international fraud rings. Attacks ranged in frequency and origin depending on the time of day and government program. And international bad actors were responsible for between 2% and 12% of all incoming applications for government services and/or loans.
• Fraudsters target multiple government agencies at once. At least 25.2% of fraud attempts targeted more than one agency.
• Once a fraudster establishes an identity with the government, that identity can be used to attack multiple agencies at once.
• Fraudsters prefer identity theft over synthetic identity fraud. Fraudsters are more likely to steal real identities rather than create fake ones, at a rate of almost 4:1 (79.7% vs. 2.3%). This is likely in an effort to steal real people’s government payments or benefits.

The Anatomy of a Fraud Ring

Fraud Ring: International #1

Between October 23, 2024 and November 28, 2024, a sophisticated fraud ring executed over 60 attacks, across multiple government programs, using stolen real identities – with correct Personally Identifiable Information (PII) – but linked to fabricated emails, manipulated foreign IP domains and phone numbers that were associated with multiple individuals.

Here’s how the attack worked:

Personal Information Exploitation

The attackers started out with real identities, leveraging stolen PII that corresponded to real individuals. They used addresses that were predominantly valid and current, with occasional use of previous addresses. Victims were targeted across several states, including Florida, Georgia, Virginia, New York, California, Kansas, North Carolina, and South Carolina.

Email Address Patterns

The perpetrators utilized email domains acquired from international registrars with little to no identity validation or emails tied to several Chinese website domains and a free Japanese VPN website that hides the location where the bad actor is attacking from:

• Several email domains tied back to Chinese websites with similar landing pages describing a service called DDNS Now.
• Attackers can leverage DDNS services to change the IP address operating in mainland China to make it appear they are coming in from a different location, such as a US address.

Phone Number Discrepancies

The fraudsters employed 11 distinct phone numbers linked to major national carriers. These numbers were registered in various locations such as Phoenix, AZ; Shreveport, LA; Placerville, CA; Paris, TX; and Grand Prairie, TX. Many numbers were associated with multiple identities across differing states and did not correspond to the legitimate individuals' information.

IP Address Analysis

IP addresses traced back to VPN providers with medium to high fraud ratings from outside third parties in:

• Canada
• England
• Finland
• Germany
• Romania
• UAE

This strategic rotation of IP addresses indicates an effort to obfuscate fraudulent activities and evade detection.

Fraud Ring: International #2

In a recent series of identity theft attacks spanning from September 30, 2024 to January 27, 2025, a fraud ring executed 36 fraudulent applications across multiple government programs. This operation exhibited several distinct patterns:

Personal Information Exploitation

The perpetrators utilized real individuals' identities, including accurate addresses associated with the victims. However, the provided email addresses and phone numbers were not linked to these identities. Notably, every phone number featured an area code that did not correspond with the applicant's address—a red flag, especially when occurring consistently.

Email Address Patterns

All fraudulent applications used Gmail or Outlook email addresses following a specific format: a first initial and last name combined with a sequence of numbers (2, 3, 6, 7, 8, or 9). Crucially, these initials and surnames did not match those of the applicants. For example, an application under the name "John Johnson" might use an email like "ssmith6329@gmail.com."

IP Address Analysis

Over 95% of the IP addresses traced in these attacks originated from Riga, Latvia. Additional IP addresses were linked to Johannesburg, South Africa; Stockholm, Sweden; and Chicago, Illinois, suggesting an international dimension to the fraud ring's operations.

Fraud Ring: Domestic

Between October 10, 2024, and November 22, 2024, a sophisticated fraud ring executed over 120 attacks on at least two government programs, compromising the identities of 86 individuals. While the majority of these cases involved identity theft, a few instances of synthetic identities were also detected.

Email Address Patterns

The perpetrators exclusively utilized mail.com email accounts, crafting addresses that mirrored the applicants' full names. Due to existing email address constraints, they appended small numerical combinations—specifically 5, 7, 9, or 10—to the usernames. For example, an individual named Jane Doe might have an email like janedoe7@mail.com.

Phone Number Discrepancies

• Two numbers from the same major carrier based in Los Angeles, CA.
• One number from a different major carrier originating in Cedar Rapids, IA.
• Four numbers associated with SaaS platform phone companies, with accounts registered in Keys, FL, and Troy, MI.

Notably, the fraudsters used these phone numbers sequentially, fully utilizing one before transitioning to the next. This pattern indicates a strategic approach to communication, possibly to minimize the risk of detection.

Organized Fraud Patterns Against Government

Below, Socure provides critical insights into common fraud patterns used by bad actors to attack government programs. The following examples do not contain real consumer data — fake data is used to replicate the types of patterns uncovered in the analysis.

| When establishing Social Security Numbers (SSNs) for synthetic accounts, oftentimes the SSNs reflect a non-random pattern. | | --- | --- | | Examples of suspicious patterns and non-suspicious random patterns are provided in the table. Interestingly, bad actors will sometimes use the same numbers or letters when they create new emails or SSNs. | | 450-00-2415 | 666-23-0987 | | 450-00-2514 | 450-00-4620 | | 450-00-4512 | 231-00-5911 | | 231-00-2511 | 773-37-4933 | | 231-00-4152 | 450-37-0000 | | 231-00-5214 | 000-37-9731 | | | 231-00-2514 | 450-00-2152 |

IP Addresses and Domain Names in International Fraud Attacks

Government programs are attacked by both domestic and international fraud groups. Telltale signs of attacks by foreign actors can be found within IP addresses and timezones as well as domain names and their registrars.

Overlap of Government and Commercial Fraud

Socure further analyzed the data to see if the same set of fraud attacks launched against government agencies were also launched against commercial entities...

Glossary of terms

Additional details and general term definitions used in this report include definitions such as Events analyzed, Fraud classification, Attack rate definition, and Overlap rate definition.

Appendix: Methodology

Socure performed two different analyses of differing government programs...