Ground-breaking research uncovers novel tactics of organized fraudsters – from China, Russia, and other nations – against U.S. government programs 

Socure, the leading platform for digital identity verification, compliance and fraud prevention operating in over 190 countries, released a new report that details common patterns of organized fraud networks from countries including China and Russia targeting U.S. public sector agencies.

According to reports from the Government Accountability Office, fraud costs the federal government upwards of $500 billion annually. During the pandemic, government agencies were flooded with fraudulent applications that went undetected by outdated methods and legacy providers. Now, AI-powered technologies are enabling fraudsters to supercharge their efforts, hitting government agencies and commercial entities at once, with relentless speed, and at scale.

Cyber Technology Insights : SpyCloud Appoints Brad Rouse as Chief Revenue Officer Amid Growing Demand

“This research confirms what many of us have known – government agencies are under coordinated attack from nation states hellbent on exploiting weaknesses in existing identity infrastructure,” said Jordan Burris, Head of Public Sector at Socure. “This is a matter of national security. We need urgent investment in modern, accurate, and intelligence-led identity verification systems to defend against these threats. The time for half measures is over.”

The report, entitled “Fraud in Focus: Exposing Organized Fraud Patterns in Government Programs,” details three suspected fraud rings uncovered by Socure researchers. The rings – two international and one domestic – use a variety of tactics detected by Socure’s AI-enabled verification platform. Common techniques included exploiting real Personally Identifiable Information, using fabricated business domains, shifting IP addresses through VPN providers, and submitting suspicious or mismatched phone numbers and emails.

Additional key findings include:

  • U.S. government programs are attacked by international fraud groups originating from China, Russia, Egypt, Poland and several other nations. In this study, international bad actors were responsible for up to 12% of all incoming applications for government services and/or loans.
  • Fraudsters target multiple government agencies at once. At least 1 in 4 fraud attempts targeted more than one agency.
  • Fraudsters are more likely to steal real identities rather than create fabricated ones. Fraudsters were about four times more likely to use stolen identities instead of synthetic identities.
  • Bad actors attack both government and commercial entities with the same identities. Commercial entities including fintechs and traditional banks, credit unions, auto lenders, telecommunications companies, online gaming and gambling were also targeted.
  • Bad actors evolve tactics to avoid detection. IP addresses, email addresses and domains linked to an identity were shifted several times within a given day, severely limiting a rules-based or black-list approach to detection.

Cyber Technology Insights : T-Mobile and Palo Alto Networks to Launch Managed SASE Offering for Wireless Devices

For the report, Socure conducted two distinct evaluations across government programs, each designed to surface fraud patterns.

The first analysis was conducted over a six-month period (September 1, 2024 – March 1, 2025) and leveraged Socure’s Sigma Identity and Sigma Synthetic scores to identify high-risk fraud events, categorizing them as either synthetic identity fraud or identity theft. This dataset was used to support qualitative insights and to illustrate distinct fraud types and behavioral trends observed within government program activity.

The second analysis spanned a longer timeframe (January 2023 – March 2025) and focused on identifying international attack infrastructure. This research incorporated IP address geolocation, time zone analysis, and behavioral analysis to highlight patterns associated with coordinated fraud activity originating outside the United States. This analysis was intended to support broader risk intelligence community efforts.

Together, these analyses provide insight into the evolving threat landscape impacting public sector services and offer actionable steps to strengthen identity verification and fraud prevention strategies.

Socure is currently being used by more than 38 state and federal government agencies to stop fraud without compromising access to critical government benefits and services. Socure for Government (SocureGov) has achieved “Moderate” authorization from the Federal Risk and Authorization Management Program (FedRAMP®) and has been named to the State Risk and Authorization Management (dba GovRAMP) Program’s Authorized Product List.

Cyber Technology Insights : SentinelOne Achieves FedRAMP-High Authorization for Purple AI

To participate in our interviews, please write to our CyberTech Media Room at sudipto@intentamplify.com

Source: prnewswire