First-party fraud is a real customer who lies to get credit they never intend to repay. Third-party fraud is somebody using a real customer's identity without their knowledge. Almost every lender's loss coding, referral route and recovery process is built on that pair, and a synthetic identity belongs to neither: the applicant is not a real customer who lied, and there is no real customer to have been impersonated. So the loss falls into the only box left — credit — and the Federal Reserve says this happens as a matter of course, because "financial losses due to synthetic identity fraud often are incorrectly categorized as credit losses, as the synthetic identities appear on the surface to be actual non-paying customers" (Detecting Synthetic Identity Fraud in the U.S. Payment System, October 2019). Botminds' Synthetic Identity Fraud Detection exists to settle that question at the application rather than at the write-off, by linking each application to every one before it and giving an analyst a recommendation with its evidence attached.
This matters more than a coding convention should, for one reason the same paper spells out: a credit delinquency ages off a consumer report, and a fraud finding does not. Mis-label the bust-out and you have not only lost the money, you have put the identity back into circulation.
The worked ring on this page is sample data that ships with the solution — a fictional issuer, Corvane Bank, and fictional applicants. Research figures are the Federal Reserve's, the Treasury's and the federal courts', linked where they appear.
The two boxes a loss-coding process actually has
First-party fraud: The borrower’s own, used honestly. The lie is about income, intent, employment or occupancy.
Third-party fraud: A real person’s identity, used by someone else without consent.
First-party fraud: Nobody. The borrower is the fraudster.
Third-party fraud: The victim, who disputes the account or the charges.
First-party fraud: At first-payment default, or during collections, when the story falls apart.
Third-party fraud: Within weeks, when the victim reads a statement or a report.
First-party fraud: The lender, usually as a credit loss.
Third-party fraud: The lender, as a fraud loss, after the victim is made whole.
First-party fraud: Collections against a real person who can be found.
Third-party fraud: A reversal, a new account number, a report to the authorities.
First-party fraud: There is no real borrower whose statements can be tested against the truth.
Third-party fraud: There is no victim, because the person on the application was never alive.
What is first-party fraud?
First-party fraud is misrepresentation by the person who will owe the money. The borrower exists, the identity is theirs, and what is false is something about their circumstances or their intention: an inflated income, an employer that does not employ them, a property they will not live in, or simply a plan to draw the limit and stop paying. Because the applicant is real, almost every identity control a lender runs returns a clean answer, and the fraud is normally discovered when a loan with a perfect application never makes a payment.
The reason first-party fraud is chronically under-counted is that it is indistinguishable, at the point of loss, from bad luck. A borrower who never intended to pay and a borrower whose circumstances collapsed both produce a charge-off with no complaint attached. Lenders therefore tend to resolve the ambiguity in the direction that requires no investigation, which is credit.
What is third-party fraud?
Third-party fraud is the impersonation most people mean by identity theft: a real person's name, number and date of birth are used by somebody else, either to open a new account or to take over an existing one. It is the best-detected category in consumer finance, and the reason is not that the controls are better but that the fraud has a complainant. FinCEN's analysis of 2021 bank reports counted roughly 222,000 identity-theft reports describing attempts "to use compromised identifying information belonging to a real individual or entity to open accounts and apply for lines of credit" (Identity-Related Suspicious Activity, January 2024).
That complainant is also what sets the clock. A victim reads a statement, calls, disputes, and the lender has both a motive and a deadline to investigate. The investigation produces a finding, the finding produces a fraud code, and the fraud code produces data the next model can learn from. Every one of those steps is missing from a synthetic identity.
Where a synthetic identity sits, and why it refuses both labels
It sits in between, and that is not a semantic problem. A synthetic identity is built from a real Social Security number — frequently a child's — joined to an invented name and date of birth, so there is a real element of somebody else's identity in it, which sounds like third-party fraud. But the person who applies, pays and busts out is the person who created the identity, which sounds like first-party fraud. A 2021 indictment in New Jersey captured the hybrid exactly, alleging that the defendants built identities "sometimes by pairing the name and Social Security number of actual persons with a fictitious birthdate, and sometimes by pairing the person's Social Security number with a fictitious name and birthdate" — in that case including the defendant's own spouse and minor child (U.S. Attorney, District of New Jersey, December 2021).
FinCEN resolves the taxonomy question by putting synthetic identity under impersonation, defining the typology as the use of "a combination of real and fake PII to fabricate a person or entity to pass validation processes." But that is a classification of the technique, not of the loss. What a synthetic identity actually is, and how it is built determines how it should be investigated; what box the write-off lands in determines whether anyone ever looks again.
"If incorrectly flagged as a credit loss, the credit bureaus remove the delinquency after seven years and the fraudsters can attempt to re-use the same synthetic identity to rebuild credit and bust out again."
Federal Reserve, Detecting Synthetic Identity Fraud in the U.S. Payment System, October 2019, page 13
Fraud loss or credit loss: the test, and who makes the call
The Federal Reserve offers a two-sided test for a bust-out. On the fraud side: goods or services received, no intention to repay, and a fraudster busting out using synthetic identity tactics. On the credit side: goods or services received, a promise to repay, and a customer defaulting when financial circumstances change. The single question that separates them is the one in the middle of the diagram — "is the account holder real or fake?" — and it is answerable, which is the useful part.
It is answerable because the evidence survives the write-off. The government number check can still be run on the application as it was submitted. The credit file's first-seen date can still be read. The device, the phone line type and the address type are in the application record. And the links to other applications are still there, which is the test that does not depend on anyone's intent. The Federal Reserve's 2020 paper notes the pattern that makes this cheap: synthetic identity fraudsters "generally open multiple accounts at the same organization," and "if the identity busts out on one account, it's likely to bust out on other accounts around the same time."
Five questions that settle whether a charge-off was a ring
| Question | Where the answer is | What a yes means |
|---|---|---|
| Did the name, date of birth and number match Social Security records at application? | The consent-based government check, re-run on the application as submitted | A no-match is the strongest single indicator; a match proves nothing on its own |
| When was the credit file first seen, against the stated age? | The bureau report held with the application | A file opened two years ago for a 40-year-old is the Federal Reserve’s own example of an anomaly |
| Was the history built on borrowed authorized-user cards? | Tradeline type on the file, and the same card number on other applicants’ files | A borrowed card shared across several applicants is a network signal, not a thin-file signal |
| Does the application share a device, phone, funding account or address with others? | The application record itself, scored against every earlier application | This is the question a one-at-a-time review cannot ask at all |
| Was the final payment one that freed credit and then failed? | Payment history and returns on the booked account | A payment that restores a limit and then bounces is a plan, not a hardship |
What the mis-classification costs you
Three things, in rising order of expense. The first is the money already lost, which is the same either way. The second is the data: a loss coded as credit teaches the credit model that a thin-file applicant in that segment is a bad risk, which is both wrong and quietly expensive, because the lender then declines genuine thin-file applicants who look like a fraud it mis-labelled. The third is recurrence, and it is the one the Federal Reserve singles out. A delinquency coded as credit is removed from the consumer report after seven years; the identity is then clean, and whoever built it can use it again.
There is also a reporting consequence. A loss coded as credit generates no referral, so nothing is reported, so the Treasury's picture of the problem stays as thin as it is. FinCEN's own 2021 count makes the scale of the gap visible: 1.2 million bank reports described general fraud, including bust-out schemes, while roughly 3,000 named a synthetic identity as the typology. That is not a measurement of how much synthetic identity fraud happened. It is a measurement of how often anyone said so.
How often a synthetic identity gets named in the reports the government receives
1.2M
bank reports in 2021 under general fraud, which is where bust-out schemes are counted
423K
under false records — fake numbers, false income, forged signatures at account opening
~3,000
under FinCEN’s synthetic identity typology, worth $182 million
Where a ring's loss is booked today, and where the research says it belongs
As coded today, typically
- Credit charge-off · 82%
- Fraud · 13%
- Referred for a report · 5%
As the fraud or credit test would code it
- Fraud · 90%
- Credit, genuinely · 10%
Credit washing: how one identity busts out twice
Recurrence is not only passive. There is an active version, and the Federal Reserve gave it the industry's own name. Under the Fair Credit Reporting Act, a consumer reporting agency must block information a consumer identifies as resulting from identity theft "not later than 4 business days after the date of receipt" of proof of identity, an identity theft report, the identification of the information, and a statement that it does not relate to any transaction by the consumer (15 U.S.C. 1681c-2). The protection is a good one, and it was written for victims.
The abuse is to claim it on an identity that was never a victim. "The CRAs relay the information to financial institutions that may or may not have the bandwidth to process a full investigation within the four-day timeframe," the Federal Reserve's 2020 paper records. "If the deadline is missed, the CRA must delete the negative information from the credit report. This practice is termed 'credit washing,' and sometimes allows a synthetic to bust out more than once using the same identity" (Mitigating Synthetic Identity Fraud in the U.S. Payment System, July 2020). The same paper notes that fraudsters can flood the agencies with disputes precisely to exhaust that window.
The statute does leave the lender a lever, and it is under-used. An agency may decline a block, or rescind one, where it reasonably determines that the block was requested on the basis of "a material misrepresentation of fact by the consumer relevant to the request to block," or that "the consumer obtained possession of goods, services, or money as a result of the blocked transaction or transactions." A ring investigation that has already assembled the links, the number check and the device evidence is a lender in a position to make that case inside four business days. One that starts from a blank dispute form is not.
What the federal record says about the classification
The clearest statement of why the label matters comes from the Federal Reserve's own conclusion on categorising a bust-out: "It is important to categorize losses correctly. If a financial institution flags synthetic identity fraud activity, it can use the information to track linked accounts (e.g., other accounts with the same SSN, name, address, etc.) or other associated identities." The fraud code is not an accounting preference. It is the thing that keeps the links in the lender's own data.
The court record shows what happens when nobody keeps them. In the largest case charged, the ring maintained "more than 1,800 'drop addresses'" and ran "over 25,000 fraudulent credit cards" across a decade before the pattern was assembled — and it was assembled by investigators across institutions, not inside one (U.S. Attorney, District of New Jersey, February 2013). Each individual lender had seen a handful of bad accounts and coded them as credit. The elements that connected them were in every file.
One decision, with every action and its reason — including what goes to recovery
How to re-classify without re-opening the books
Re-coding closed accounts is a bigger exercise than most fraud teams can win approval for, and it is usually the wrong first move. The cheaper version answers the same question without touching the accounting. Take the charge-offs from the last twenty-four months, run the five questions above over the applications as they were submitted, and count how many of those accounts were linked to one another at the time. The output is not a restatement; it is a number for the next conversation — how much of last year's credit loss was a ring, stated as a share.
Three things make that number trustworthy. The replay has to run in date order, scoring each application only against the ones that preceded it, or the test is answering a question the model never faced. The false-positive side has to be counted too: how many genuine applicants the same thresholds would have held, which is the measure the Federal Reserve warns is easy to leave out. And the thresholds have to be the ones you would actually run, not the ones that make the number look best. The method, with the hold-out design, is in the guide on testing detection on your own closed files.
Once the share is known, the forward change is small: a fraud code that records the ring identifier as well as the loss, a referral route that does not depend on a customer complaining, and a rule that an account closed as part of a ring is never re-opened on a bureau dispute without the case file being read. Who holds each of those duties, and which of them needs a second signature, is set out in the guide on who signs a decline. To see the links, the recommendation and the recovery split on your own applications, start from Synthetic Identity Fraud Detection.
Questions people ask
Is synthetic identity fraud first-party fraud or third-party fraud?
Neither, strictly. It uses a real element of somebody else's identity, which looks third-party, but the applicant and the defaulter are the same person, which looks first-party. FinCEN classifies the technique under impersonation, as the use of "a combination of real and fake PII to fabricate a person or entity to pass validation processes." For loss coding, the practical answer is that it is fraud, and treating it as a third category with its own identifier is what preserves the links to other accounts.
What is the difference between a fraud loss and a credit loss?
A credit loss is a real borrower who promised to repay and could not. A fraud loss is goods or money obtained with no intention of repaying. The Federal Reserve's test for a bust-out turns on one question — whether the account holder is real or fake — and that question is answerable after the fact from the application file, the government number check and the links to other applications.
Why does loss classification matter if the money is already gone?
Because of what happens next. A delinquency coded as credit is removed from the consumer report after seven years, so the identity becomes clean and can be used again; a loss coded as fraud keeps the links to other accounts in your own data; and a credit code quietly teaches your credit model that a whole segment of genuine thin-file applicants is a bad risk.
What is credit washing?
Disputing a genuine bad record as identity theft so that it is removed. Because a consumer reporting agency must block disputed information within four business days of receiving the required documents, a lender that cannot complete an investigation in that window loses the record. The Federal Reserve notes this can let one synthetic identity bust out more than once. The statute does allow a block to be declined or rescinded where the consumer in fact received the goods, services or money.
Can the same synthetic identity really be used twice?
Yes, by two different routes: passively, when a credit-coded delinquency ages off the report after seven years, and actively, through a disputed block that nobody contested in time. Both routes depend on the lender having no record that the account belonged to a ring, which is why the fraud code and the ring identifier matter more than the write-off amount.
How much of our credit loss might actually be fraud?
That is measurable rather than guessable, and nobody else's number should be used for it. Replaying your own closed applications in date order and counting how many charged-off accounts were linked to each other at application gives a share for your own book. Published estimates of the industry figure trace back to vendor studies, so they are not cited here.