Synthetic identity fraud in auto lending is the problem of an applicant who does not exist, assembled out of pieces that do: a real Social Security number joined to a name and a date of birth that never belonged with it. Nothing about a mature synthetic file looks wrong at a funding desk — the number was really issued, the payment history is real because somebody really made the payments, and the score that history produces is an honest prediction about it. Botminds' Auto Loan Fraud Detection is built on the one thing that does go wrong, which is that the pieces disagree with each other, and on the discipline that follows: no single identity signal decides a case, and a thin file belonging to a real young person is never treated as a suspect.
Where a figure below comes from Auto Loan Fraud Detection it is sample data on a fictional applicant and lender, and says so. The statute, the rules and the research are quoted and linked where they appear.
What an identity actually consists of, in law and in the data
3
pieces of information the statute treats as one identity: a name, a Social Security number and a date of birth
443m
of the almost one billion possible nine-digit numbers had been assigned when the agency set out to randomise them
0
consumers who will ever telephone to report a file that belongs to nobody
1
of the fourteen findings in the sample case cleared — the identity itself, which is why the deal turned on its documents
What is synthetic identity fraud, and why a score cannot see it
A synthetic identity is a composite. The Federal Reserve System's own description, published with its white paper on the subject, is the plainest one available: "A synthetic identity is created by using a combination of real information (such as a legitimate Social Security number) with fictional information (which can include a made-up name, address or date of birth)" (Federal Reserve Board, 9 July 2019).
The same announcement sets out why detection is hard and why the loss surfaces late. Synthetic identities are used "to commit payments fraud, which can escape detection by today's identity verification and credit-screening processes"; "over time, fraudsters build up the creditworthiness of the synthetic identity, then 'bust out' by purchasing high-value goods and services on credit and disappearing"; and "because the identity was not real to begin with, there is limited recourse in tracing the perpetrators and holding them responsible for their debts". A car is close to the top of the list of high-value goods that can be obtained on credit and driven away the same day.
It is also the one fraud Congress has named in a statute. The purpose clause of 42 U.S.C. §405b says the section exists "to reduce the prevalence of synthetic identity fraud, which disproportionally affects vulnerable populations, such as minors and recent immigrants, by facilitating the validation by permitted entities of fraud protection data, pursuant to electronically received consumer consent" (42 U.S.C. §405b(a)). Keep the second clause of that sentence; the rest of this page keeps coming back to it.
A credit score cannot see any of this, and the reason is not a defect in the model. A score is a prediction about repayment, computed from a payment history, and the payment history on a cultivated synthetic file is genuine. Everything the model was built to read is true. The thing that is false — that a person stands behind the file — is not an input.
How a synthetic file is assembled, and why nobody reports it
What is a credit privacy number, and is a CPN legal?
A credit privacy number, sold online as a "CPN" or a credit profile number, is presented to a borrower as a lawful alternative identifier they may use on a credit application in place of their Social Security number. No federal agency issues such a thing, and the law has no slot for it.
The rules are specific about what a lender must obtain. A bank's customer identification programme must collect, before opening an account, a name, a date of birth for an individual, an address, and an "identification number, which shall be: (i) For a U.S. person, a taxpayer identification number" (31 CFR 1020.220(a)(2)(i)(A)). There is no other category. And the statute that created consent-based verification defines what it is verifying with the same economy: "fraud protection data" means a combination of "the name of the individual (including the first name and any family forename or surname of the individual)", "the social security number of the individual" and "the date of birth (including the month, day, and year) of the individual" (42 U.S.C. §405b(b)(3)).
So a nine-digit number offered as a substitute for a Social Security number is one of two things. Either it is nobody's, in which case it will not verify. Or it is somebody's — most often a child's, which is why the statute's purpose clause names minors — in which case using it is the use of another person's identifying information, and the whole identity-theft framework attaches to it. In the sample queue published with Auto Loan Fraud Detection, "a credit profile number in place of an SSN" sits among the other flagged patterns, a few rows below a case of washed credit.
This page is not going to describe how such a number is constructed or what makes one pass, and that is deliberate. The useful content for a fraud desk is the other direction: what a number must agree with before it is believable.
The five cross-checks that fail a synthetic file
No one of these is a finding. The method is agreement: a real identity's pieces corroborate each other because they were created by the same life, and an assembled one's pieces were created by a person filling in a form.
Five cross-checks, and what each one is actually asking
- The number against the date of birth
Only sound for numbers issued before the agency randomised them. For anything issued since, there is no relationship left to test — the next section is about why.
- The file’s age against the person’s age
A forty-year-old with no credit history before last year is possible and uncommon. A nineteen-year-old with the same file is ordinary. The question is not "thin" but "thin in a way the claimed life does not explain".
- The address against every address the report holds
A notice of address discrepancy is a formal signal with a duty attached, not a data-quality annoyance. The rule for motor vehicle dealers is quoted further down this page.
- The age of the phone and the email against the employment history
Four years at an employer, with a number ported last month and an address no report has seen, is three claims that do not sit together. One is explainable; three is a question.
- The identifying information against what the lender already holds
The rule’s own illustrative list includes the case where "personal identifying information provided is not consistent with personal identifying information that is on file with the financial institution or creditor".
Two of the rule's illustrative examples sit squarely in this territory and are worth reading in their own words, because both describe documents rather than data: a red flag arises where "other information on the identification is not consistent with information provided by the person opening a new covered account", and where "other information on the identification is not consistent with readily accessible information that is on file with the financial institution or creditor, such as a signature card or a recent check" (16 CFR 681, Supplement A, red flags 7 and 8). A synthetic identity usually has excellent data and a thin paper trail, which is the reverse of the position a fabricated pay stub puts a lender in.
What is Social Security number randomization, and why the range test broke
For seventy-five years the first three digits of a Social Security number meant something. The agency's own account is exact: "SSNs assigned before 1972 were issued by local SSA field offices and the area numbers reflected the State where the application for the number was made. Since 1972, SSA has issued Social Security cards centrally, and the area number reflects the State, as determined by the ZIP code in the mailing address of the application" (Social Security Administration, 72 FR 36540).
Because numbers were issued in blocks, in sequence, by place, a number carried an approximate issue date and an approximate place of issue — and from those, a check: does this number fit a person born in this year in this part of the country? That check was the basis of a whole generation of identity screening, and it is the one the Red Flags Rule's eleventh illustrative example reaches when it names a lack of correlation between the number's range and the date of birth.
Then the agency removed the relationship on purpose. In the same notice it set out the change — "the SSN will be randomly assigned from the remaining pool of available SSNs, and the first three digits of the SSN will no longer have any geographical significance" — having assigned "about 443 million of the almost one billion possible nine-digit combinations". Its reason was an anti-fraud reason: eliminating the geographical significance of the first three digits "can help prevent someone from learning an individual's SSN by acquiring the area number of a potential victim's SSN through knowledge of the date and/or location of the SSN application, and combining it with the correct group and serial number". The change took effect in 2011, and numbers issued after it carry no geographical meaning at all (Bennett, Page One Economics, Federal Reserve Bank of St. Louis, 2 January 2020).
The consequence for a fraud desk is specific and easy to get wrong. The correlation test still works, and only on numbers issued before 2011 — which now means applicants in their late teens and twenties are exactly the cohort the test cannot judge. In the sample case the check is the reassuring kind: a number issued in 2008, consistent with a 1992 birth, and a licence that passes. Had the number been issued in 2015, that sentence could not have been written.
Can you verify an SSN with the Social Security Administration?
Yes, with the applicant's consent, and the shape of the answer matters more than the fact of it. Congress built the route in 42 U.S.C. §405b, and the database it directs the Commissioner to maintain has a narrow job: to "compare fraud protection data provided in an inquiry by a permitted entity against such information maintained by the Commissioner in order to confirm (or not confirm) the validity of the information provided" (42 U.S.C. §405b(d)(1)).
Three limits are built into that sentence and the ones around it. It runs on consent: a permitted entity may submit a request only "pursuant to the written, including electronic, consent received by a permitted entity from the individual who is the subject of the request", and only "in connection with a credit transaction" or another permissible-purpose circumstance. It is open to a defined set of askers — a "permitted entity" means "a financial institution or a service provider, subsidiary, affiliate, agent, subcontractor, or assignee of a financial institution". And it returns a confirmation or a non-confirmation of a triple, not an identity: it does not say whose number it is, how old the number is, or whether the person in front of you is the person it belongs to.
A non-confirmation is therefore a reason to ask a question, and nothing more. Names change, data entry fails, a hyphen moves. A lender that treats a non-confirmation as a decision has converted a clerical mismatch into an adverse action, and will do it most often to people whose names do not fit a form.
What each identity source can confirm, and what it cannot
| The source | What it can confirm | What it cannot confirm | Who has to consent |
|---|---|---|---|
| Consent-based verification under §405b | That a name, number and date of birth agree with the agency’s own record, or that they do not | Whose number it is, when it was issued, or that the applicant is that person | The applicant, in writing or electronically |
| A credit report | A history, addresses the file has held, inquiries, and a notice of address discrepancy where one arises | That the file belongs to a living person, if no person ever held an account on it | Nobody — a permissible purpose is enough |
| A driver’s licence barcode and photo | That the document is internally consistent and, where a state permits the comparison, matches its record | Anything about the number on the credit application | Depends on the state |
| Phone and email history | How long a number or address has existed and whether it recently moved carrier | Who used it. A new number is the ordinary condition of a young adult | Nobody, for most line-type data |
| The lender’s own records | Whether this information has been on another application, and whether it differs from what is already on file | Anything about an applicant who has never applied before | Nobody |
| Payroll data or a tax transcript | That a real employer paid a real number real money | That the person collecting the car is that worker | The applicant |
One of those duties was written for the auto channel specifically, and it is easy to miss because it lives in its own part. The address-discrepancy rule applies to "users of consumer reports that are motor vehicle dealers excluded from Consumer Financial Protection Bureau jurisdiction", defines a notice of address discrepancy as one that "informs the user of a substantial difference between the address for the consumer that the user provided to request the consumer report and the address(es) in the agency's file for the consumer", and requires reasonable policies and procedures designed to "form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report" (16 CFR 641.1). That is a synthetic-identity duty in all but name, aimed at the party that takes the application.
What does a thin credit file mean, and when is it a real person?
A thin file is one with too little history for a score to be computed reliably, or none at all. It is the normal condition of a nineteen-year-old, somebody who has recently arrived in the country, somebody who has used cash by choice, and somebody who has just left a marriage in which the credit was in another name. It is also the normal condition of a synthetic identity in its first year.
A thin real file and a cultivated synthetic file, side by side
A real thin file: The person is young, new to the country, or has not borrowed before
A synthetic file: The file is as old as the fraud, and no older
A real thin file: Issued at a date the claimed age explains, and used for employment and tax
A synthetic file: Real and valid, but with no earnings or tax footprint attached to this name
A real thin file: Few, and they match where the person has lived
A synthetic file: Few, recent, and often not corroborated anywhere outside the credit file
A real thin file: An ordinary first account: a card, a phone, a co-signed loan
A synthetic file: Deliberately: small accounts, perfect payment, authorised-user positions, rising limits
A real thin file: Payroll, a lease, a tax record, a relative who will co-sign
A synthetic file: Documents that corroborate each other and nothing that corroborates them from outside
A real thin file: A real person is denied a car they can afford, and will say so
A synthetic file: The application disappears and the same number appears elsewhere
Which means the test cannot be "is the file thin". It has to be "does the thinness fit the claimed life", and the only way to answer that is with evidence from outside the credit file — an employer that existed before this year, a tax record, a lease, a licence with a history. That is the same evidence a lender gathers anyway when a pay stub does not reconcile, which is why the two tests belong on one desk.
How do you detect synthetic identity fraud at scale?
By making the cross-checks a step rather than an investigation, and by writing down what happens when they disagree.
The customer identification programme rule, which the Red Flags Rule's own guidelines point at for detection, sets the standard in a single sentence: the programme "must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable", and "the procedures must enable the bank to form a reasonable belief that it knows the true identity of each customer" (31 CFR 1020.220(a)(2)). Reasonable belief is the operative phrase and it is a judgement, not a threshold.
The same rule then asks for the thing most lenders cannot produce on demand, and it is the most useful requirement in the whole framework. The record a bank keeps must include "a description of the resolution of any substantive discrepancy discovered when verifying the identifying information obtained" (31 CFR 1020.220(a)(3)(i)(D)). Not the discrepancy: the resolution. A desk that can answer that for every mismatch has a synthetic-identity control; a desk that cannot has a data-quality queue.
In Auto Loan Fraud Detection the cross-checks run on every application before a case is opened — the licence barcode and photo, the number's issue date against the date of birth, the age of the phone and the email, the address history and the synthetic markers — and two limits are published alongside them. The identity component never decides identity theft on one signal, and a fraud alert on a file always means a call before credit. Both are constraints on the software rather than capabilities of it, which is the distinction worth looking for when comparing one of these systems against another.
Thirteen findings against the deal, and one that cleared the identity
What a false positive costs a real applicant
The population a synthetic-identity test flags and the population of real people with thin, recently rebuilt files overlap heavily. The statute says so itself: synthetic identity fraud "disproportionally affects vulnerable populations, such as minors and recent immigrants". The children whose numbers are used grow into adults applying for their first car with a file that looks, to a screening rule, exactly like the fraud committed against them.
There is now decent evidence about what happens to those people afterwards, and it cuts against the instinct to decline. A Federal Reserve Bank of Philadelphia working paper followed roughly fifty thousand consumers who placed an extended fraud alert — a flag that, unlike a precautionary one, requires evidence of identity theft — and reports that "the immediate effects of fraud for these consumers are negative, relatively small, and transitory", that "after placing an alert, these consumers experience persistent declines in delinquencies and a 12-point increase in credit scores, and 11 percent of filers become prime consumers", and that although "alert filers have larger balances, their performance on loans is as good as or better than before fraud" (Blascak, Cheney, Hunt, Mikhed, Ritter and Vogan, Philadelphia Fed WP 25-29, October 2025).
Read that against an auto desk's working day. The paper finds that these consumers go on to "apply for new auto loans and increase auto loan balances", and that they perform. The applicant whose file carries the marks of somebody else's fraud is, on this evidence, a better risk after the clean-up than before it — so a rule that treats the marks as the finding is declining the wrong half of the distribution. The study is about consumers who placed an alert rather than about synthetic-identity cases specifically, and it is a working paper rather than settled literature; take it as a reason for care rather than as a number to put in a policy.
One signal is never enough, and where this solution stops
Four honest limits, and they apply to Auto Loan Fraud Detection as much as to anything else on offer.
It cannot confirm that the applicant is the person the number belongs to. Nothing available to a lender can, short of the applicant appearing with documents and consenting to a check that returns a confirmation of three fields. The honest output is a reasonable belief, which is also exactly what the rule asks for.
It cannot read a state's photograph database at will. Licence barcode and photo checks depend on what each state permits, and a lender that assumes national coverage will build a control that works in some places and quietly fails in others.
It cannot tell a first-year synthetic file from a first-year real one on data alone. That is a limit of the evidence, not of the software, and the right response is to ask for something from outside the credit file rather than to lower a threshold.
It will not decide. The identity component is barred from calling identity theft on one signal, the case component is barred from declining anything, and a person signs every flagged application before funding. Where the case is bigger than one deal, the referral goes to the team that carries the reporting duty — and the opposite problem, a real person whose real debts have been removed from a file, arrives through the same door and must not be handled with the same reflex.
Where the identity check sits in the order of work
To see the identity checks, the cross-checks and the limits on each component together, start from Auto Loan Fraud Detection.
Questions people ask
How do you tell a synthetic identity from a real one?
By looking for agreement between things created at different times by different parties, rather than for a defect in any one of them. A real identity has a number issued at a date its owner's age explains, a tax and employment footprint under the same name, addresses that other records also hold, and contact details older than the application. A synthetic one usually has an excellent credit file and nothing outside it, which is why evidence from beyond the bureau decides these cases.
Does synthetic identity fraud have a victim?
Often, and the victim does not know. Where the number used belongs to a real person — commonly a child, which is why the statute's purpose clause names minors — their number has been used to build a credit history they never consented to, and they may discover it years later when they first apply for credit themselves. Where the number belongs to nobody, there is no consumer to notify, no report to trigger and no complaint, which is precisely why the losses sit undiscovered for so long.
Can a synthetic identity pass a credit check?
A mature one will pass comfortably, and that is its design. The payments on the file were really made, so the history is genuine and the score computed from it is an honest prediction about that history. What a score cannot test is whether a person stands behind the file, because that is not one of its inputs. The Federal Reserve System's own account is that synthetic identities "escape detection by today's identity verification and credit-screening processes".
What is a bust-out, and how does it end?
A bust-out is the exit. After a period of small borrowing and perfect repayment, the file draws on everything available at once and stops paying — the Federal Reserve System describes building up creditworthiness and then "purchasing high-value goods and services on credit and disappearing". On an auto desk it shows as a strong-looking applicant whose file is a year or two old, financing a vehicle near the top of what the file supports, with a first payment that never arrives.
Is a non-confirmation from a consent-based check proof of fraud?
No. The statutory database is directed to "confirm (or not confirm) the validity of the information provided", which is a statement about three fields agreeing, not about a person. Name changes, transliterations, hyphens and data entry all produce non-confirmations on entirely real applicants. Treat it as a request for one more piece of evidence, and write down how the discrepancy was resolved — which the customer identification programme rule requires of a bank in any case.
Should a lender decline every thin file?
No, and a lender that does will decline a great many young adults and recent arrivals to buy a small reduction in exposure. The workable rule is to ask whether the thinness fits the life the application claims, and to require corroboration from outside the credit file where it does not — payroll data, a tax record, a lease, a licence with a history. The cost of the other policy is paid almost entirely by people who were never a risk.