Synthetic identity fraud detection that finds the ring, not just the applicant — before the money goes out
Rings caught at application, not at charge-off, each hold explained.
See one case, screen by screen ↓Finding applicants who do not exist — a real Social Security number joined to a made-up name, date of birth and address — before they are booked or bust out. Synthetic Identity Fraud Detection does it by linking every card and loan application to the ones before it, so identities that share a phone, a device, an address, an employer phone or a funding account show up together as a ring.
How to choose AI solutions for lending →
Updated
A synthetic identity blends a real Social Security number with a made-up name, date of birth and address. It applies, gets declined, and in being declined gets a credit file. It is added as an authorized user on someone else’s card, pays on time, asks for line increases — then draws everything it can reach and disappears.
Looked at one application at a time, each identity is clean: the file is real at the bureau and the payments were real. The tell is in the set — the same VoIP phone, the same handset, the same mail-receiving store, the same funding account. With no victim to dispute it, the bust-out is booked as a credit charge-off, and the ring’s other identities keep applying.
Estimated split for one ring of about ten identities, worked by hand and with the solution, in hours.
Six specialist agents link every application to the ones before it and check each identity; the fraud analyst decides, an investigator co-signs.
Sunday night at Corvane Bank, a card application arrives on a handset the bank has seen six times before. Here is what happens next, screen by screen, in the working solution.
Elena starts the day on the link graph: every card and loan application since February is a dot, and a line means two applications share a phone, a borrowed card, a device, an address, an employer phone or a funding account. In the middle sits a new red cluster — R-2291, the Marrowfield Pike ring: 14 applications from 10 people, $102,500 of credit at stake, 6 applications already held for $83,000.
Run log: “Application linker cluster score 630 → 904 · ring R-2291 linked · 6 applications held.”
Elena replays how the ring formed. Applications appear in date order; one VoIP number, (614) 555-0182, draws faint lines between them, but the cluster score stays under the 700 hold line. By Mon 5 Oct, 9 of the 14 applications are in and the score is 540.
“A recycled VoIP number alone stays under the hold line.”
Trevor Lindqvist’s card application, A-58226, is the seventh on Android device D-7F3A. The linker re-reads all 14 credit files and finds the same borrowed authorized-user card, ••9052, on 7 of them. The score jumps to 904 and the whole cluster pulls together; the credit profile analyst pauses 3 line increases on the booked cards.
Switch every link off and the 14 scatter across the book like any other applicants. Each has a real SSN and a credit file. Four of them were booked as cards between February and April.
“14 unrelated people, each with a real SSN and a credit file — 11 of them would have scored under 300 and passed.”
Elena opens the ring and presses Investigate the ring. The identity verifier runs the government SSN check: 9 of 10 no match. The credit profile analyst finds files first seen in 2023–2024 at ages 33–42, 7 of 9 built on borrowed authorized-user cards. The device and contact checker traces one Android handset on 7 applications, a mail-receiving store at 4410 Marrowfield Pike and IPs 340 miles away; the document checker finds 6 IDs on one template, the birth-date font changed on 4.
A-58201, a Corvane Platinum card for $12,000. The SSN is from a range issued after 2011 against a 1984 birth; the credit file was first seen in January 2024 with 3 borrowed authorized-user cards, one of them ••9052; the phone is the VoIP line on 13 applications and the address is a mailbox at the mail-receiving store. Every check carries its source.
“Decline. Darnell’s SSN does not match Social Security records, the file was built in 2024 on borrowed cards, and 4 of the ring’s elements are on the application.”
Simone is in the ring only because three ring applicants claim to work at Tallow Creek Logistics. She gave the company’s main line, not the ring’s VoIP “HR” number. Her government SSN check matches, her credit file goes back to June 1998, and her license and selfie pass. Score 212: Elena clears her card to underwriting.
One signal alone never decides — the identity verifier calls an identity synthetic only when the signals agree.
The case writer recommends: decline 5 applications ($72,000), deny 3 line increases ($16,000), close 4 booked cards ($14,500 in open lines; the $2,140 already drawn goes to recovery) and hold a $3,600 payment from account ••7731 until it clears. Credit kept from the ring: $102,500. Simone’s $11,000 goes to underwriting.
“At about $13,000 per synthetic identity charged off (Equifax), nine identities is roughly $117,000 of loss if they had busted out.”
Elena signs the decision with its meaning recorded. Every decline and account closure needs a second person, so it goes to Marcus Tran, who co-signs the 5 declines and 4 closures. Only then are the 5 adverse action notices sent — the reason says only what could not be verified, nothing about the ring.
“Marcus Tran co-signed · 5 notices sent · case on its 30-day clock.”
The case writer has drafted a four-part narrative — summary, identities, activity, action — with 8 exhibits that each open at their source. Detection was Sun 11 Oct, so the report is due Tue 10 Nov: 29 days left. Simone Achebe is left out of the report. Elena refers it to Graham, who decides whether to file.
The same ring, seen by the five people who carry it — what their week looked like, and what it looks like now.
Six specialist agents link every application to the ones before it and check each identity; the fraud analyst decides, an investigator co-signs.
Links every new application to every earlier one on device, phone, address, email pattern, employer phone, IP and funding account, scores the link and groups linked applications into rings.
Runs the consent-based government SSN check, the SSN issuance logic and the credit file’s first-seen age and depth.
Reads tradelines for borrowed authorized-user cards, inquiry velocity, line-increase requests and payments that free credit before they clear.
Checks the device fingerprint, IP location and hosting, phone line type, email age and address type.
Compares ID images for shared templates and altered fields, and checks selfie liveness.
Writes the recommendation for every application and account, the case file and its exhibits, and the adverse action and closure notices.
Decides; an investigator co-signs every decline. The agents propose; a named person decides.
The analyst can ask in plain words — or ask for the case file to be drafted. Every answer points to its source.
What links Darnell Okafor to the others?
Four things. The VoIP line (614) 555-0182, given on 13 of the ring’s 14 applications; the borrowed card ••9052, on his credit file and six others; device D-7F3A, the Android handset on 7 applications; and Suite 212, 4410 Marrowfield Pike — a mail-receiving store. His SSN does not match Social Security records for his name and birth date.
Why is Simone Achebe in this ring?
Only because of her employer’s name. Three ring applicants claim to work at Tallow Creek Logistics and give a VoIP “HR” number; Simone gave the company’s main line. Everything else is her own: the government SSN check matches and her licence and selfie pass. I recommend clearing her card to underwriting.
How much credit was the ring reaching for?
$102,500 if you take the recommended actions: $72,000 in 5 new applications (Simone cleared), $16,000 in 3 line increases, and $14,500 in 4 open card lines. $2,140 is already drawn and goes to recovery; the $3,600 payment from account ••7731 is held until it clears.
Draft the case file for Marcus
Done — case file R-2291: a four-paragraph narrative and 8 exhibits, each opening at its source. Detection was Sun 11 Oct, so the report is due Tue 10 Nov. Simone Achebe is left out — she is genuine. Marcus sees it when you sign the decision.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rules every application is scored and decided by are settings, versioned and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Hold threshold (linkage score) | 700 | 500 to 900, in steps of 50 |
| Step-up band — photo ID and selfie | 500 – 699 | 500 – 699 · 450 – 699 · 550 – 699 |
| Link weights | Device 30 · funding account 30 · phone 20 · address 15 (×2 if a mail-receiving store) · employer phone 10 · email pattern 5 | Surname and any protected characteristic: 0 |
| Government SSN check | Every held application | Every held application · Every application · Held and step-up |
| Pause line increases in an open ring | On | On · Off |
| Second signature on a decline or closure | Fraud investigator | Fraud investigator · Fraud manager · Any second analyst |
| Suspicious activity report clock | 30 days | 30 days · 25 days (internal target) |
| Keep ID images for | 30 days | 30 · 90 · 7 days |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “estimated” = our estimate · “typical” = published figures: TransUnion H2 2024 Omnichannel Fraud update and 2025 release ($3.2–3.3B lender exposure, +18% synthetic-opened accounts) · Equifax (~$13,000 average charge-off per synthetic identity). People, companies and accounts named on this page — Corvane Bank, Pallas Credit Union, Tallow Creek Logistics and the applicants — are fictional: characters and sample data in the working solution.
Finding applicants who do not exist — a real Social Security number joined to a made-up name, date of birth and address — before they are booked or bust out. Synthetic Identity Fraud Detection does it by linking every card and loan application to the ones before it, so identities that share a phone, a device, an address, an employer phone or a funding account show up together as a ring.
The application linker scores each new application against every earlier one, weighting each shared element — device, funding account, phone, address, employer phone, email pattern. Applications at or above the hold threshold are held; linked applications are drawn as one cluster on the link graph, with every link and its evidence.
It is built to hold the ring and clear the genuine person who happens to share one element with it. In the working solution, Simone Achebe is linked by her employer’s name only; her SSN check matches and her ID and selfie pass, so she is cleared to underwriting. Scores in the step-up band ask for a photo ID and a selfie instead of a hold.
No. The agents hold and recommend; the fraud analyst holds, clears or recommends a decline, and every decline or account closure needs the fraud investigator’s second signature. Adverse action notices go out only after that signature.
No. The case writer drafts the narrative and exhibits, and the case runs on a 30-day clock from detection. The anti-money-laundering officer decides whether to file, and files.
No. Surname and any protected characteristic carry a weight of zero, and the application linker is set never to link on them. The government SSN check runs only with the consent captured at application.
Yes. The hold threshold, the step-up band, the link weights, when the SSN check runs, pausing line increases in an open ring, who co-signs, the report clock and how long ID images are kept are all settings. Changes are versioned and on the audit trail.
The Agentic Solution Engine builds and deploys it from your requirements — your fraud policy, link weights, notice templates and a sample of past applications and confirmed fraud cases — and it goes live once every quality gate has passed. We will walk you through it on your own applications first.
Applications verified in minutes, each figure tied to its document.
1-min demoAdverse Action Notice AutomationEvery notice out inside 30 days, each reason traced to the decision.
1-min demoCard Dispute ManagementNo missed Reg E or Reg Z deadline; claims investigated in minutes.
1-min demoWe’ll run Synthetic Identity Fraud Detection on a sample of your own past applications and confirmed fraud cases.