The Loss That Never Reaches the Fraud Team: First-Party Fraud and Synthetic Identity at the Credit Boundary

A synthetic identity is not a mask worn over a real person. It is a construction, assembled from elements that are individually plausible and collectively belong to nobody: a genuine but dormant identifier, a name that has never been associated with it, an address that exists and receives post, a date of birth chosen to make the file internally coherent. Little of that assembly is detectable at the moment of application, because there is no victim to complain and no stolen credential to fail a check.

What makes the construction valuable is patience. The operator does not ask for a large facility on day one. It asks for something small, accepts a token limit or a declined decision, uses whatever it is given correctly, pays on time, accumulates a credit file, and is progressively rewarded by the models built to reward exactly that behaviour. Eighteen months or three years later the identity holds several lines across several institutions, each of which regards it as a satisfactory customer with a clean record. Then every line is drawn to the limit inside a short window and the identity stops answering. The industry calls that a bust-out. The accounting calls it a credit loss.

That last sentence is the real subject of this post. First-party fraud, meaning fraud committed by the account holder against the institution rather than by a third party against a customer, is frequently invisible to the fraud function because it never arrives there. It is absorbed into impairment, provisioned against, reported as credit performance, and analysed by a team whose remit is to improve underwriting rather than to detect deception. We set out below why synthetic identities behave the way they do, why credit risk models find them attractive, which detection signals actually exist and where they live, and who ought to own the loss.

Regulatory and Market Context

The supervisory framing is awkward because first-party fraud falls between two regimes and is fully owned by neither. The United Kingdom reimbursement regime for authorised push payment fraud, designed and overseen by the Payment Systems Regulator, deliberately does not extend to claims where the payer was party to the fraud, which is correct policy and has the side effect of leaving first-party conduct outside the dataset that now drives most industry fraud reporting. Cifas operates the National Fraud Database precisely so that first-party and application fraud markers can be shared between members, and its annual analysis has consistently described first-party conduct as a material share of recorded cases. In the United States, the Federal Reserve's payments fraud work has published a working definition of synthetic identity fraud together with material on detection and mitigation. None of these sources agrees with the others on scope, which tells you something about how the category is treated.

The prudential and accounting position compounds it. A loss that is booked as impairment flows through expected credit loss provisioning and is explained to the board as credit performance. A loss booked as fraud is an operational risk event, sits in the operational loss dataset, and is explained to the board by a different executive. The same underlying event therefore produces two entirely different governance consequences depending on a reason code chosen by a collections agent under time pressure. It is also worth being clear where the new corporate criminal liability does not reach: the failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act addresses fraud committed by associated persons intended to benefit the organisation, not fraud committed against it by its own customers. Regulatory expectations here come instead from the Financial Conduct Authority's general requirements on systems and controls, from Consumer Duty where a genuine thin file customer is wrongly treated as constructed, and from the credit reference infrastructure lenders both feed and rely on.

What the Data Is Showing

Across the first-party fraud and synthetic identity reviews TrustSphere conducted for lending and card issuing clients during 2024 and 2025, the most consistent finding was structural rather than analytical. In the majority of the portfolios we examined, there was no charge-off reason code that allowed a collections agent to record suspected first-party fraud, so the only available classifications described inability to pay. The consequence is not that the institution mislabelled a few accounts. It is that it had no population to analyse, no baseline, no trend, and therefore no evidence with which to fund the work. These are our own engagement findings across a defined set of client reviews rather than an industry measurement.

The second finding concerns the behaviour of the accounts themselves. Where we were able to reconstruct a suspected synthetic cohort retrospectively, the accounts did not look like poor credit decisions. They looked like good ones. Payment punctuality before the bust-out window was, in several portfolios, better than the portfolio average, utilisation was moderate rather than stretched, and the accounts had generally been through at least one limit increase granted automatically on the strength of conduct. The models were working exactly as designed. They were rewarding a pattern of behaviour that a patient operator can produce at will and that a genuine customer in financial difficulty frequently cannot.

The third finding concerns where the signal actually sits. In no case we reviewed was the decisive evidence present in the individual application. It appeared only when the portfolio was examined across time and across entities: identifier and address elements recurring across applications that were otherwise unrelated, small clusters of accounts opening within days of each other and maturing on near identical trajectories, thin files thickening in a pattern that did not match how genuine credit histories accumulate, and a sharp increase in credit seeking activity across the cohort shortly before the drawdown. Each of those is invisible at the point of decision and obvious in aggregate.

The fourth finding concerns organisational plumbing. In most of the institutions we reviewed there was no routine feed from collections or recoveries back into the fraud function, no forum in which credit risk and fraud examined the same accounts together, and no shared definition of what first-party fraud even meant. Where a bust-out pattern had been identified, it had usually been found by an analyst who noticed something, escalated informally, and received no mandate to continue. Detection capability of that kind does not survive a reorganisation.

Implications for Financial Institutions

The first implication is that loss classification is the control, and everything else depends on fixing it. Until collections can record suspected first-party fraud at charge-off, until that code triggers a referral into the fraud function, and until the two loss populations are reported to the same committee in the same paper, the institution is not managing this risk, it is provisioning for it. This is unglamorous work involving reason codes, agent training and a referral workflow, and it will produce more value in its first year than any model purchase.

The second implication is that credit risk models cannot be expected to solve a problem they are structurally designed to miss. A scorecard that rewards punctual payment, moderate utilisation and file maturity is rewarding precisely the behaviour a synthetic builds. Degrading the scorecard is not the answer, because it penalises genuine thin file and credit building customers and raises a Consumer Duty question. The answer is a separate identity risk assessment running alongside the credit decision, answering a different question: not whether this applicant will repay, but whether this applicant is a person.

The third implication is that detection has to be built at cohort and portfolio level, not at application level. The unit of analysis is the network of shared attributes across the book over time, which means entity resolution across applications and accounts, velocity monitoring on identifier, address, device and contact elements, and cohort trajectory analysis against how genuine accounts mature. An institution that can only score a single application in isolation will continue to approve synthetics, because in isolation they look approvable.

The fourth implication is that scoring at the front door does not remove the need to watch the book. Identity risk assessment at application reduces intake, and intake reduction is worth a great deal, but it cannot address the population already on the balance sheet or the operator who ages an identity for three years before monetising it. In-life monitoring needs to look for the precursors of a bust-out rather than the event: a burst of credit seeking across multiple institutions, simultaneous limit requests, a change in funding source, and a sudden move from moderate to full utilisation across several lines within days.

The fifth implication is that somebody has to own the loss, and current incentives prevent it. Credit risk owns impairment and is measured on portfolio performance, so a loss reclassified as fraud improves its numbers. Fraud is measured on fraud loss rates, so the same reclassification worsens its numbers. Left to itself, this arrangement will always under-detect. The remedy is a single accountable executive for combined first-party fraud loss, a combined loss view reported to the board, and a measurement framework that does not reward either function for pushing the loss across the boundary.

Conclusion

First-party fraud and synthetic identity are not technically hard problems in the way real time payment fraud is. The signals exist, they are stable, and they are present in data the institution already holds. The reason so few lenders detect them well is organisational: the loss lands in the wrong ledger, is explained by the wrong team, and is measured in a way that makes the detection work look optional. An institution that fixes the classification and the ownership before it buys anything will get more from whatever it eventually buys.

The practical agenda is therefore sequenced rather than ambitious. Create the loss category and the referral route, so that a population exists. Reconstruct a historic cohort and quantify it, so that the funding conversation has evidence. Build entity resolution and cross-portfolio velocity analysis, because that is where the signal lives. Add identity risk assessment at the credit application point, and decide in advance what a given score will do to a decision. Then extend the same thinking into in-life monitoring, because the identity you approved carefully in 2026 is the one that busts out in 2029.

Suggested Next Steps

• Introduce a suspected first-party fraud classification at charge-off with a mandatory referral route from collections and recoveries into the fraud function, train agents on how to apply it, and report first-party fraud losses and credit impairment losses in the same paper to the same committee.

• Reconstruct a historic cohort of suspected synthetic and bust-out accounts from the last twenty four months, quantify the loss that was booked as impairment, and use that figure rather than a vendor estimate as the business case for detection investment.

• Build entity resolution and cross-portfolio velocity analysis over identifier, address, contact and device attributes, and add cohort trajectory analysis that compares how groups of accounts mature against the maturation profile of genuine credit building customers.

• Name a single accountable executive for combined first-party fraud loss across credit and fraud, and write the credit policy that states explicitly what an identity risk score does to a decision at each threshold, including where it declines, where it caps a limit and where it only triggers review.

Sources: Cifas National Fraud Database and annual fraud analysis on first-party and application fraud; UK Finance annual fraud reporting on application and identity fraud; Payment Systems Regulator authorised push payment reimbursement requirements and their exclusion of claims where the payer is party to the fraud; Financial Conduct Authority Financial Crime Guide, expectations on systems and controls, and Consumer Duty outcomes for credit customers; Federal Reserve payments fraud insights on the definition, detection and mitigation of synthetic identity fraud; Federal Bureau of Investigation Internet Crime Complaint Centre annual reporting on identity based schemes; National Crime Agency strategic assessments of serious and organised crime; HM Treasury national risk assessment of money laundering and terrorist financing; Basel Committee operational risk framework treatment of fraud loss events; TrustSphere Risk Index, April 2026.

Companion vendor assessment: today's TrustSphere Risk Index post assesses SentiLink against this problem. Read it at www.trustsphere.ai

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai