Synthetic Identity Fraud

What Is Synthetic Identity Fraud?

Synthetic identity fraud is the creation of a new, fictitious identity by combining real personal data with fabricated details. A fraudster might take a genuine national identification number belonging to one person, a date of birth from another source, an invented name and a newly created email address and phone number. The result is a persona that does not correspond to any single real person, yet contains enough genuine data to pass many automated checks.

This is different from traditional identity theft. In identity theft, the criminal impersonates a real, existing person, who usually notices sooner or later when unfamiliar accounts or debts appear. With a synthetic identity there is often no single victim who will complain, which is why these identities can stay active for long periods.

Why Synthetic Identity Fraud Matters

Synthetic identities are a direct threat to lenders and an increasingly common tool for money laundering.

• Credit losses. Fraudsters build credit history slowly, then draw down every available line at once and disappear. The loss is often booked as a credit write-off rather than fraud, which hides the true scale of the problem.
• Mule accounts. Accounts opened with synthetic identities are used to receive and move proceeds of crime, because there is no real account holder to trace.
• Sanctions and AML evasion. A fabricated persona can be used to avoid screening that would catch the real person behind it.
• Harm to real people. Individuals whose data is reused, often children, the elderly or people with little credit activity, may discover problems years later when they apply for credit themselves.

How Synthetic Identities Are Built and Used

Common Building Blocks

• genuine identity numbers that have been stolen, bought from data breaches or that belong to people unlikely to check their records
• fabricated names or slight variants of real names
• dates of birth that do not match the real owner of the identity number
• addresses such as mail drops, vacant properties or addresses shared by many applicants
• newly created email addresses and prepaid or virtual phone numbers
• forged or manipulated identity documents when a document check is required

The Typical Lifecycle

1. Creation. The identity is assembled and an initial application is made, often for a low-limit product. It may be declined, but in some credit systems the application itself creates a file in that name.
2. Cultivation. The fraudster uses small credit lines responsibly to build a positive history. Some schemes add the synthetic identity as an authorized user on a genuine account to borrow its credit history, a practice known as piggybacking.
3. Expansion. With an established profile, the identity qualifies for larger limits and more products, sometimes across many institutions at once.
4. Bust-out. The fraudster maxes out every line, sometimes making payments with bad checks to temporarily free up credit, then stops paying and abandons the identity.

Red Flags

• identity data that is internally inconsistent, such as an identity number that does not fit the stated age
• thin or very recent credit files paired with confident applications for multiple products
• email addresses, phone numbers or devices shared across applicants with different names
• addresses linked to many unrelated identities
• rapid credit-seeking across several institutions after a quiet build-up period
• applicants who avoid steps that require a live, document-based identity check

Regulatory Expectations

AML rules do not name synthetic identity fraud specifically, but they target it directly through the core requirement to identify customers and verify their identity using reliable, independent source documents, data or information. FATF standards, the US Bank Secrecy Act customer identification program rules, the EU AML Directives and Regulation (EU) 2024/1624, and the UK Money Laundering Regulations 2017 all require firms to verify identity, not just collect it, and to apply extra measures where the relationship is non-face-to-face or otherwise higher risk.

Where accounts opened with synthetic identities are used to move suspicious funds, firms have the same obligation to report suspicious activity as with any other customer.

Best Practices

• Verify, do not just validate. Checking that a data element exists is not enough; confirm that the elements belong together and to the person applying.
• Combine document and biometric checks. A genuine document matched to a live face makes a fully synthetic persona much harder to sustain. See biometric verification and liveness detection.
• Use network analysis. Synthetic identities are rarely built one at a time. Shared contact details, devices, addresses and beneficiaries reveal clusters.
• Check the digital footprint. Real people usually have email addresses and phone numbers with some history. Brand-new or disposable contact details deserve more scrutiny.
• Monitor after onboarding. Watch for the cultivation and bust-out pattern, including rapid limit increases and sudden spending spikes.
• Label losses correctly. Reclassifying suspected synthetic write-offs as fraud improves the data that rules and models learn from.

How on8.ai Helps

on8.ai's Pre-KYC checks look at email, phone and IP risk, VAT validation, velocity and bot activity before onboarding begins, which helps expose freshly created contact details and repeated applications. Passporter, currently in development, adds document reading and verification, including e-passport chip verification to ICAO 9303, to tie the application to a genuine document.

Related Terms

• Identity Spoofing
• Document Forgery
• Device Fingerprinting
• Money Mule
• EV (Electronic Verification)
• KYC (Know Your Customer)