Sham Surgery Clinics, Stolen Doctor Identities and the Identity Fraud Problem Lenders Can't Outsource
The clinics had names, addresses, and state registrations. They had doctors listed as owners. They had more than 100 patients applying for financing. What they didn't have was any medical care.
According to the Justice Department, Jacquez Dion Tullis, 42, of Wellington, Florida, was sentenced on November 12 to 84 months in federal prison for a scheme that used six sham cosmetic surgery clinics and stolen identities to take about $2.3 million from medical lenders. U.S. District Judge Rodolfo A. Ruiz II of the Southern District of Florida imposed 60 months for conspiracy to commit bank fraud and a consecutive 24 months for aggravated identity theft, plus five years of supervised release. Tullis was ordered to pay $2,309,859.44 in restitution and faces a forfeiture money judgment for the same amount. He pleaded guilty on July 21.
On its face, it is a fraud story. Underneath, it is a case study in how identity fraud works when it attacks a lender at two levels at once: the business that sends the applications and the people named on them.
How the scheme worked
From about April 2018 through February 2024, prosecutors say, Tullis and his co-conspirators set up six clinics that claimed to offer cosmetic surgery and other services but provided no real care. The clinics were registered with the Florida Department of State using the personal information of practicing doctors and other people, without their knowledge or consent. The applications that got the clinics approved as merchants with medical lenders were often in the defendants' own names, according to the factual proffer Tullis signed with his plea agreement, but some used the information of doctors and other people to list them as owners.
The plea agreement names six lenders as restitution victims: Synchrony Bank, Comenity Bank, United Medical Credit, Momnt Technologies, GreenSky and Bright Smile Financing. Court papers describe two of the lenders as FDIC-insured banks and four as fintech companies that partnered with FDIC-insured banks, which originated the loans. Their programs give patients lines of credit for out-of-pocket care that insurance doesn't cover, often as a physical card that can be used at the approved provider. That model depends on the provider. Once a clinic is an approved merchant, either the provider or the patient can submit the credit application.
With the clinics approved, the group submitted fraudulent credit card applications in the names of more than 100 people, seeking about $3.1 million, the release says. The people named didn't know about or authorize the applications and didn't need any treatment. According to death records cited by prosecutors, some of them had died before the dates they supposedly received care.
The court filings mention the names of six clinics: Contour Medical Center of South Florida in Tamarac, Optimum Telecare Health in Houston, Bella Stahrr Rejuvenation in Miami, Skyn Dep in Boca Raton, Cosmetic Aesthetics in Fort Lauderdale and Radiance Beauty Lounge in Aventura. Tullis owned and managed Contour Medical and managed Cosmetic Aesthetics and Radiance Beauty Lounge. In one example, an August 2022 merchant application for Contour Medical listed a person identified only as D.W. as the owner. D.W. had never heard of the company, and the group went on to get about $585,423 from that lender.
The 2025 indictment says the identity data used included names, dates of birth, and Social Security numbers, among them those of a doctor identified only as "Dr. R.A." It also notes that the lenders' merchant agreements often required applications to be signed in person by the applicant. The indictment put lender payouts at about $1.78 million. In the proffer, Tullis agreed that the group received about $2.3 million.
Separately, Tullis submitted at least nine fraudulent Economic Injury Disaster Loan applications to the Small Business Administration between April and August 2020, seeking a combined $696,860, with false employee and revenue figures, the Justice Department says. One Contour Medical application claimed $42.31 million in gross revenue and eight employees. According to the proffer, he received $8,000 in total.
The case by the numbers
Sentence: 84 months in federal prison, plus five years of supervised release
Restitution: $2,309,859.44, with a forfeiture money judgment in the same amount
Sham clinics: six, registered with stolen personal information
Lenders: six, named in the plea agreement: two FDIC-insured banks and four fintech companies
Fraudulent applications: in the names of more than 100 people, seeking about $3.1 million, with about $2.3 million received
Pandemic relief: at least nine EIDL applications seeking $696,860, with $8,000 received
Time frame: about April 2018 to February 2024
Two co-defendants were sentenced earlier. Taneika Nakia Pace, 50, of Hallandale Beach, who managed two of the clinics, received six months after pleading guilty to bank fraud. Junaque Nicole Tullis, 46, of Coral Springs, received eight months after pleading guilty to wire fraud tied to disaster loan applications. All three were charged in the 2025 National Health Care Fraud Takedown, and the FBI investigated.
Two identity checks, both beaten
Most identity fraud coverage focuses on the borrower. This scheme went after the merchant first.
The business layer. Before a single patient application went in, each clinic had to be approved as a merchant. State registrations built with stolen personal information, and in some cases a merchant application listing an unwitting doctor or other person as owner, got them there. A state filing shows that someone filed paperwork. It doesn't prove that the person named on it knows the business exists. In lending terms, this is a know your business (KYB) failure: the entities were real on paper, but they weren't real medical practices, and in some cases the owners on file didn't know the business existed.
The borrower layer. Once the clinics were approved, the consumer side ran through them. In this model, the provider can submit the application for the patient, which put the people committing the fraud in control of what the lender saw, from the applicant's personal data to the procedure being financed. That is where know your customer (KYC) checks are supposed to catch a stolen identity. Some of the applications were in the names of people who had already died. The release doesn't say how those applications got through.
That structure isn't unique to medical financing. Any lending model where a third party sits between the lender and the end customer, whether a merchant, a dealer, an ISO or a broker, gives that third party the same position. Funder Intel covered a version of it earlier this month in the Buffalo case, where a Buffalo-area ISO used at least 63 customers' identities to submit hundreds of applications to at least 23 lenders.
"Fraud schemes of this magnitude undermine the integrity of our financial system and inflict real harm on victims whose identities are stolen and misused." Brett D. Skiles, Special Agent in Charge, FBI Miami
No AI required, and that is the warning
Nothing in the release or the indictment says Jacquez Tullis used artificial intelligence. The scheme started in 2018 and ran on stolen names, birth dates, and Social Security numbers. It took years and a hands-on crew to build six clinics and file more than 100 applications.
That is what is changing. Regulators and law enforcement have been warning that generative and agentic AI lowers the cost of the hardest parts of a scheme like this one: producing believable documents and making each fake identity hold up under review.
Fake IDs on demand: The FBI's Internet Crime Complaint Center warned in December 2024 that criminals use generative AI to create fraudulent identification documents, such as fake driver's licenses, for identity fraud and impersonation schemes.
Synthetic identities: In a November 2024 alert, FinCEN said it had seen an increase since 2023 in suspicious activity reports describing deepfake media. It said criminals have combined AI-generated images with stolen or fake personal information to create synthetic identities and used AI-made documents, photos and videos to get around identity verification and customer due diligence controls.
Lower cost to scale: Deloitte's Center for Financial Services projected in May 2024 that generative AI could push U.S. fraud losses to $40 billion by 2027, up from $12.3 billion in 2023. It pointed to a dark web market selling scamming software for as little as $20.
Exposure already on the books: TransUnion estimated in October that U.S. lenders had about $2.4 billion in exposure tied to synthetic identities as of June 30, 2026. In its survey, 53% of U.S. business leaders said synthetic identity fraud is the threat they are least prepared to address.
Agentic AI, software agents that can carry out multi-step tasks with little human direction, adds another layer. In its October report on AI adoption, the Financial Stability Board said highly autonomous agentic systems "may act unpredictably or outside intended boundaries" and that some advanced models may "materially increase the speed and scale of cyber attacks." The Tullis case shows how much manual work identity fraud used to take: forming companies, filling out merchant forms, submitting application after application. That repetitive work is exactly what automation is built to speed up.
Identity fraud was already a large share of the problem before generative AI. In a January 2024 analysis of 2021 Bank Secrecy Act filings, FinCEN found that about 1.6 million reports, 42% of the total, were identity-related, covering about $212 billion in suspicious activity. Impersonation was the most common tactic.
The other side of the arms race
The same technology is being turned into a defense. The Financial Stability Board's report says AI is increasingly used to detect identity fraud, synthetic identities and deepfake-based attacks, often in real time. One case study in the report describes a digital bank whose facial recognition checks detect loan applications involving fake identities.
FinCEN's alert lists red flags that map closely onto a case like this one, including identity documents that are inconsistent with each other, a customer who can't satisfactorily authenticate their identity or source of income, device or location data that doesn't match the identity documents, and patterns of coordinated activity among multiple similar accounts. It points to multifactor authentication and live verification checks, where a customer confirms their identity on audio or video, as processes that can reduce exposure to deepfake documents.
Some tools are older and simpler. The Social Security Administration's electronic Consent Based SSN Verification service lets financial institutions, with the number holder's consent, check whether a name, date of birth and Social Security number match SSA records. The response includes a death indicator when SSA has that data. A check like that can flag an application in the name of someone who has died, when SSA has the death on record.
On the business side, there is less help from Washington than once planned. In March 2025, FinCEN removed the requirement for U.S. companies to report beneficial ownership information under the Corporate Transparency Act. Confirming who actually owns and controls a business remains the lender's job.
What lenders, funders and brokers can take from it
Verify the people, not just the entity. A state registration, an EIN and a website prove that a business was set up. They don't prove the named owner set it up. AI checks may not catch everything. Contact owners and principals through information you sourced yourself, not through the details on the application.
Check professionals against their licensing board. When a merchant's legitimacy rests on a licensed professional, such as a doctor, confirm the license and the person directly. A doctor who learns from a lender that they "own" a clinic is a fraud signal in itself.
Treat the intermediary as a risk point. Merchants, dealers, ISOs, and brokers control what the lender sees. Watch for volume spikes from new partners, clusters of applications that share devices, addresses, or bank accounts, and files where you can't reach the end customer independently.
Run deceased and identity-match checks. Applications in the names of dead people are among the most avoidable losses in this case. Matching name, date of birth, and SSN against authoritative records, including death data, should happen before funding, not after a chargeback.
Plan for documents that look perfect. If generative AI can produce a convincing driver's license, a clean document is no longer proof of anything. Liveness checks, device and location signals, and cross-checks against outside data carry more of the weight.
Share what you see. FinCEN asks institutions to reference its deepfake alert in suspicious activity reports. On the commercial side, Funders and other non-bank lenders that see a merchant or broker pattern like this one help the market most when the information reaches others before the next application does.