Fraud in Focus:

Executive Summary

During the pandemic, fraud skyrocketed as government agencies attempted to get critical funds quickly out the door to people in need. Domestic and international crime rings took advantage of outdated verification methods – that relied on credit-header data or knowledge-based authentication – to flood government agencies with fraudulent applications. Not only were billions of dollars lost, but real applicants were blocked from the services they needed because they could not be validated by legacy systems, and sometimes fraudsters got to their benefits first.

Now, fraudsters view government agencies as easy targets and are continuing to exploit their vulnerabilities. According to reports from the Government Accountability Office, fraud costs the federal government up to $500 billion annually.

Criminals are using the stolen identities of Americans to pilfer federal and state government programs at record pace. New, AI-enabled technologies allow bad actors to use increasingly sophisticated fraud tactics to siphon billions away from programs, hitting people at their most critical and often vulnerable moments: in the aftermath of a natural disaster, after becoming unemployed, or when launching their own small business.

And these attackers are not just individuals looking to put a few thousand dollars in their pockets – they are often sophisticated, organized crime networks that steal massive amounts of funds at scale. Researchers from Socure have tracked fraud rings originating in China, Russia, and around the world. And these criminals are getting more sophisticated, deploying techniques, such as the creation of synthetic identities, faster and in greater volume than ever before.

As Washington prioritizes efficiency, one of the most significant opportunities to reduce government waste, fraud, and abuse remains under-addressed: strengthening our digital identity verification systems.

For far too long, fraud has been seen as the cost of doing business in government. But this is a fallacy. With advanced technologies, government can deliver a seamless experience to real people while combating fraud and protecting taxpayer dollars. Across the country, some government agencies are beginning to adopt advanced digital identity verification methods that combine artificial intelligence with machine learning to verify all aspects of identity – and they’re seeing immediate impact. These adopters have reduced the presence of bot attacks, and fake accounts.

This report sounds the alarm on fraud in government programs. The message is clear: fraudsters are attacking government programs with relentless speed, using stolen and fake identities, across state borders and within agencies, often driven by complex crime networks that are difficult to entirely track down and stop.

As government services have become increasingly digital, the need for accurate digital identity verification has never been greater. In order to change the status quo, we must first understand how perpetrators of fraud operate.

Key Findings

This report uncovers a variety of fraud patterns used by domestic and international fraudsters against public sector agencies. Key findings include:

1. U.S. government programs are attacked by international fraud groups originating from China, Russia, Poland, India, South Africa, Philippines, and several other nations.

2. In conducting this research, Socure uncovered dozens of international fraud rings. Attacks ranged in frequency and origin depending on the time of day and government program. International bad actors were responsible for between 2% and 12% of all incoming applications for government services and/or loans.

3. Fraudsters target multiple government agencies at once. At least 25.2% of fraud attempts targeted more than one agency. Once a fraudster establishes an identity with the government, that identity can be used to attack multiple agencies at once.

4. Fraudsters prefer identity theft over synthetic identity fraud. Fraudsters are more likely to steal real identities rather than create fake ones, at a rate of almost 4:1 (79.7% vs. 2.3%). This is likely in an effort to steal real people’s government payments or benefits.

5. Once fraudsters steal identities, they hit repeatedly with little time between attacks. Bad actors committing identity theft trend toward shorter intervals between initial and subsequent attacks, especially as attacks ramp up. Days between attacks range from 21 days to intraday.

6. Bad actors attack both government and commercial entities with the same stolen or synthetic fraud identities. There is a real need for fraud prevention solutions which leverage single consortium data that spans commercial and government programs.

7. Bad actors constantly evolve tactics to avoid detection. For example, the IP addresses, email addresses and domains linked to an identity can shift instantly, often several times within a given day, severely limiting a rules-based or blacklist approach to detection.

The Anatomy of a Fraud Ring

Fraud Ring: International #1

Between October 23, 2024, and November 28, 2024, a sophisticated fraud ring executed over 60 attacks, across multiple government programs, using stolen real identities – with correct Personally Identifiable Information (PII) – but linked to fabricated emails, manipulated foreign IP domains and phone numbers that were associated with multiple individuals.

Here’s how the attack worked:

Personal Information Exploitation

The attackers started out with real identities, leveraging stolen PII that corresponded to real individuals. They used addresses that were predominantly valid and current, with occasional use of previous addresses. Victims were targeted across several states, including Florida, Georgia, Virginia, New York, California, Kansas, North Carolina, and South Carolina.

Email Address Patterns

The perpetrators utilized email domains acquired from international registrars with little to no identity validation or emails tied to several Chinese website domains and a free Japanese VPN website that hides the location where the bad actor is attacking from.

Phone Number Discrepancies

The fraudsters employed 11 distinct phone numbers linked to major national carriers, registered in various locations such as Phoenix, AZ; Shreveport, LA; Placerville, CA; Paris, TX; and Grand Prairie, TX.

IP Address Analysis

IP addresses tied back to VPN providers with medium to high fraud ratings from outside third parties.

Fraud Ring: International #2

In a recent series of identity theft attacks spanning from September 30, 2024 to January 27, 2025, a fraud ring executed 36 fraudulent applications across multiple government programs. This operation exhibited several distinct patterns:

Personal Information Exploitation

The perpetrators utilized real individuals' identities, including accurate addresses associated with the victims. However, the provided email addresses and phone numbers were not linked to these identities.

Email Address Patterns

All fraudulent applications used Gmail or Outlook email addresses following a specific format: a first initial and last name combined with a sequence of numbers. The consistent mismatch between phone number area codes and applicant addresses further underscores the fraudulent nature of these applications.

IP Address Analysis

Over 95% of the IP addresses traced in these attacks originated from Riga, Latvia.

Fraud Ring: Domestic

Between October 10, 2024, and November 22, 2024, a sophisticated fraud ring executed over 120 attacks on at least two government programs, compromising the identities of 86 individuals. While the majority of these cases involved identity theft, a few instances of synthetic identities were also detected.

Email Address Patterns

The perpetrators exclusively utilized mail.com email accounts, crafting addresses that mirrored the applicants' full names.

Phone Number Discrepancies

Two numbers from the same major carrier based in Los Angeles, CA. One number from a different major carrier originating in Cedar Rapids, IA. Notably, the fraudsters used these phone numbers sequentially, fully utilizing one before transitioning to the next.

Dive deeper

Organized Fraud Patterns Against Government

Below, Socure provides critical insights into common fraud patterns used by bad actors to attack government programs.

Glossary of terms

Events analyzed: New applications or registrations for government benefit, drivers license, lending and disaster relief programs.

Fraud classification: Events were categorized as fraudulent only if they scored ≥0.995 in either the Sigma Identity or Sigma Synthetic Score.

Appendix: Methodology

Socure performed two different analyses of differing government programs. Both analyses were focused primarily on a smaller subset of government programs.