Synthetic identity fraud: How it works and how to stop it

What synthetic identity fraud is

A synthetic identity pairs a genuine Social Security number with a false name, address and date of birth. The fraudster then applies for credit cards, loans and other financial products as that person.

Built with care, the profile looks like a thin-file but legitimate customer and can go unnoticed for years.

Over that time the fraudster opens more accounts, borrows more and keeps paying on time, until the credit lines are large enough to drain in one go. Then the identity disappears.

Detection is hard because the identity is not wholly fake. The SSN is real, the credit history is real, the payments were real. Only the person behind them is not.

Synthetic identities are used to:

• Deceive businesses
• Get past Know Your Customer (KYC) checks
• Abuse promotional offers
• Obtain credit the fraudster never intends to repay
• Make purchases that will never be paid for
• Launder money

There are three ways to build one:

1. Alter a real identity, for example by changing the birth date or a digit of the SSN
2. Combine real data from several people into one record
3. Invent the elements outright, such as a random SSN

However it was built, you want to catch it early. A synthetic identity that passes onboarding is usually the seed for a larger operation.

How synthetic identity fraud works

The fraudster uses the blended identity to:

1. Apply for credit
2. Build a positive credit history over time
3. Earn the trust of lenders
4. Draw down every line at once
5. Disappear

The last two steps are the "bust-out", and the whole scheme exists to set them up.

The patient version runs for a long time:

1. Several fake identities managed in parallel
2. Accounts kept in good standing for months or years
3. Credit scores built through regular, on-time payments
4. Limits raised step by step to larger lines
5. Then everything drawn down at once

Some add a second round:

• Run up fraudulent charges
• Use the real data in the identity to pose as a fraud victim
• Get the credit line restored
• Drain it again

A scheme that waits years before it costs you anything is hard to spot on a dashboard built for same-day fraud.

Who pays for it

In the United States the damage reaches financial services, healthcare, government agencies and individual consumers.

Beyond the money, records get corrupted, services go to people who do not exist, and real people's data is misused.

Individuals, and children most of all

Children are the preferred source of Social Security numbers, for three reasons:

1. Years can pass before a child or their guardians learn the SSN has been used
2. Children have no credit report, so there is nothing to monitor
3. An unused SSN is a blank slate for building a credit file

Businesses

Synthetic identities cost businesses billions a year, plus the hours spent chasing people who do not exist. The obvious question is why onboarding does not catch them.

Part of the answer is that the raw material is everywhere:

1. Frequent large-scale data breaches
2. Compromised personally identifiable information (PII) sold in bulk
3. Dark web markets anyone can reach

The other part is that SSN and credit bureau checks were designed to match a record, and a synthetic identity has a matching record. Tools built for stolen-identity fraud do not see it.

How to identify synthetic identity fraud

Three things make this fraud hard to see:

1. It is among the hardest frauds to detect
2. The filters most financial institutions run were not built for it
3. At application time a synthetic identity looks like a real customer with a short credit history

Bust-out fraud is the pattern to look for, and it is slow:

1. A period of model behaviour, with every payment on time
2. A gradual slide into delinquency that mimics a real person in trouble
3. The drain only at the end, rather than the max-out-and-run of ordinary card fraud

The effect:

• Credibility built up over time
• An account record that reads like a legitimate customer
• No clean way to tell a bust-out from a genuine hardship case

The signals that do work are mismatches: an SSN issued after the stated birth date, a credit file far younger than the applicant, one phone number or address shared across many applications, and a device or IP address already seen on other new accounts.

How to prevent it

You cannot stop the data leaks that feed this fraud, beyond sharing less personal information with third parties. You can close the gaps that let a synthetic identity through.

For individuals, the useful steps are:

• Unique passwords for every account. Use a password manager or the browser's generator, and never reuse one.
• Treat unsolicited contact as suspect. Dating apps, marketplace buyers, a new online store: any conversation with a stranger can turn into social engineering.
• Turn on the basics. Antivirus, two-factor authentication (2FA) and encryption take minutes to set up.
• Read your credit reports. Unexpected accounts or enquiries are the earliest sign your SSN is in use.
• Hand over PII sparingly. Your SSN, a passport scan, even your full name on social media: ask why it is needed before you give it.

Protect the SSN above all. Keep the card at home, do not say the number aloud where others can hear, and shred bank statements, tax forms and government letters before they go in the bin.

• Know what phishing looks like. Emails, texts and calls that claim to be from a bank or agency but lack your name or account number, sender addresses with swapped characters, links you did not ask for. Do not click; a link can install software that records what you type.

For businesses, the answer is document and biometric verification. A synthetic identity built on a real SSN passes a credit bureau check; it is far less likely to pass a document check, and a fraudster will not put their own face on a fake identity in a biometric check.

What financial institutions and businesses should do

Financial services take the most of this fraud because every digital transaction rests on personal data that can be assembled into a plausible applicant.

An estimated 95% of synthetic identities pass onboarding at financial institutions. Once in, they open bank accounts, take loans and credit cards, and feed other fraud. The direct losses are large; the indirect ones (manual case work, filing reports, staff training) add to them every year.

No single check catches this. Combine document verification, biometric identification, passive fraud signals such as device and network data, and database verification, and score them together.

Where to start

Add a document check to onboarding for any account that can borrow or be paid out, and treat a thin credit file attached to a real SSN as a reason for more checks, not fewer. Credit bureau data on its own will keep passing these identities.

[Sensfrx](/) scores every signup for the device, network and behaviour signals that synthetic identities share, and the 14-day trial runs on your own traffic.