The Father, the Son and a $2.26 Million Synthetic Identity Scheme

Federal prosecutors say a father-and-son fraud operation built fake credit profiles around stolen identities, often belonging to children, then turned them into a decade-long spending machine.

–

For more than a decade, the identities allegedly applying for credit cards across Western New York looked real enough to pass through the system. The Social Security numbers were valid. The mailing addresses existed. Payments were made. Credit limits increased.

But federal prosecutors say many of the applicants never existed.

A federal grand jury has returned a 19-count indictment charging Pittsford, New York, residents Talib Hussain, 75, and Mirza Khan, 48, in an alleged synthetic identity fraud scheme that generated approximately 1,072 online credit and debit card applications and inflicted an estimated $2.26 million in losses on major financial institutions.

The alleged operation did not simply steal existing identities. Prosecutors say the defendants and their co-conspirators obtained legitimate Social Security numbers belonging to real people, often children, and used them without permission to construct entirely new financial identities.

Those manufactured borrowers were then unleashed on the banking system.

–

Real Numbers. Invented People.

Synthetic identity fraud is especially difficult to detect because it blends authentic personal information with fabricated names, addresses or other identifying details.

Unlike conventional identity theft, in which a criminal impersonates a specific victim, a synthetic identity may be assembled piece by piece until it develops what appears to be a legitimate credit history.

Children can be particularly attractive targets. They rarely apply for credit, frequently have clean Social Security numbers and may not discover the damage until years later, possibly when they apply for their first apartment, vehicle loan or credit card.

According to the indictment, Hussain, Khan and their alleged co-conspirators used stolen Social Security numbers to submit roughly 1,072 applications to financial institutions between approximately 2012 and July 23, 2024.

The scheme allegedly continued for nearly 12 years.

–

Apartments Became Credit-Card Collection Points

Prosecutors allege the group rented apartments throughout the Western District of New York and used the addresses as destinations for cards issued in the names of the synthetic identities.

Once the cards arrived, the defendants allegedly used them to make purchases at retailers including Apple, BJ’s and Sam’s Club.

But the alleged spending did not stop with outside retailers.

Federal prosecutors say the cards were also used at businesses controlled by the defendants, including Lucky Beverage, Chili Express Mart and Easy Food Market. Some of the accounts were allegedly used to pay property taxes on three Rochester properties.

That gave the alleged scheme several ways to convert manufactured credit into real economic value.

Bad Checks Allegedly Created More Spending Power

One of the indictment’s most significant allegations involves how the group allegedly manipulated available credit.

Prosecutors say fraudulent checks were submitted as payments against the synthetic accounts. Before those checks were rejected or discovered, the apparent payments temporarily reduced account balances and reopened available credit.

That allowed the cards to keep spending.

The balances were ultimately left unpaid, according to the government, leaving financial institutions with approximately $2,257,697 in combined losses, and leaving the real owners of the stolen Social Security numbers with damage attached to identities they may not have known were being used.

The affected institutions allegedly included:

American Express
Bank of America
Barclays Bank Delaware
Capital One
JPMorgan Chase
Citibank
Comenity Bank
Discover Bank
First National Bank of Omaha
Synchrony Bank
U.S. Bank

–

A Warning Hidden Inside 1,072 Applications

The volume of applications is striking, but the duration may be the larger warning.

If the allegations are proven, the scheme survived through multiple generations of fraud controls, identity-verification systems and credit-underwriting technology. It allegedly operated while applications moved online and financial institutions invested billions of dollars in data analytics, authentication and fraud prevention.

Yet more than 1,000 applications were allegedly submitted before the operation was dismantled.

For lenders, the case exposes the weakness of relying too heavily on a valid Social Security number as proof of a valid applicant. Authentic identity data does not necessarily mean the person presenting it is authentic, or that the credit profile built around it belongs to anyone who actually exists.

It also demonstrates why apparently successful payment activity may not indicate account legitimacy. Fraudulent payments can be used strategically to establish credibility, preserve an account or temporarily create additional purchasing power before the eventual loss.

The danger becomes even greater when the victim is a child whose credit file may go unmonitored for years.

–

Up to 30 Years in Federal Prison

Hussain and Khan are charged with conspiracy to commit bank fraud, wire fraud and access-device fraud, along with access-device fraud and aggravated identity theft.

The charges carry a maximum possible penalty of 30 years in prison and a $1 million fine.

The case is being prosecuted by Assistant U.S. Attorney Meghan K. McGuire following an investigation involving the FBI, IRS Criminal Investigation, the U.S. Postal Inspection Service and the Social Security Administration Office of Inspector General.

The indictment contains allegations only. Hussain and Khan are presumed innocent unless and until proven guilty.

Source: U.S. Attorney’s Office for the Western District of New York