Synthetic identity fraud

What it means

Synthetic identity fraud is the creation of a person who does not exist by mixing real details, such as a genuine ID number, with invented ones, such as a name and a date of birth. The result looks real enough to pass automated checks and open an account.

Unlike stolen identity, no single victim notices. The fraudster builds the identity slowly, often making small payments on time to earn trust, then takes credit or benefits and disappears. Onboarding checks that only confirm that each field is plausible do not catch it.

Why it matters

The losses arrive late and large. A synthetic account may behave well for months, then take a credit line, a loan, a refund or a payout and vanish. The business writes it off as bad debt, so the fraud is often misfiled as a credit loss, which hides the real size.

It affects any business that gives credit, rewards or trust to new accounts, including lenders, marketplaces and payment platforms. It overlaps with fake account creation and fraud detection, but it is slower, and it passes checks that block cruder fakes.

How it shows up

You meet it at onboarding and at the first credit or payout decision. Weak points include checks that only validate format, no comparison between a document and a live selfie, one email or phone reused across accounts, and approval of high-value actions soon after sign-up.

NIST's identity proofing guidance (SP 800-63A) describes how strong a proof of identity should be for a given risk. Match your checks to the value at stake, verify documents against issuing sources where law allows, link accounts sharing devices or details, and delay large payouts. Test the flow with fabricated test data.