What Is Synthetic Identity Fraud? How Fake Identities Are Built, Aged and Cashed Out

A lender approves a credit card for a customer who pays on time for 14 months. The limit goes up twice. Then, in one week, the card is maxed out, a personal loan is drawn down, and the customer is gone. Collections calls go to a number that was never really theirs, because the customer never existed. That is synthetic identity fraud, and in the US it now costs lenders billions of dollars a year while sitting in their books disguised as ordinary bad debt.

For fraud, risk and compliance teams, the hard part is not understanding the definition. It is that a well-built synthetic identity looks exactly like a thin-file customer you would want to approve. Here is how these identities are made, why they pass checks, who they target, and what it takes to stop them before they get a credit line.

What Is Synthetic Identity Fraud?

Synthetic identity fraud is a type of fraud where criminals combine real and fabricated personal information to create a person who does not exist, then use that identity to open accounts, build credit and steal money. A typical synthetic identity pairs a real Social Security number with a fake name, date of birth, address, phone number and email.

The Federal Reserve, which published an industry-recommended synthetic identity fraud definition in April 2021, describes it as using a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain. The definition splits the crime into two parts: creating the synthetic identity, and using it to commit fraud.

What is a synthetic identity?

It is the fabricated person at the centre of the scheme. Fraudsters sometimes call it a "Frankenstein ID" because it is stitched together from pieces of different people. You will also see synthetic ID fraud, synthetic fraud and synthetic identity theft used for the same crime.

What Is the Difference Between Synthetic Identity Fraud and Identity Theft?

The difference between synthetic identity frayd and identity theft is that in identity theft, a criminal takes over a real person's whole identity while in synthetic identity fraud, the criminal creates a new person, so there is often no individual who notices and complains.

That is why synthetic identity theft is a slightly misleading name, even though it is widely used. Part of the identity, usually the SSN, may be stolen, but the identity being used belongs to no one.

Synthetic identity fraud is mostly a new account fraud problem. The failure happens at onboarding, when a person who does not exist is accepted as a customer.

What Are the Types of Synthetic Identity Fraud?

Synthetic identity fraud comes in two types: manipulated synthetic identities and manufactured synthetic identities. The difference is how much of the identity is real.

1. Manipulated Synthetic Identities: Real Records, Altered Details

A manipulated synthetic identity starts from a real person's record and changes enough of it to create a new profile. A fraudster might keep a real SSN but alter the name slightly and change the date of birth. Some people do this to their own records to hide a poor credit history, which is why this type often blurs into first-party fraud.

2. Manufactured Synthetic Identities: Mostly or Fully Invented

A manufactured synthetic identity is built largely from scratch. The fraudster pairs an SSN that has never been used for credit, or one that falls in a range the Social Security Administration has not issued, with an invented name and address. These are the identities organised fraud rings create in bulk, because they are cheap to make and have no real person attached who might check a credit report.

How Does Synthetic Identity Fraud Work?

Synthetic identity fraud works in five stages: assembling the identity, getting a credit file opened, aging the identity, growing its credit limits, and the bust-out. The whole cycle can take anywhere from a few months to several years, and that patience is what makes it profitable.

1. Assembling the Identity: A Real SSN Plus Invented Details

The fraudster gets a valid SSN, often bought from data breach dumps on dark web markets. SSNs belonging to children, elderly people and the recently deceased are popular, because those people rarely check their credit. The fraudster then adds a fake name, date of birth, address, phone and email. Increasingly, they also generate a matching ID document and selfie with AI tools, which is why AI deepfakes now show up in synthetic identity cases.

2. Getting a Credit File Opened: Applying Until Something Sticks

The first credit application with a new identity is usually declined. That is expected. In the US, a credit inquiry on an unknown identity can be enough to start a credit file at the bureau. The fraudster keeps applying, often to subprime lenders, retail cards or secured cards, until one approves a small line.

3. Aging the Identity: Piggybacking and Perfect Payments

With a file open, the synthetic identity behaves like a model customer: small purchases, on-time payments, low utilisation. Many fraudsters speed this up with piggybacking, paying to have the synthetic identity added as an authorised user on someone else's well-established credit card, so it inherits that account's history. Some rings also build social media profiles and utility accounts so the identity holds up to a quick online check.

4. Growing Credit Limits: Moving to Better Lenders

As the score improves, the identity applies to mainstream banks, auto lenders and fintechs for higher limits. Credit lines go up. Fraud rings often run dozens of synthetic identities in parallel and add them as authorised users on each other's accounts to boost scores across the whole network.

5. The Bust-Out: Maxing Out and Disappearing

At a planned moment, the identity draws down every available line across every lender, then stops paying. Some fraudsters add one last step called credit washing: they file a false identity theft claim to get the debts removed and restart the cycle. With no real person to chase, collections fail and the loss gets written off. The bust-out is the stage where all the earlier patience turns into cash, and it is the same playbook behind bust-out fraud by real borrowers and businesses.

Why Is Synthetic Identity Fraud So Hard to Detect?

Synthetic identity fraud is hard to detect for five reasons: there is no victim to raise the alarm, the identity passes standard verification, SSN randomisation removed an old validation check, losses get booked as credit risk, and AI has made fake documents and faces cheap to produce.

• No victim complains. In traditional fraud, the account holder spots strange activity and calls the bank. A synthetic identity has no account holder to notice.
•  
• It passes standard checks. The SSN is valid, the credit file exists and the payment history is clean. Rules built to catch stolen identities see a thin-file but well-behaved customer, which is why basic customer due diligence on its own rarely flags them.
•  
• SSN randomisation weakened an old check. Since 2011, the Social Security Administration has assigned SSNs randomly instead of by state and sequence, so lenders can no longer sanity-check an SSN against a birth year or birthplace.
•  
• Losses hide as bad debt. When a synthetic identity busts out, the account looks like a customer who defaulted. Many lenders book it as a credit loss, so their fraud numbers understate the problem.
•  
• AI makes the front door weaker. Generative tools can produce a convincing driver's licence image and a deepfake selfie in minutes, which defeats document checks that only look at the image. Our guide to detecting fake IDs covers why visual inspection alone no longer holds up.
•  

Who Is Most at Risk of Synthetic Identity Fraud?

Synthetic identity fraud mostly hits five groups of businesses: auto lenders, credit card issuers, personal loan and BNPL providers, digital banks and fintechs, and deposit account providers. Any business that extends credit or opens accounts remotely is a target.

• 1. Auto lenders carry the largest exposure, according to TransUnion, because a single approval unlocks a high-value asset the fraudster can drive away.
•  
• 2. Credit card issuers are where most synthetic identities are first established and aged.
•  
• 3. Personal loan and BNPL providers are attractive because decisions are fast and fully digital.
•  
• 4. Digital banks and fintechs optimise onboarding for speed and conversion, which can leave gaps in digital identity verification that synthetic identities slip through.
•  
• 5. Deposit account providers get targeted too, since a synthetic identity with a bank account can be used as a money mule or to move fraud proceeds.

On the consumer side, the people whose SSNs get used most are children, elderly people and the deceased. A child can reach 18 and discover their SSN is already tied to years of credit history and unpaid debt.

How Much Does Synthetic Identity Fraud Cost US Lenders?

Synthetic identity fraud exposure for US lenders passed $3.3 billion for the year ending 2024, the highest level TransUnion has recorded, according to TransUnion's research. That figure measures the credit available to synthetic identities on newly opened accounts, not total losses, and the real number is likely higher because so much synthetic fraud is booked as bad debt.

The trend is moving the wrong way. TransUnion also found the share of synthetic identities among attempted US account openings rose 18% in 2024 compared with the year before, with auto loans showing the highest balances, roughly double the next credit type, a pattern that still holds in the latest synthetic identity fraud statistics.

What Are the Warning Signs of a Synthetic Identity?

The warning signs of a synthetic identity fall into four groups: identity data that does not add up, a thin footprint outside credit, shared data across applications, and credit behaviour that is too perfect or too fast.

•  
• 1. Data mismatches: An SSN issued before the stated date of birth, or credit history older than the person could plausibly have.
•  
• 2. Missing real-world footprint: TransUnion found that a file with no vehicle registrations or known relatives can be up to seven times more likely to be synthetic, and none of the synthetic identities it analysed had an open bankruptcy.
•  
• 3. Shared data: The same device, phone number, address or face appearing across applications under different names.
•  
• 4. Suspicious credit patterns: A burst of applications across lenders, authorised-user tradelines from strangers, or rapid limit growth followed by full utilisation.
•  

Each of these signals is weak on its own. Detection works when they are scored together, which we cover in detail in our guide to synthetic identity fraud detection.

How Can Businesses Prevent Synthetic Identity Fraud?

Businesses prevent synthetic identity fraud with four layers of control: verifying identity against authoritative sources, proving the applicant is a real and present person, scoring device and behaviour signals in the session, and monitoring accounts after onboarding.

• 1. Authoritative source checks confirm the SSN, name and date of birth belong together, not just that the SSN exists. Layering several identity verification methods closes the gaps any single check leaves.
•  
• 2. Document and liveness detection stops AI-generated IDs and deepfake selfies from getting through remote onboarding, with biometric verification matching the live face to the document.
•  
• 3. Device and behavioural signals catch the same fraud ring applying under many identities from shared devices.
•  
• 4. Post-onboarding monitoring flags the sleeper-to-bust-out pattern before the final drawdown, backed by transaction screening on money moving in and out of the account.

For the full playbook, see our guide on how to prevent synthetic identity theft. If you operate in Nigeria, South Africa or Kenya, our breakdown of synthetic identity fraud at African banks covers the local identity databases and regulator expectations.

Stopping Synthetic Identity Fraud at Onboarding With Youverify

Synthetic identity fraud is cheapest to stop on day one. Once a synthetic identity has a credit line, every month it stays on your books adds to the loss you will eventually write off. The point of control is the moment a person who does not exist asks to become your customer.

Youverify's Customer Onboarding runs document, anti-deepfake liveness and government-source checks in one journey, scored to a risk tier. AI-generated IDs and face-swapped selfies, the tools fraudsters now use to get synthetic identities past remote onboarding, get caught before the account is opened.

Synthetic identities rarely come alone, so Fraud Insights scores device and browser fingerprint, IP spoofing, emulators, remote tools, velocity and behaviour inside the same session. When one device keeps applying under different names, you see the ring, not just the application. And for identities that were approved before you tightened controls, Transaction Monitoring flags the drawdown patterns that signal a bust-out in progress.

Your thin-file applicants are either future customers or future write-offs. Book a free demo with our fraud experts to see how Youverify tells them apart at onboarding.

About the Author

Temitope Lawal is the Content Marketing Manager at Youverify, where she leads content on fraud prevention, AML compliance and identity verification. She has spent seven years turning complex financial crime topics into clear, practical guidance for the risk and compliance teams who have to act on them.