Synthetic Identity Fraud Detection: Measurement Across the Customer Lifecycle

Last updated: September 2026

TL;DR

Synthetic identity fraud detection fails at onboarding because at onboarding there is almost nothing to catch. A fabricated identity is built from real, verifiable fragments, so the attributes hold up under checking. What it lacks is depth of history, and depth only becomes visible over time. Detection is therefore not one check at the door but a sequence of different questions asked at different stages — and the weakest link is usually that the answer found at the door never reaches the team watching the account afterwards.

What synthetic identity fraud is

The Federal Reserve defines synthetic identity fraud as "the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain." The identity does not belong to anyone. It was assembled to exist.

That is the whole operational difference from stolen-identity fraud, and it decides how the fraud gets caught. A stolen identity belongs to a real person who will eventually see a statement, receive a letter, or check a credit file, and complain. A synthetic identity has no such owner. Nobody disputes the charge, because nobody was wronged in a way they can notice.

The consequence is that these accounts age quietly inside a portfolio. When one finally defaults, it looks like a borrower who stopped paying, and it gets booked as credit loss rather than as fraud. Institutions therefore tend to underestimate their own exposure, and the industry's aggregate numbers inherit the same problem.

The Federal Reserve treats that measurement gap as a root problem in its own right: "Multiple definitions of synthetic identity fraud throughout the industry pose a fundamental problem. The lack of a common definition leads to inconsistent categorization and reporting, making it difficult for the industry to identify and mitigate this type of fraud."

For scale, TransUnion reported $3.3 billion in US lender exposure to suspected synthetic identities across auto loans, bank credit cards, retail credit cards and unsecured personal loans, as at the end of 2024. One figure is enough for a piece about detection. What matters more than the total is whether any of it sits in your book, and how you would know given how it gets classified.

How a synthetic identity gets built

There are two routes, and they need different responses.

The first assembles a new person from fragments belonging to several real ones. Mike Timoney, Vice President of Secure Payments at the Federal Reserve Bank of Boston, described it on the Bank's Six Hundred Atlantic podcast in March 2025: "Thieves steal pieces of information, maybe this guy's checking account number, this woman's driver's license number, this child's Social Security number, and they put it all together to construct a completely fake person."

The second alters a single element of one real identity rather than combining several — a digit changed in a Social Security number, a date of birth shifted by a year — producing a near-copy that resolves to no one.

The reason the first route works so well is the reason attribute-level checking cannot stop it. Each fragment is genuine and independently verifiable. A checking account number that exists, a driver's licence number that validates, a Social Security number issued to a real person: every component clears, and the composite they form has never been checked as a composite. Verification confirms the parts and says nothing about the whole.

Children's Social Security numbers are a favoured input for the same reason. They are valid, issued, and attached to no credit history that anyone is watching — which means the fabrication can be years old before the real owner applies for anything and discovers the file.

Why conventional onboarding checks clear them

An onboarding check asks a narrow question: are these attributes internally consistent, and can they be verified against a source. A well-built synthetic passes because the honest answer is yes. Its attributes are real. They simply are not one person's.

What would expose it is a different kind of signal. Timoney's recommendation is to look at "relationships bigger than just those few components" — email address history, how long a phone number has been in service, social connections, organisational affiliations. Real people accumulate this depth as a by-product of living. Fabricated ones have to have it manufactured, and manufacturing it takes time the fraudster would rather not spend.

Here is the difficulty that shapes everything downstream. At the moment of application, that depth is also thin for a genuine nineteen-year-old, a recent immigrant, or anyone else who is credit-invisible or thin-file. The signal that best distinguishes a synthetic identity is weakest exactly when the decision has to be made, and treating thin history as suspicious in itself declines a great many real applicants.

This is why a single onboarding verdict is the wrong shape for the problem, and why the rest of this article is organised by stage rather than as one flat list of tests.

The lifecycle: fabrication, seasoning, expansion, bust-out

The useful way to think about a synthetic identity is as something that changes over time, because the signal that would reveal it changes too. The four stages below are a way of organising that, not an industry-standard taxonomy — the labels are ours, and what matters is the sequence rather than the names.

The middle of the sequence is credit seasoning, and Timoney described it in plain terms: the identity is used and repaid, so "the credit rating goes up" and lenders extend more. Expansion often runs through authorized user tradelines — adding the fabricated identity to an existing account, sometimes called piggybacking — which inherits that account's history at a stroke.

Then the ending, in his own illustration: "I max out the credit card. Let's pretend it's 25,000. I max it out, I walk away."

Two things follow from reading it this way. The evidence that would have caught the account at fabrication is largely gone by expansion, and the evidence available at expansion did not exist at fabrication. Neither stage can do the other's job.

Not every synthetic ends in a bust-out, which is the part most treatments miss. The Federal Reserve groups the common uses as credit repair, fraud for living, payment default schemes, and other criminal activity. An identity used for "fraud for living" behaves like a good customer indefinitely — it is not building toward a loss event at all, and a detection strategy that only looks for bust-out patterns will never find it.

Detecting them at account opening

The controls at this stage are the ones usually grouped under new account fraud, and against a fabricated identity they have a specific job: establishing whether this identity has a past. Four categories of evidence are available beyond the attributes themselves, and they are the categories worth working through rather than a complete set.

Identity consistency across sources. Not whether each element verifies, but whether the elements agree with each other across independent sources, and whether the combination has been seen before.

Device and network intelligence. Whether this device, network path, or session has appeared in other applications, and what happened to those applications. This is orthogonal to identity data, which is what makes it useful — the fraudster controls the identity and controls the device rather less completely.

Application behaviour. How the form was completed. Data that arrives faster than a person types it, or in an order that suggests it was copied from a record rather than recalled, is not proof of anything on its own and is a reasonable input.

Credit-file patterns. File age against applicant age, the shape of the file's early history, and whether the file's growth pattern resembles seasoning.

Organising these by the depth principle matters more than the list itself. Each one is a way of asking whether this identity has a past, which is the question the attribute checks cannot reach.

The honest limit is worth stating. At account opening the correct output is often not approve or decline but a confidence level plus an instruction about what to watch — a decision that stays open. An application scored as thin-but-plausible and then monitored on that basis is handled well. The same application approved into a book that forgets the concern is not.

One boundary: a synthetic identity is a subtype of first-party fraud, since the account holder and the bad actor are the same party. The overlap in controls is real, and the wider problem is its own subject rather than part of this one. The same goes for the identity-verification programme itself — KYC fraud detection covers where a compliance check ends and a fraud decision begins, and mule accounts are a further adjacent problem that sits alongside both.

Detecting them after the account is open

Time supplies evidence that no application-stage check can produce.

Velocity of credit-seeking becomes visible — an identity applying across several institutions in a compressed window looks different from a household's ordinary borrowing. Cross-customer relationships surface only at portfolio scale, where a device, address, or funding instrument shared across accounts that have no business sharing one is a strong signal and is invisible in any single application. And the shape of repayment behaviour before a bust-out is a pattern rather than an event: balances drawn toward the limit across several accounts, minimum payments maintained until they stop together.

That last point reframes bust out fraud as something monitorable. Treated as an event, it is a loss you discover. Treated as a pattern, it has a run-up you can watch, and the run-up is where the intervention is worth anything.

Which brings this back to the onboarding decision. A confidence level produced at application is an input to later thresholds, not a closed file. An account opened with a flagged concern should carry a lower trigger for review, a tighter limit-increase policy, and attention when it starts seeking credit elsewhere.

None of that requires re-litigating the original decision. It requires the original decision to still be legible.

In practice it usually is not, and this is the most common failure on the whole topic. An onboarding team catches the synthetic, flags it, and the signal does not reach transaction monitoring or the compliance team — because fraud and compliance run as separate systems that do not exchange signals in real time. Our own view is that this is a data-layer problem rather than a detection problem, and that patching connectors between systems does not fix it.

A risk leader at a payments company described the same thing from the other side: a synthetic is sometimes flagged during onboarding and can still be missed across silos afterwards. The decision was right. It just stayed where it was made.

Where that gap is the binding constraint, the work sits in ongoing transaction monitoring and in whether onboarding evidence is readable there, rather than in a better door check.

What AI changed on both sides

Generative AI made fabrication faster and more varied. Timoney describes it parsing "large, large data sets much faster than a human can" and making "sure that it's not duplicating types of things" — producing identities with fewer of the internal repetitions that used to make a batch detectable as a batch.

The adversarial half matters more, and it gets less attention. If a set of fabricated identities "start to get caught", the pattern that caught them is identified and the next set is built to avoid it. Detection logic under those conditions does not simply decay with age. It actively teaches the other side what to change, and the more static it is, the more reliably it teaches.

The defensive implication is about speed of change rather than sophistication. A rule set that takes a quarter to modify is a stable target. What helps is being able to see which signals are carrying a decision, change them quickly, and know what the change did — which is a question about the platform underneath the detection, not about any single model.

At platform level that means a real-time data layer rather than periodic extracts, device and behaviour intelligence alongside identity data, rules and case management in the same stack as the risk agents that use them, and a full audit trail per decision with the reasoning stored, human-in-the-loop by design. What it does not mean is a dedicated synthetic-identity product. The signals that expose fabricated identities are the ordinary signals of a well-connected risk platform, applied with the lifecycle in mind.

Where the exposure actually sits

Exposure is unevenly distributed, and the aggregate figure hides that. TransUnion's total spans four product classes, which is not the same as those classes carrying it equally, and an institution's own mix decides most of its risk.

A risk lead at a consumer lender said on a recorded call that synthetic identities had not come up much for them. That is worth taking at face value rather than treating as a blind spot. The exposure is real and it is not evenly spread, and a vendor page insisting every institution is under equal threat is not being straight with the reader.

So the question worth asking is not whether synthetic identity fraud is large. It is whether it is large in your portfolio, and how you would find out — given that when it does land, it arrives labelled as credit loss.

If the losses you are seeing concentrate at the point of account opening, account opening fraud sets out how Oscilar approaches the decision and what it carries forward from it. If they are arriving months after approval, the monitoring side is the closer fit.

Frequently asked questions

What is synthetic identity fraud?

Synthetic identity fraud is the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain, in the Federal Reserve's definition. The identity does not correspond to a real individual, even though its components may each be valid. That is why no victim ever reports it.

Why do synthetic identities pass conventional onboarding checks?

Because their attributes are real and verifiable — just not one person's. An onboarding check asks whether the elements are consistent and can be confirmed against a source, and a well-built synthetic satisfies that test. What is missing is depth of history, which is also thin at application for genuine young and thin-file applicants.

How does synthetic identity fraud work, from fabrication to bust-out?

An identity is assembled from real fragments, then used and repaid on a small credit line so that the file builds and the score rises. Lenders extend more credit as the record improves, often across several institutions. The fraudster then draws the available balance down and stops paying. Not every case ends this way — some are used indefinitely to sustain ordinary borrowing rather than to engineer a loss.

Which signals expose a synthetic identity at account opening?

The categories worth working through are identity consistency across independent sources, device and network relationships to other applications, behaviour during the application itself, and credit-file patterns such as file age against applicant age. Each asks whether the identity has a past. None is conclusive alone, and the appropriate output is often a confidence level with a monitoring instruction rather than a decline.

How do lenders detect synthetic identity fraud during loan origination?

By weighting evidence the applicant does not control. Identity data is supplied by the applicant and is the weakest available signal against a fabrication designed to satisfy it. Device history, application behaviour, and whether these attributes have appeared together in prior applications are harder to fabricate consistently, and origination is also the point to set what happens next rather than to reach a final verdict.

How should onboarding risk inform later monitoring?

A confidence level from application should become an input to later thresholds rather than a closed file. An account opened with an unresolved concern warrants a lower review trigger, a tighter limit-increase policy, and attention when it seeks credit elsewhere. The common failure is not misjudgement at the door but the judgement never reaching the systems that meet the same account later.

Which is harder to detect, synthetic or stolen identity fraud?

Synthetic, and for a structural reason rather than a technical one. A stolen identity has a real owner who eventually notices and disputes, which gives the institution a reliable outside signal. A synthetic identity has no owner to complain, so it produces no such signal and can age inside a portfolio for years before anything surfaces.

How is AI used in synthetic identity fraud?

On the attacking side, generative AI speeds up fabrication and produces more varied identities, avoiding the internal repetition that once made a batch detectable as a batch. It also learns from failure: when a set starts getting caught, the next set is built to avoid whatever caught it. The consequence for defenders is that static detection logic does not merely age — it shows the other side what to change.