New account fraud statistics are scarce because no agency counts new account fraud as such. The public picture is assembled from five sources that each see part of it: the Bureau of Justice Statistics' survey of identity-theft victims, in which less than 1% of residents aged 16 or older said their information was used to open a new account in 2021; FinCEN's analysis of identity-related suspicious activity reports, 1.6 million of them in 2021; the Federal Reserve's annual survey of bank risk officers, which shows new-account and mule-account fraud persistent or rising; FinCEN's study of mail-theft check fraud; and FTC complaint data. Each counts victims, reports or institutions, not accounts, and none counts the loss to banks. For a board paper, that means citing them for direction and using the bank's own data for size, which is what Botminds' New Account Fraud Detection is built to produce.
New account fraud is the rarest identity theft households report
How common is new account fraud?
Uncommon for households, common for banks. In the Bureau of Justice Statistics' 2021 survey, an estimated 23.9 million people, "about 9% of all U.S. residents age 16 or older", experienced identity theft, but "Less than 1% reported the misuse of their personal information to open a new account" (BJS, Victims of Identity Theft, 2021). Among victims, about 3% had a new account opened with no other identity theft, and 5% experienced several types together.
The banks' side looks very different, because a bank sees every attempt, including those using identities of people who never notice, synthetic identities that belong to nobody, and real customers renting out their own accounts. FinCEN's 2021 analysis found that identity-related reports made up "approximately 1.6 million, or 42% of around 3.8 million total BSA reports, equivalent to $212 billion in suspicious activity", and depository institutions filed 54% of them (FinCEN, Identity-Related Suspicious Activity: 2021 Threats and Trends). Not all of those concern new accounts; the report counts typologies, and a single report can describe several.
Among identity-theft victims, new-account-only cases are a small slice
All victims’ most recent incident, 2021
- At least one existing account misused · 85%
- Everything else · 15%
Inside the other 15%
- Other fraudulent purposes · 47%
- Several types at once · 33%
- New account only · 20%
What the suspicious activity reports count
FinCEN's figures count what banks and other institutions reported as suspicious, not proven fraud, and their dollar amounts include attempts. Within them, the typology closest to new account fraud is identity theft in the narrow sense: "More than 222,000 identity-related BSA reports documented identity theft", with "$36 billion in suspicious activity", describing attempts "to use compromised identifying information belonging to a real individual or entity to open accounts and apply for lines of credit". FinCEN adds that institutions "often identify the activity after discovering false records, additional fraud, or determining the victim is deceased, incapacitated, incarcerated, or otherwise unable to apply at the time of application".
What FinCEN’s 2021 identity analysis counted
1.6M
identity-related BSA reports, 42% of all reports filed
$212B
in suspicious activity, including attempts
222,000
reports of identity theft used to open accounts or apply for credit
13%
of identity-related reports describe weak or circumvented verification
Two other typologies in the same report sit inside new account fraud. "False records", about 423,000 reports, covers fake Social Security numbers, false income documents and forged signatures presented "when opening accounts, applying for lines of credit, or conducting transactions". And "third-party money laundering", about 154,000 reports and $18 billion, covers money mules and straw buyers. A rented checking account appears there, not under identity theft.
What the household survey counts
The BJS survey counts people who know they were victims. That is its strength, because it measures harm to individuals with a national sample, and its blind spot, because a stolen identity used once to open a mule account may never come to its owner's attention, and a synthetic identity has no owner to interview. The survey also measures losses only to victims: its loss figures "exclude financial losses to stores, credit card companies, and banks". With that caveat, it is the one source that prices new account fraud for the person whose name is on the account: mean direct losses "were higher for victims whose personal information was misused to open a new account ($3,430) than for victims whose credit card ($620), bank account ($670), or other existing account ($550) was misused".
Is new account fraud increasing?
The banks surveyed by the Federal Reserve say it is, modestly. In its 2026 survey of more than 400 institutions, fielded in late 2025, "account openings showed heightened vulnerability, as 3% more financial institutions reported that this type of fraud was persistent or increasing compared to last year" (Federal Reserve Financial Services, 2026 Key Findings from the Financial Institution Risk Officer Survey). The same survey found "a 3% increase in the number of financial institutions rating risks from mule accounts and synthetic ID accounts as impactful and persistent or increasing, trending up two years in a row". Two caveats travel with every figure from it: the survey says its findings "are not independent academic research", because the Federal Reserve offers the payment services the respondents use, and its margin of error is plus or minus 6% at 95% confidence. A 3-point change is inside that margin.
Older series point the same way without measuring new accounts directly. FinCEN counted more than 680,000 check-fraud reports in 2022, nearly double the year before, and its study of mail-theft check fraud found that many perpetrators kept away from bank staff: they deposited through remote deposit capture or at ATMs, and opened accounts online rather than in person (FinCEN, Mail Theft-Related Check Fraud, 2024).
How are mule accounts opened?
Mostly in branches, according to the institutions the Federal Reserve surveyed, but with virtual openings growing. "A total of 53% of surveyed financial institutions reported experiencing this type of fraud", and "mule accounts are most often opened in branches", the survey reports, "with growth in virtual openings". Its summary puts deceived legitimate customers behind two-thirds of mule account fraud, with synthetic identities and accounts opened by criminal enterprises rising steadily; strictly, the underlying chart shows two-thirds of institutions seeing deceived customers' accounts used as mules, not two-thirds of mule accounts (the guide to types of money mules sets out the difference). It also found "51% of institutions surveyed reported that they identified mule activity only after losses". That last figure is the one most relevant to new accounts: a mule account found after the money has passed through it is a detection that came too late to prevent anything.
"Payments fraud data, such as value and volume of fraudulent payments and industry negative lists, is currently collected in an incomplete, non-standardized, ad hoc, and fragmented way."
OCC, Federal Reserve and FDIC, Request for Information on Potential Actions To Address Payments Fraud, June 2025
Is new account fraud worse online?
The public data do not settle it. FinCEN's check-fraud study found perpetrators preferred opening accounts online to avoid human contact, and its identity analysis found remote verification easier to defeat. But the Federal Reserve's risk officers named branches as the most common place mule accounts are opened. The likeliest reading is that both are true: online opening is where stolen and synthetic identities enter at scale, while branches are where deceived or recruited real people open accounts in their own names. A bank should measure its own channels separately rather than borrow either conclusion.
Five public measures of new account fraud: what each counts and what it misses
| Source | What it counts | What it misses |
|---|---|---|
| BJS Identity Theft Supplement, 2021 | People 16+ who know their information was used to open a new account: less than 1% | Synthetic identities, unnoticed victims, mules, and all losses to banks |
| FinCEN identity-related SAR analysis, 2021 data | Reports filed: 1.6 million identity-related; 222,000 identity theft | Fraud not reported; reports overlap; amounts include attempts |
| Federal Reserve risk officer survey, 2026 | Institutions saying a fraud type is persistent or increasing | Volumes and losses; not independent research; ±6% margin |
| FinCEN mail-theft check fraud analysis, 2023 data | 15,417 reports and how stolen checks were used, including online-opened accounts | Fraud not linked to mail theft |
| FTC Consumer Sentinel, 2024 | More than 1.1 million identity theft reports to IdentityTheft.gov | Unreported cases; reports are not verified |
How much does new account fraud cost?
Nobody publishes the bank side. The BJS figures price the victim's direct loss, $3,430 on average for new-account cases. FinCEN's dollar totals price suspicious activity, including attempts and double counting, not losses. The Federal Reserve survey reports trends, not dollars. And the June 2025 interagency request for information on payments fraud said of fraud data generally what the passage quoted above says: it is gathered piecemeal and without a common standard. By late October 2026 no rule or guidance had followed that request in the Federal Register.
One widely repeated figure shows why sourcing matters. In an April 2025 speech, Federal Reserve Governor Michael Barr said that "Deepfake attacks have seen a twentyfold increase over the last three years" (Barr, Deepfakes and the AI Arms Race in Bank Cybersecurity). The speech's footnote for that sentence cites a press release from a commercial identity-verification company, not a government or academic study. The claim may be right, but its source is the company's own data, and a board paper should say so or leave it out.
Why the numbers will not agree, and what to count instead
Because they count different things: people, reports, institutions' opinions, complaints. None counts accounts opened to commit fraud at a given bank, the days they lived, or what they took. The only reliable statistics for a board paper on new account fraud are the bank's own: openings by channel and partner, how many reached review, how many were restricted or closed and on which day of their life, how much was held before release, how many restrictions were reversed. The public sources give the direction; the bank's data give the size.
Six new account fraud statistics a bank can measure for itself
- Openings by channel and partner
The denominator every other figure needs; branches, online, mobile and each partner separately.
- Share that reached review
How much of each channel the program actually looked at, and on which day of the account’s life.
- Restrictions and closures per 1,000 openings
By channel and by shape: stolen identity, mule pass-through, bust-out, kiting, synthetic-looking.
- Day of life at restriction
The median and the spread; a restriction after the first large deposit cleared prevented little.
- Amount held before release, and amount lost
Held deposits and blocked transfers against charge-offs and returned items on young accounts.
- Reversals
Restrictions later lifted as mistaken: the cost good customers paid, and the check on every other number.
Two of those deserve a line of their own in any board paper. Day of life at restriction tells the board whether detection is early enough to matter, which no public statistic can. Reversals tell it what detection costs the bank's honest customers, which the public statistics never mention at all. A program that reports restrictions without reversals is reporting half of its own performance.
A bank’s own new account fraud statistics, for the fraud committee
On the solution's fictional sample bank, which opens about 9,800 accounts a month, 298 reached review in the first 22 days of October and 64 were restricted or closed, with the median restricted on day 17 of its life. Those are sample figures, but they are the shape of statistics a bank can stand behind, because every one of them points to decisions with reasons. A ring that opens five accounts in a week across two or three partners does not appear in any public series; it appears in a bank's own. Which shapes those restrictions take, window by window, and how to test detection against last year's numbers, follow from here. To see them on your own accounts, start from New Account Fraud Detection.
Questions people ask
What percentage of identity theft is new account fraud?
In the BJS 2021 survey, about 3% of identity-theft victims had only a new account opened in their name, and 5% had several types of identity theft that could include one. The great majority, about 85%, involved misuse of an existing account.
How many accounts are opened with stolen identities?
No public source counts accounts. FinCEN's 2021 analysis counted more than 222,000 identity-related reports describing identity theft used to open accounts or apply for credit, but reports are not accounts, one report can cover many, and many cases are never reported.
Where do new account fraud statistics come from?
In the United States, from the Bureau of Justice Statistics' Identity Theft Supplement, FinCEN's analyses of Bank Secrecy Act reports, the Federal Reserve's annual risk officer survey, and FTC complaint data. Figures from vendors and analyst firms are based on their own clients' data and should be labelled as such.
Do victims lose money when an account is opened in their name?
Often less than the bank does, but not nothing. BJS found mean direct losses of $3,430 for new-account victims, higher than for other identity theft, while only 9% of them had out-of-pocket losses at the time of their interview, because much is reimbursed.
Are synthetic identities counted in these statistics?
Mostly not. A synthetic identity has no victim to answer the BJS survey, and many synthetic losses are booked as credit or overdraft losses rather than reported as fraud. FinCEN counts synthetic identities as a separate typology when filers recognise them.