Synthetic Identity Fraud: The Ghost in the Machine

Synthetic identity fraud is now the fastest-growing financial crime in the world — and most banks are still fighting it with tools built for a different era.

Unlike traditional identity theft, where a criminal steals and uses a real person's credentials, synthetic identity fraud involves the creation of an entirely new identity — typically by combining a real Social Security number (often from a child, deceased person, or someone with no credit history) with fabricated name, date of birth, and address details. The result is a "ghost" — an identity that passes basic KYC checks, builds a credit profile over months or years, and then executes a bust-out fraud, maxing out credit lines before disappearing entirely.

Why Traditional Detection Fails

The insidious genius of synthetic identity fraud lies in its patience. Fraudsters invest time building legitimate-looking credit histories — paying bills on time, keeping balances low, slowly increasing credit limits. By the time they "bust out," the synthetic identity looks more creditworthy than most genuine customers.

Traditional rule-based fraud systems flag anomalies in behaviour. But synthetic identities are the behaviour. There is no anomaly to flag — until it's too late.

Bureau-based identity verification is equally inadequate. If the SSN exists and the credit file builds consistently, most bureau checks will return a green light. The fraud is baked into the foundation of the identity itself.

The Scale of the Problem

US estimates put synthetic identity fraud losses at over $20 billion annually. In the UK, the pattern is similar — fraudsters exploit the National Insurance number system in much the same way. Across the EU, the fragmentation of identity verification regimes creates further arbitrage opportunities for well-organised fraud rings.

For tier 1 banks and large fintechs, the exposure is concentrated in unsecured lending, credit cards, and buy-now-pay-later products. But the risk extends further — synthetic identities are increasingly used as money mule accounts in layering schemes, effectively acting as a laundering vehicle embedded inside the institution's own customer base.

What Better Looks Like

Leading institutions are tackling synthetic identity fraud through a combination of:

Device and behavioural biometrics — Looking beyond the identity document to the patterns of how an account is opened and operated. Synthetic identity applicants often share device fingerprints, typing patterns, or network characteristics with other known fraud accounts.

Identity graph analysis — Building networks of relationships between identity elements (SSNs, addresses, phone numbers, emails) to identify clusters of synthetics. A single SSN appearing across multiple "independent" applications is a powerful signal.

Velocity and cohort analytics — Analysing how a new customer's behaviour compares not just to their own history, but to cohorts of genuine customers who opened accounts at the same time. Anomalous credit-building patterns are detectable at portfolio level even when they look normal at account level.

Third-party data enrichment — Integrating telco data, device data, and open banking signals to verify that the identity has a genuine, consistent digital footprint.

The Compliance Dimension

Synthetic identity fraud sits at the intersection of fraud and financial crime compliance. Regulators increasingly expect firms to demonstrate that their KYC and onboarding controls are robust enough to prevent synthetic identities from entering the customer base — not just to detect fraud losses after the fact. Firms that can show they use layered, intelligence-led onboarding controls are better positioned in regulatory dialogue.

Final Thought

Synthetic identity fraud is a fundamentally different problem to the fraud most institutions were built to detect. It requires a shift from reactive, anomaly-based detection to proactive, intelligence-led identity verification — built into the onboarding process, not bolted on afterwards. The ghost in the machine is patient. Your defences need to be smarter.

TrustSphere helps financial institutions deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai to learn more.