Name Alteration

Name Alteration is the deliberate manipulation of an individual’s personal name—through legal name changes, aliases, slight misspellings, transliteration shifts, or nom de guerre—to sever or weaken an information trail that would otherwise expose sanctions hits, negative media, or prior suspicious-activity reports. Unlike wholesale identity fraud (which fabricates an entirely new persona), Name Alteration preserves most biographic markers—date of birth, nationality, biometric likeness—while subverting controls that rely heavily on exact‐string or near-string matching.

Criminal actors exploit several systemic blind spots. First, many screening engines prioritize orthographic exactness: a single dropped vowel, an inserted diacritic, or the reversal of given and family names can defeat automated filters [6]. Second, civil-registry procedures in some jurisdictions permit rapid, low-cost legal name changes; once new passports or driver’s licences are issued, downstream financial institutions accept them as authoritative [8]. Third, global inconsistencies in romanizing non-Latin scripts—e.g., Arabic, Cyrillic, Chinese—generate multiple legitimate renderings of the same name, giving launderers plausible deniability when one spelling is black-listed but another is not [10].

Operationally, Name Alteration frequently appears at the access-facilitation stage of money-laundering workflows. By onboarding under a subtly altered spelling, a politically exposed person or previously de-banked fraudster obtains fresh customer records and account numbers unlinked to historical alerts. Once an alias account is live, subsequent placement and layering transactions enter the financial system with a reduced baseline risk score, making downstream detection markedly harder.

Cultural practices reinforce the technique’s potency. Illicit actors may adopt Arabic kunyas (“Abu X”) [14] that obscure birth names in remittance instructions. In Spanish-speaking contexts, fluid ordering or omission of maternal surnames can create legitimate-looking variants of the same individual. In East Asian contexts, the same Chinese characters may be romanized as Li Wei, Lee Way, or Li Wai depending on the transliteration standard employed. Unless screening systems normalize such variants, each representation can masquerade as a distinct, low-risk customer.

The technique’s strategic value is amplified by the growth of remote, automated onboarding and unsupervised e-KYC pipelines. Such workflows are vulnerable when tuned to exact-match confidence thresholds which can be gamed by minimal spelling changes that escape human review.

[
Code
T0023.002
]
[
Name
Name Alteration
]
[
Version
1.1
]
[
Parent Technique
]
[
Risk
Customer Risk, Jurisdictional Risk
]
[
Created
2025-02-13
]
[
Modified
2025-05-30
]

Alias Use

Rebranding

Name Change

A.K.A. abuse

Legal Name Change Fraud

Misspelled-Name

Transliteration Gaming

Nom de Guerre \ Kunya

Identity Morphing

Tactics

Using aliases or minor spelling changes breaks historical linkage to previous SARs, sanctions or convictions, which minimises the risk that any single operational compromise will expose broader laundering activities.

Launderers proactively adjust their names so onboarding and screening controls treat them as low-risk new customers, thereby preparing secure and dependable entry points into financial environments.

Risks

RS0001
|
Customer Risk
|

Manipulating personal names conceals the real identity behind financial activities, defeats watchlist checks, and undermines robust customer due diligence.

RS0004
|
Jurisdictional Risk
|

In some jurisdictions, name changes are relatively easy and less regulated, which increases this risk.

Indicators

IND00020
|

Checks or payment instruments show manual or digital alteration of the payee name that differs from the account holder’s verified identity.

IND01006
|

A customer repeatedly presents subtle name variants—aliases, spelling swaps, or transliteration shifts—that do not align with historical identity records.

IND01007
|

Ongoing CDD reveals a newly declared name that conflicts with previously verified personal-data fields (e.g., DOB, national ID).

IND01232
|

The same individual files multiple legal name changes within a short period, especially in jurisdictions with low documentary scrutiny.

IND01997
|

Recently submitted identity documents appear forged or tampered with and are offered solely to justify a fresh name change.

IND03106
|

Near-match watch-list hits where only one or two characters differ from a sanctioned or PEP name while DOB and nationality match exactly.

IND03107
|

A single biometric template (face, fingerprint) or device fingerprint recurs across multiple onboarding attempts, each under a different spelling of the name.

IND03108
|

Customer requests a name change immediately after negative news or sanctions updates that would otherwise match their prior spelling.

IND03109
|

Internal or consortium KYC utilities flag the same passport or national-ID number paired with multiple name spellings at different institutions.

IND03110
|

A customer’s transaction velocity or limits spike directly after a documented name change, suggesting risk-score reset exploitation.

Data Sources

Many PEP databases carry “also-known-as” lines. Screening a fresh onboarding name against those weak aliases reveals hidden exposure to corruption risk that a direct spelling match would overlook.

Negative-news aggregators and court-case dockets often show earlier prosecutions or civil actions under an individual’s original spelling. By comparing these historical records with a customer’s newly declared name, investigators can surface concealed reputational risk that simple string-match screening would miss.

The same device fingerprint or IP block repeatedly onboarding “distinct” spellings indicates systematic alias cycling—an artefact captured only in device-telemetry logs.

Cross-searching social-media handles, leaked-credit databases, and genealogy forums uncovers maiden names, kunyas, or transliteration variants that the customer failed to disclose—linking them back to historic SARs.

OFAC and UN and similar lists include strong and weak aliases; importing those alias fields into screening engines ensures one-character deviations from a sanctioned name still generate alerts.

Detailed cheque, wire, and digital-payment logs record both the declared payee name and the receiving account owner. Overlaying these fields exposes inconsistent spellings and evidences cheque tampering (e.g., payee line manually re-inked) that signals name-alteration abuse.

Civil registries and public gazettes publish legal name-change announcements. Querying those registries in real time validates whether a customer’s claimed spelling shift is legitimate or an undisclosed alias.

Automated ID-verification services test MRZ codes, security features, and chip signatures. If an attacker manually alters the name field on a physical passport, the chip’s untouched digital profile exposes the mismatch.

Internal onboarding files store prior verified names, biometric data, and device IDs. When a customer resurfaces with a near-match alias, the system can link back to these originals—highlighting undisclosed identity recycling.

Typing cadence, facial recognition, and mouse-movement signatures persist across accounts. When identical behavioural hashes appear under different names, analysts gain hard evidence of one person running multiple aliases.

Mitigations

Any request to update or correct a legal name triggers step-up EDD: original registry extracts are retrieved, fuzzy-matching algorithms compare old and new spellings, and funds remain frozen until compliance validates the change.

APIs into national e-ID registries pull the authoritative spelling during onboarding; any deviation between user-submitted text and registry response halts account creation.

Run sanctions/PEP screening with phonetic, diacritic, and transliteration logic so that minor spelling changes of a listed individual still trigger a match.

Binding accounts to faceprint or hardware-token factors prevents the same individual from simply re-registering with a new name: the biometric/device clash exposes the alias attempt at login.

Investigators run open-web queries for every historic alias and spelling variant, verifying whether the claimed “new” name appears elsewhere online in contexts that contradict the customer’s narrative.

Participate in public-private fusion cells or frameworks that circulate weak-alias lists, enabling faster detection of name-manipulation attempts seen at peer institutions.

Scheduled re-screenings automatically import the latest weak-alias updates from sanctions providers, catching customers whose names were clean at onboarding but later mapped to risk entities via variant spellings.

Cryptographically signed e-ID tokens make the legal name field tamper-evident; if a criminal alters one character, the signature fails and the bank rejects the credential.

Instruments

IN0004
|
|

Physical or PDF cheque stock is reprinted so the payee line shows the alias; because cheque-clearing often trusts the payee field, the altered name evades historical SAR linkage.

Betting platforms accept aliases during remote signup; launderers cycle cash through wagers and later withdraw to bank accounts under the same alias, disguising illicit proceeds as gambling “winnings.”

Aliases or slight spelling changes enable new current or savings accounts that hide historical alerts tied to the customer’s original name.

Fraudsters request re-embossing or new card issuance under a cleaned-up spelling; merchants and ATMs then accept transactions linked to the alias, severing ties to prior fraud scores on the original name.

Light-KYC prepaid cards accept self-declared names; loading high amounts onto cards registered to aliases allows spend or ATM withdrawal without triggering the original name’s risk profile.

Service & Products

Mobile-deposit algorithms emphasise MICR code integrity, not payee-field text; attackers exploit this gap by scanning cheques with payee names digitally scrubbed or respelled.

Remote loading portals often accept name-on-card values that aren’t verified against civil registries, enabling alias cards to become conduits for cash-in and retail spend.

Manual cheque-clearing relies on teller or back-office visual checks; altered payee names that look “close enough” to original signatures frequently dodge deeper system validation.

By maintaining multiple personal chequing accounts each under a slight name variant, offenders can rotate deposits: once a variant triggers an alert, they switch to the next spelling.

Walk-in remitters frequently rely on single-document checks; presenting a passport with a one-letter-off spelling enables cross-border cash payouts that dodge prior watch-list matches for the real name.

Actors

AT0046
|
|

Personally adopts the altered spelling or full alias, presents the forged (or legitimately re-issued) ID, and opens or updates accounts under that name. The same individual may cycle through multiple near-match variants—especially after each generates a compliance alert—thereby using name alteration as a low-cost, repeatable tactic to keep transacting even when earlier spellings have been flagged.

Sources stolen-ID components, commissions document forgers, and packages “alias kits” (ID, utility bill, device fingerprint) for clients. Their value proposition is selecting spellings that test just below fuzzy-match thresholds, registering those aliases at several banks, and handing over ready-made accounts whose names are deliberately one character away from sanctions or SAR history.

Operates an industrial pipeline of alias identities: tracking which spellings have cleared which institutions, rotating clients through fresh variants as soon as a name is contaminated by a suspicious-activity report, and maintaining cross-border drop accounts registered to each spelling. This network effect makes simple name tweaks scale far beyond a single customer.

Fabricates or manipulates passports, national IDs, and cheque stock so the holder’s name appears in an alias form—altered characters, added diacritics, or alternative transliterations—yet the document still passes superficial authenticity checks (MRZ scans, hologram tests). By providing “clean” paperwork that matches the altered spelling, the forger removes the most common barrier that would link the person back to prior adverse records.

AT0068
|
|

Agrees—sometimes knowingly, sometimes under misrepresentation—to serve as director, shareholder, or signatory for shell companies or bank accounts. The nominee’s genuine legal name is then minutely altered (e.g., middle-initial swap, diacritic added) on corporate filings or account paperwork, creating a façade of independence while still masking the true beneficial owner.

References

  1. APG (Asia Pacific Group on Money Laundering). (2016, September). APG Typologies Report on Fraud & Money Laundering in the Pacific.APG Secretariat. https://apgml.org/documents/default.aspx

  2. AUSTRAC (Australian Transaction Reports and Analysis Centre). (2009). AUSTRAC Typologies and Case Studies Report 2009. Australian Government. https://www.austrac.gov.au/business/how-comply-guidance-and-resources/guidance-resources/typologies-and-case-studies-report-2009

  3. Brunt, M. (2018, August 28). Criminals able to change name by deed poll without declaring convictions. Sky News. Retrieved 2025-05-21, from https://news.sky.com/story/criminals-able-to-change-name-by-deed-poll-without-declaring-convictions-11481007

  4. U.S. Attorney’s Office. (2015, September 30). Two men convicted of operating multi-million dollar advance fee fraud scheme. Federal Bureau of Investigation. Retrieved 2025-05-21, from https://www.fbi.gov/contact-us/field-offices/newhaven/news/press-releases/two-men-convicted-of-operating-multi-million-dollar-advance-fee-fraud-scheme

  5. Hong Kong Monetary Authority. (2021, October 22). Frequently asked questions in relation to anti-money laundering and counter-financing of terrorism. Retrieved 2025-05-21, from https://www.hkma.gov.hk/media/eng/doc/key-functions/banking-stability/aml-cft/AML_FAQ_20211022.pdf

  6. Office of Foreign Assets Control. (n.d.). Sanctions list search frequently asked questions (FAQ 636). U.S. Department of the Treasury. https://ofac.treasury.gov/faqs

  7. Pistole, J. S. (2003, October 1). Fraudulent identification documents and the implications for homeland security. Federal Bureau of Investigation. Retrieved 2025-05-21, from https://archives.fbi.gov/archives/news/testimony/fraudulent-identification-documents-and-the-implications-for-homeland-security

  8. Government Digital Service. (n.d.). Change your name by deed poll. GOV.UK. Retrieved 2025-05-21, from https://www.gov.uk/change-name-deed-poll

  9. United States v. Harun, 885 F.3d 936 (2d Cir. 2018). Retrieved 2025-05-21, from https://case-law.vlex.com/vid/united-states-v-harun-885936677.

  10. Financial Action Task Force. (2020, March). Guidance on digital identity. Retrieved 2025-05-21, from https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Guidance-on-Digital-Identity.pdf.coredownload.pdf

  11. United Nations Security Council Counter-Terrorism Committee Executive Directorate. (2023, December). Thematic summary assessment of gaps in investigating and prosecuting the financing of terrorism. Retrieved 2025-05-21, from https://www.un.org/securitycouncil/ctc/sites/www.un.org.securitycouncil.ctc/files/thematic_summary_assessment_of_gaps_-_investigating_and_prosecuting_the_financing_of_terrorism_-_december_2023.pdf

  12. Federal Bureau of Investigation, Internet Crime Complaint Center. (2024). 2023 Internet crime report. Retrieved 2025-05-21, from https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf

  13. Financial Crimes Enforcement Network. (2024, January). Identity-related suspicious activity: 2021 threats and trends. Retrieved 2025-05-21, from https://www.fincen.gov/sites/default/files/shared/FTA_Identity_Final508.pdf

  14. Wikipedia contributors. (2025, April 24). Kunya (Arabic). Wikipedia, The Free Encyclopedia. Retrieved 2025-05-21, from https://en.wikipedia.org/wiki/Kunya_(Arabic).