Does Having a Common Surname Make You More Prone to Identity Theft?

In a webinar about The Journey of a Stolen Identity, a member of the audience asked an interesting question that panelists Eva Velasquez (President and CEO of the Identity Theft Resource Center) and Dr. David Maimon (Head of Fraud Insights at SentiLink) didn't have time to answer in depth. Paraphrasing it slightly:

Is identity theft different with common names like "Smith," compared to uncommon names?" 

It's an interesting question, so after the webinar, we decided to dig into the data to see if there were any notable patterns.

Do identities with more common surnames get stolen more?

If you're just here for the short answer: probably not. But as you might expect, the full answer is a little bit more complicated.

The data

SentiLink's solutions verify 3M identities and stop 40k+ instances of ID theft every single day, so we have a lot of data we can leverage for this sort of investigation. We verify identities through a combination of automated risk scoring via machine learning and the human insight of our Fraud Intelligence Team, who constantly review cases manually to help our partners catch more fraud and to improve our machine learning models. 

This gives us two different ways we can look at identity theft cases:

• Cases that were labeled identity theft by our Fraud Intelligence Team
• Cases that were scored as very high ID theft risk by our model
  
  

For this investigation, we decided to look at both. Specifically, we investigated two datasets:

• Surname proportions (how many times each surname appears as a percentage of the total number of cases) in 42,637 cases that were labeled identity theft by our FIT team, compared against surname proportions in a control dataset of 49,478 cases that our FIT team labeled clear (i.e., not fraud).
• Surname proportions in 99,964 cases with ID theft scores above 900 (very high risk), compared against surname proportions in a control dataset of 99,853 cases with ID theft scores below 150 (low risk).

We also used chi-square tests for both datasets to determine whether the difference in proportions between common surnames was statistically significant (p =< 0.05). 

The results

In both datasets, we found that a few surnames appeared more frequently in ID theft cases than in clear cases. However, none of the top 20 most common surnames had statistically significant differences in both datasets. Some common names such as Smith did appear more frequently in both datasets, but in these cases the difference was only statistically significant in one of the two. 

Our conclusion is that there is no convincing evidence that ID thieves target common names any more frequently than they target uncommon ones. When it comes to identity theft, we are all more or less equally at risk (at least as far as our surnames are concerned). 

What about surnames used for synthetic fraud?

Since one of SentiLink's specialties is catching synthetic fraud, we thought it would also be interesting to look at what surnames are most frequently used there.

Specifically, we looked at third-party synthetic fraud, in which fraudsters invent an entirely fictitious identity. We already know synthetic fraudsters make some interesting choices when inventing their DOBs — given the ability to choose their fake identity's name, would fraudsters select more common surnames in the hopes of blending in?

We investigated this question using a dataset of 6,535 third-party synthetic identities (where an identity is a specific name, DOB, and SSN combination), each with at least five applications in our database. Comparing this data against a dataset of more than 171,000 non-synthetic identities (identities with applications that scored as low-risk for third-party synthetic fraud) and also against 2010 census data on surnames, we found that synthetic fraudsters do indeed choose common surnames at a higher rate than they exist in the general population:

Open a larger version of this chart in a new tab.

All five surnames appear 2-3x more frequently in our synthetic dataset than they do in the 2010 census data. All but "Williams" appear at least twice as frequently in the synthetic identity data as in the clear identity data. 

This may reflect an active attempt on the part of some synthetic fraudsters to fly under the radar, picking names that won't stand out in the crowd. But it may also be that since these surnames are the most common in the US, they're simply more likely to be top-of-mind when fraudsters are thinking of names to attach to a new synthetic identity. 

(Note: although the difference is far more pronounced for synthetic identities, surname frequency among SentiLink's clear applications also differs from the US Census data. This is likely due in large part to the fact that SentiLink's data comes overwhelmingly from the population of credit-active adults and thus is not a representative sample of the entire US population.)

Conclusions

It might seem to make sense that using a common surname might help identity fraudsters "hide in plain sight," but we did not find evidence that this is happening in cases of identity theft. 

Synthetic fraudsters, however, do seem to choose common surnames at a higher rate than they occur in the general population.