How synthetic identity fraud hides inside one loan vintage

Synthetic identity fraud detection, done the way it actually works, is link analysis across time. One loan file looks like a marginal applicant; the ring is visible only when a window of applications — 180 days is the working horizon — is searched for shared devices, shared bank accounts, shared phone numbers, shared addresses, shared employers and shared document templates. Early Payment Default Review runs exactly that search the week a vintage turns, because an early default is often the first time a ring's loans surface together: none of them pays, and they all miss at once. The guide below follows one fictional ring through the solution, from the first shared device to the referral a bank's BSA team receives.

The ring, the bank, the partner and every loan in this guide are invented sample data from the solution's fictional August vintage — an illustration of the method and its limits, not a typical ring size or a measured rate. The regulatory figures come from FinCEN's own published analysis and the Bank Secrecy Act rules, linked where they appear.

What is synthetic identity fraud, and how is it different from stolen-identity fraud?

Synthetic identity fraud fabricates a person; stolen-identity fraud borrows one. FinCEN's definition is exact: the typology is "the use of a combination of real and fake PII to fabricate a person or entity" (FinCEN, Identity-Related Suspicious Activity, January 2024). The synthetic borrower may carry a real Social Security number paired with a fabricated name and date of birth, or a real address history stretched around a made-up employment record — enough real material to pass validation, enough fake material that no actual person is responsible for the debt. Stolen-identity fraud, by contrast, impersonates a specific real person, whose credit file and life show the damage. For a lender the distinction matters operationally: a synthetic identity has no true owner to call, no genuine hardship to work out, and no honest file to re-read — only signals.

The fabricator's goal is validation, not perfection. The file must pass the checks the application actually runs: an identity match, a pay-stub image, a bank account in the borrower's name. Everything else is economy — the same device for several applicants, the same pay-stub template for two employers, an internet-line phone number registered the same month as the account. Detection starts from that economy.

How a fraud ring hides inside a normal-looking vintage

A ring hides by distributing itself. Its loans spread across weeks and sub-sources, each application individually plausible: a score in the low 700s, a debt-to-income under 32%, an employer that answers the phone. In the sample vintage, the 19 ring loans were funded between 4 and 19 August through one partner sub-source, FW-2207, each with a different borrower's name. Seen one file at a time, each looked like a credit success. Seen as a group, not one payment was ever attempted on any of them — 0 of the first 38 due — and every file shared infrastructure. The vintage's early-default rate for the sub-source, 5.14% against a 3.0% contract trigger, was the ring surfacing as a channel spike before anyone knew it was a ring.

This is why single-file review misses rings by construction. A fraud analyst reading one file sees one marginal borrower; the same analyst reading the link map sees the shape. The NBER's study of mortgage misrepresentation made the same point from the sales side: "a significant degree of misrepresentation exists across all reputable intermediaries" (NBER Working Paper 18843) — the practice is a market pattern, visible only in aggregate, not the work of one sloppy desk.

The link map: 19 loans, 4 devices, 3 accounts, 2 employers — and what they share

The six signals that link one loan to another: devices, accounts, phones, addresses, employers, templates

Six signal families do the linking, and each is cheap for a ring to reuse and expensive to vary. Devices: the sample ring's 4 devices each carried 3 to 7 of the 19 loans, one device fingerprint on 6 other applications in 30 days. Bank accounts: 3 receiving accounts, all opened in July, taking 5 to 8 loans each — an account that exists to receive loan proceeds is a signature in itself. Phones: 11 employer phone numbers, all internet lines registered within two weeks, some answered by the same voice for two different employers. Addresses: the same drop addresses across applications that claim different households. Employers: two companies sharing one pay-stub template, the same fonts and the same pay-date error. Templates: the document image itself, matched pixel-for-pixel across supposedly unrelated applicants.

How big is the problem? What FinCEN's own data shows

FinCEN's January 2024 Financial Trend Analysis quantified identity-related suspicious activity from the 2021 BSA filings: "approximately 1.6 million, or 42% of around 3.8 million total BSA reports, equivalent to $212 billion in suspicious activity, related to identity" (FinCEN FTA, January 2024). Identity is the single largest thread in the country's suspicious-activity reporting. Within it, the typology this page concerns is small in dollars — roughly 3,000 reports carrying $182 million — because synthetic-identity loans are usually consumer-sized and individually unremarkable. The aggregate is where the damage lives, and the aggregate is only visible to whoever links the files.

What a link analyst can do, and what it must never do

The link analyst in Early Payment Default Review reads 180 days of applications and loans on six signals, groups what links, and lists the applications still in the pipeline that carry the same ones — in the sample run, two open applications worth $41,000, flagged for hold the morning the ring was found. Its limits are written into the product, and they are the point. It never blocks an account. It never declines an application. It never files a report. What it prepares is the referral: the link map, the shared signals with their evidence, and the list of open applications, handed to people who hold the authority it deliberately lacks. "Confirmed rings go to your BSA team" is a design decision, not a courtesy — filing thresholds, timing and liability belong to the bank's own officers.

When does the 30-day suspicious activity report clock start?

The Bank Secrecy Act's clock runs from detection, not from the crime. For a bank, "a bank is required to file a SAR no later than 30 calendar days after the date of initial detection by the bank of facts that may constitute a basis for filing a SAR"; if no suspect was identified at detection, the bank "may delay filing a SAR for an additional 30 calendar days to identify a suspect", and "in no case shall reporting be delayed more than 60 calendar days after the date of initial detection" (31 CFR 1020.320(b)(3)). Two consequences follow for a lending desk. First, detection is an organizational fact: the day the ring's linked signals are confirmed is the day the clock starts, which is why the sample run dates detection — Monday 2 November — and shows the BSA team's decision deadline, 2 December, on the ring page itself. Second, preparation speed matters legally, not just operationally; a referral that takes weeks to assemble consumes the clock the bank will be judged against.

What happens to applications still in the pipeline when a ring is found?

They are the ring's next month, and they are usually still approvable on their own numbers. The sample ring had two open applications carrying the same device and template signals — submitted the Sunday before and that same morning — which the link analyst listed with a hold recommendation and a single button for the fraud strategy manager. Holding is a human decision, and a reversible one; the applications are not declined, and the borrowers — whoever they are — are not accused. If the hold clears, funding proceeds; if the ring confirms, the applications are declined on the policy line the bank writes for that case. What the pipeline must never do is keep flowing silently while the ring is being documented: every day of assembly is a day the ring keeps selling itself loans.

Can an AI agent file a SAR? Where the line is drawn

No — and the line is drawn in the product, not in a policy memo. Filing a suspicious activity report is a legal act by the bank: the report is filed under the bank's own judgment, on facts the bank stands behind, within a clock only the bank can start. An agent that proposed causes could in principle draft the narrative, and in this solution it stops one step earlier than that — it prepares the referral and the evidence, and the BSA team decides. The same line runs through every other consequential act: never block an account, never decline an application, never contact a borrower. The general shape of that division — what automation proposes, what people decide — is the subject of how the six agents in this solution actually work, and the cautionary side of mistaking credit misses for fraud is where mis-drawn lines cost the most. To see the link map, the pipeline holds and the referral on a working vintage, start from Early Payment Default Review.

Questions people ask

What is synthetic identity theft?

It is the fabrication of a person from mixed real and fake personal information — a real number paired with a made-up name, a real address stretched around invented employment — so the identity passes validation while no real person answers for the debt. FinCEN defines the typology as "the use of a combination of real and fake PII to fabricate a person or entity."

How does device fingerprinting fraud detection work?

A device fingerprint identifies the phone or computer an application came from, independent of what the applicant types. When one fingerprint appears across applications claiming different borrowers, households and employers, the device links them — in the sample ring, four devices carried all 19 loans. Fingerprints are one of six link signals, alongside accounts, phones, addresses, employers and document templates.

What is the suspicious activity report filing deadline?

A bank must file no later than 30 calendar days after initial detection of facts that may constitute a basis for filing; if no suspect was identified at detection it may take up to 30 further days to identify one, and never more than 60 calendar days after initial detection (31 CFR 1020.320(b)(3)).

What triggers a suspicious activity report for a lender?

A transaction conducted or attempted by, at, or through the bank, involving or aggregating at least $5,000, where the bank knows, suspects, or has reason to suspect it hides criminal proceeds, is designed to evade requirements, or has no business or lawful purpose (31 CFR 1020.320(a)(2)). A ring of loans that never pay, linked by shared infrastructure, is a textbook aggregation case.

How do you prevent synthetic identity fraud at origination?

Verify against third-party facts the fabricator must rent — device reputation, account age, phone registration — and run every application against the recent window, not just against itself, because the ring's economy is in reuse. Prevention is cheaper at the partner door: the sample ring entered entirely through one sub-source, and closing that door ended its access.

What is loan stacking, and is it the same as a synthetic-identity ring?

Loan stacking is taking several loans in a short window, often from different lenders who cannot see each other. It overlaps with synthetic-identity fraud — a fabricated borrower can stack — but a stacker using one real identity is a credit-risk problem, not fabrication. The link signals separate the two: shared devices and templates across names point to synthesis; one name, many lenders points to stacking.