Synthetic identity fraud detection, explained.

Synthetic identity fraud, from a borrowed number to a bust-out

The life of a synthetic identity, in five steps

1. A number is borrowedA real SSN that nobody watches, joined to an invented name, birth date and address. Some sellers call it a "credit privacy number".
2. The first application is declinedThe bureau inquiry opens a credit file anyway. In our example, four applications from the ring were declined between June and August as thin files, files with too little history to score.
3. The file is agedAuthorized-user slots on strangers' cards, a secured card, small purchases paid on time. This is called seasoning; one vendor counts 14.5 months of it on average before the identity is used.3
4. The identity applies for real creditCards, personal loans, auto loans, line increases. This is where linking applications catches a ring, before the money goes out.
5. The bust-outEvery line drawn at once, often after a payment that will bounce frees the limit again. The loss usually lands in the credit-loss line.

Step 4 is the subject of this guide. The people, bank and figures in our example are fictional.

Synthetic identity facts that surprise lenders

Synthetic identity, authorized user, bust-out and eCBSV

Fourteen terms are defined in the one-page summary.

What makes an identity synthetic: the Fed's definition, three ways to build one, and how it differs from theft

In shortSince 2021 the industry has one definition, written by a Federal Reserve focus group and adopted in nearly the same words by NIST in 2025. It covers identities that are invented outright, slightly altered or stitched together from real and fake pieces. What sets synthetic fraud apart from identity theft is the missing victim, which changes who notices and how the loss is booked.

Three ways to build a person who does not exist

Synthetic, stolen or first-party: who is behind the application decides what you see

The Fed's 2019 paper describes the contrast in one line each: an identity thief "pretends to be another real person in order to use his or her credit"; a synthetic fraudster "combines fake and sometimes, real information to establish a credit record under the new synthetic identity".1

Fraud models built for identity theft look for a victim's tells: a changed address, a new device on an old account, a dispute. A synthetic identity has none. ID Analytics estimated that traditional identity-fraud models did not flag 85% to 95% of likely synthetic applicants.2,4

What the government's suspicious-activity reports say about identity

The January 2024 analysis by FinCEN, the Treasury's Financial Crimes Enforcement Network, of 2021 reports found about 1.6 million identity-related filings, 42% of all Bank Secrecy Act reports that year, describing about $212 billion of suspicious activity. It files synthetic identities under the first identity step, validation, alongside forged records: perpetrators "use a combination of real and fake PII to fabricate a person or entity to pass validation processes".9 PII is personally identifiable information: name, birth date, SSN and the like.

Piggybacking, seasoning and the borrowed tradeline: how a fake identity earns a good score

In shortA synthetic identity is grown, the way a real credit history is, only faster. The bureau inquiry creates the file, authorized-user slots on strangers' cards give it years of history overnight, and small accounts paid on time raise the score. Seasoning takes months or years, which is why the ring in our example had been applying since February.

Authorized-user tradelines: renting a stranger's history

A tradeline is one account as it appears on a credit file. An authorized user is "a person who is permitted by a revolving account holder to use an account without being legally liable", and the account's history appears on the user's credit file as well.10

A Federal Reserve study of the practice in 2010 described piggybacking as an arrangement where "an individual pays a fee to be added as an authorized user on an account" to "rent" its history, and found it "can materially improve credit scores, particularly for individuals with thin or short credit histories".10

Families do this honestly every day: a parent adds a teenager to a card. The fraud version sells slots on strangers' cards with long, clean histories, and puts several invented people on the same card. In a New Jersey case charged in 2013, prosecutors described more than 7,000 fake identities, more than 25,000 cards, at least $200 million of confirmed losses and more than 1,800 "drop addresses"; the Fed adds that the ring placed classified ads offering to pay consumers to add synthetic identities to their accounts as authorized users.11,1

Seasoning: why rings take their time

The Fed found that synthetic identities "can be nurtured for months – and sometimes, years – to achieve higher credit limits".2 In auto lending, Point Predictive counts an average of 14.5 months between an identity's first appearance and the loan it is built for.3 The longer the identity waits, the higher the limits it can reach, and the more it looks like a real customer when it arrives.

Our fictional ring shows the pattern. Seven of its nine fake files were added to the same borrowed card, ending 9052, between July 2023 and March 2024. That card was opened in 2011 at another issuer by its real holder and has a perfect record. The files were first seen by the bureaus in 2023 and 2024, when the "applicants" were already 33 to 42 years old.

Why the Social Security number itself says less than it used to

Until June 25, 2011, the first three digits of an SSN showed the state that issued it and the middle two followed a known sequence, so a lender could tell when a number was too new for its owner's age. Since that date SSA assigns numbers at random, and area numbers no longer map to states.12,13 The Fed's 2020 paper notes that randomization removed "the predictable, chronological significance of the remaining digits".4

A number's issue date now has to come from data, and an adult with a recently issued number is often a new immigrant. The Fed lists "SSN issued after 2011" as one characteristic of synthetics; section 07 explains why no such signal can stand alone.4

How a bust-out works, and why a payment that bounces can double it

In shortA bust-out is the cash-out: the identity maxes every line and stops paying. A common variant pays the balance with a check or transfer from an account that will fail, spends the freed limit again before the payment returns, and doubles the take. Signs come in the weeks before: line-increase requests, new accounts at other lenders, payments from outside accounts.

The Fed defines busting out as "maxing out the line of credit with no intention to repay", and warns that it "is not always a one-time event".2 Its example: an identity with a $20,000 line draws it, sends a $20,000 payment from a fake bank account, sees the $20,000 become available again when the payment posts, draws it a second time, and is gone when the payment is rejected.2

Prosecutors describe the same move. An indictment announced by IRS Criminal Investigation on August 12, 2026 alleges that a father and son from Pittsford, New York, built synthetic identities on real people's Social Security numbers, submitted about 1,072 online credit and debit card applications between about 2012 and July 2024, and used fraudulent checks "to pay down balances and temporarily raise spending limits", with losses of about $2,257,697. The charges are allegations that no court has decided.14

In our example, the shared bank account ending 7731 sent a $3,600 payment to one of the ring's cards on October 9 against a $580 balance. That is more than six times what was owed, and it had not cleared when the ring was linked.

Signs in the weeks before a bust-out

The Fed's 2020 paper adds the urgency: "If the identity busts out on one account, it's likely to bust out on other accounts around the same time", so linked accounts have to be connected quickly.4

The rules around a synthetic identity decision, and what changed from 2024 to 2026

In shortNo federal rule names synthetic identities. Four sets of rules surround the decision: the bank's customer identification program, the identity theft Red Flags program, the suspicious activity report (SAR), and the adverse action notice to a declined applicant. SSA's consent-based SSN check sits beside them. Between 2024 and 2026 the SSN check got cheaper, banks may now take the SSN from a database, the SAR rules were clarified, and the model-risk guidance was replaced.

The Federal Reserve's work, by title and date

The CFPB also changed course in May 2025: it withdrew 67 guidance documents on May 12, among them its circulars on adverse action notices for complex algorithms, and days later withdrew its proposed rule that would have treated data brokers, and the identity details they sell, under the Fair Credit Reporting Act. Regulation B's duty to give specific reasons was not affected.32,33,27

How eCBSV works: what the government SSN check returns, the consent it needs, and what a check costs

In shorteCBSV answers one question with a yes or no: do this name, birth date and SSN belong together in SSA's records? It runs only with the applicant's signed consent, only for credit and other FCRA purposes, and only at application. There is no per-check price: a lender buys one of twelve yearly tiers, so the cost of a check depends on how full its tier is.

What eCBSV answers, and where it stops

The consent rules

The statute allows a request only with the person's consent, written "including electronically", with an electronic signature as defined in the E-SIGN Act, and only "in connection with a credit transaction" or another purpose in section 604 of the Fair Credit Reporting Act.5 SSA's notices add that valid consent must "clearly specify to whom the information may be disclosed", the information to be disclosed, and the timeframe where one applies.34

Each permitted entity certifies its compliance at least every two years, keeps records for at least two years, and can be audited; violations are enforced under the Gramm-Leach-Bliley Act.5 In practice the consent sits in the application flow, before the applicant submits.

What one check costs

SSA's April 7, 2025 notice set twelve annual tiers, from $5,100 for up to 10,000 checks to $5,878,125 for 25 million to 200 million, after a first cut in February 2025. SSA projected 21 participating entities and 68 million checks a year, up from the 20 entities and about 52 million checks it planned for in fiscal 2024.17,34,35 Dividing each tier's fee by the most checks it allows gives the lowest cost per check in that tier.

Take a lender with 1,200,000 card and loan applications a year (an illustration). Checking only the 2% it holds means about 24,000 checks, inside tier 2: $37,125 a year, about $1.55 a check, with 51,000 more checks already paid for. Checking every application means tier 6: $907,500 a year, about 76 cents a check.

The second choice costs $870,375 more a year and catches a no-match on applications the lender would never have held. Whether that is worth it depends on how many synthetic identities slip through without a hold, which only your own charge-off review can tell you.

The signals that expose a synthetic applicant, and how much weight each one can bear

In shortNo single signal proves an identity is fake; most also describe some real people. The strong ones are a government no-match and identity details shared across many applications. A file that is young for the applicant's age, borrowed tradelines, internet phone numbers and mailbox addresses add weight when they appear together.

Why a ring only shows when applications are linked, worked through one example

In shortLinking compares each new application with every earlier one on the details a ring tends to reuse, and treats each shared detail as a line between two applications. A cluster of lines is a ring. The weight of a link depends on what is shared: a handset or a bank account says more than an employer's name. Linking also has to let real people out of a cluster they joined by chance.

The Fed's identity-verification use case shows the idea with four applicants: Social Security numbers sharing their first five digits, issued on the same date in the same state, first seen by the bureaus on the same day, and all at one address that was already on a negative list. "This indicates a high likelihood that all four applications are part of the same fraud ring", and the check is "generally done in less than a second".31

What tied the example ring together

Read alone, the phone number would not have held anyone: internet numbers are recycled, and the bank's rule kept a phone link below its hold line. What changed on Sunday night was the seventh application from one handset. The bank's linking re-read all fourteen credit files and found the same borrowed card on seven of them. The cluster's score went from 630 to 904, above the 700 hold line, and the six pending applications were held.

Switch links off and see what holds

The genuine applicant in the middle

One of the ten names was real. Simone Ajuluchi was linked only because three ring applicants claimed to work at the same logistics company she does. She gave the company's main line; they gave an internet "HR" number. Her SSN matched SSA's records, her credit file went back to June 1998, and her license and selfie passed. A link on an employer's name alone is weak, and a good process clears such people quickly: she went to underwriting the same morning.

What a week of linking looks like at the example bank

Eight reasons synthetic identities get past lenders' checks

In shortMost of the gaps are structural: checks built for identity theft, decisions made one application at a time, a credit file taken as proof, and losses booked as credit. A few are new: documents made with generative AI, and banks' freedom since 2025 to take the SSN from a database rather than the person.

What a synthetic identity costs a lender, and what a careless hold costs a real applicant

In shortThe direct cost is the bust-out, often booked as credit loss. The rest is regulatory: an identity theft program examiners can test, SARs on time at a bank, specific reasons on every decline, and fair lending duties that make protected characteristics off limits as links. The other side of the scale is the real customer held or declined by a rule built for fakes.

Losses, as the sources measure them

The three figures measure different things over different years and scopes: exposure (balances at risk), average loss per identity, and a total loss estimate. Do not add or chain them.

The applicants a fraud rule can hurt

Thin files and new SSNs belong to real people too: young adults, recent immigrants, people who lived on cash. Regulation B forbids treating applicants differently on a prohibited basis, and since July 21, 2026 the CFPB's rule says the law does not support disparate-impact claims, while disparate treatment stays illegal.21 Colorado's law on automated decisions in lending adds notice and human review from January 1, 2027.22 A sound program weights surname, nationality and other protected characteristics at zero, and lets a held real person prove who they are quickly.

The duties examiners test

Synthetic identity fraud in numbers: who measures what, and how to read vendor figures

In shortNo government agency measures synthetic identity losses. The figures come from credit bureaus and fraud-data companies, each with its own data and definition, and from a handful of public sources: FinCEN's report counts, the FTC's fraud reports, SSA's eCBSV projections. Read each vendor figure with its scope and date, and never combine them.

The same report credits SSA's check and consortium scoring for a 22% fall in its synthetic index from a peak in the third quarter of 2024, and notes that credit privacy numbers "remain widely marketed".3 TransUnion's exposure estimate fell over the same period, from $3.2 billion in mid-2024 to $2.4 billion in mid-2026, by its own figures.39,37

Equifax launched a synthetic identity product in January 2026, and TransUnion launched synthetic fraud and credit washing scores on October 20, 2026, calling them "the first-ever adverse-actionable solutions of their kind": they come with reason codes a lender can use on a decline notice. Regulation B still asks for the specific reasons behind a decline; saying only that an applicant failed a score is not enough.40,37,27

The Fed's toolkit announcement in February 2022 cited "an estimated $20 billion in losses" in 2020 from an ABA Banking Journal report; the Fed's 2020 paper quoted vendors who found synthetics in 0.3% to 0.6% of new accounts at smaller institutions and just over 20% of losses in one portfolio from under 1% of loans.15,4 Every one of these is an estimate.

What software and AI change in synthetic identity checks, and what the 2026 model guidance leaves to you

In shortSoftware can link every application to every earlier one as it arrives, re-read credit files when a cluster forms, run the SSN check and the document checks, and draft the case file. The April 2026 model-risk guidance replaced both SR 11-7 and the 2021 statement on BSA/AML models, and leaves generative AI to each bank's own controls. Decisions to decline and to file stay with people.

The Fed's 2020 paper already saw machine learning flag about 85% of synthetic applications in one credit union's beta test, and recommended "a multi-layered approach that employs both manual and technological data analysis".4 Since then three things changed: generative AI made documents and selfies cheap to fake, FinCEN told banks how to spot them, and the model guidance was rewritten.16,20

SR 26-2, issued April 17, 2026 with OCC Bulletin 2026-13 and FDIC FIL-15-2026, superseded SR 11-7 and SR 21-8, the interagency statement on model risk for systems that support BSA/AML compliance. The Fed expects it to be "most relevant" to banks above $30 billion of assets.20 Fraud scores built on statistics remain models under it; generative AI and AI that acts on its own fall outside its scope, governed by the bank's own risk management.

What FinCEN says to look for in AI-made identities

Declines, cleared customers and SAR decisions stay with fraud staff

• Declining an applicant and closing an account, with the reason that goes on the notice.27
• Clearing a real person who joined a cluster by chance.
• Deciding whether to file a SAR, and writing what it says.19
• Approving changes to thresholds and link weights, which change who gets held.

A first-of-its-kind synthetic, with nothing yet to link to, still depends on the SSN check, the file's age and the documents. And SSA told the Fed in 2020 that eCBSV cannot be run on existing accounts, so a portfolio review relies on linking and the bureau file.4

How application fraud teams work a synthetic ring today, and where the hours go

In shortAn analyst works a hold queue one application at a time. Finding the other applications in a ring means searching the origination system by phone, address and device, pulling every credit file, running the SSN checks and comparing ID images by eye. An investigator co-signs, writes the case and refers it to the AML team. For a ring of ten, most of a working day goes into finding and assembling the evidence.

Who works a synthetic ring: fraud analyst, investigator, identity ops, AML

Four people between a held application and a reported ring

Most of a day spent assembling evidence for a ring of ten

Duplicate-detail rules, bureau scores or link analysis

The Marrowfield Pike ring: a seventh application from one handset, ten identities checked, one real customer cleared, declines co-signed

In shortThis is the example from the top of the page, inside the product. Six agents link every application to the ones before it, hold the ring when the seventh application arrives from one handset, and check all ten identities in under half a minute. Elena Sorvino, the application fraud analyst, clears the one real person, signs the declines and closures, and Marcus Tran, the fraud investigator, co-signs. The case goes to the anti-money-laundering officer on its 30-day clock.

1

The morning starts on a map of every application

Monday, 9:14 a.m. Elena's home screen draws every card and loan application since February as a dot, and every shared detail as a line between two dots: phone, borrowed card, device, address, employer phone, bank account. Ordinary links, such as a couple at one address, stay small and gray.

In the middle is a new red cluster, R-2291, the Marrowfield Pike ring: 14 applications from 10 people, $102,500 of credit at stake, six applications already held for $83,000. The panel on the right lists what they share and the run log behind the hold.

2

Replay: one phone number, just under the hold line

Elena replays how the cluster formed. Applications appear in date order. One internet phone number draws faint lines between them from the first application in February, but a recycled internet number alone stays under the bank's 700-point hold line.

By Thursday, October 8 at 7:06 p.m., when Jalen Whitford applies, 11 of the 14 applications are in and the cluster score is 600.

3

Sunday, 11:48 p.m.: the seventh application from one handset

Tobin Larrow applies for a $9,500 card. His application is the seventh from Android handset D-7F3A, so the application linker re-reads all 14 credit files and finds the same borrowed authorized-user card, ending 9052, on seven of them.

At 11:52 p.m. the score jumps to 904 and the whole cluster pulls together. Six pending applications are held. At 11:53 p.m. the credit profile analyst pauses three limit increases on the ring's booked cards.

4

Six agents check ten identities in 23.6 seconds

Elena opens the ring and presses Investigate the ring. The identity verifier runs the government SSN check: 9 of 10 names do not match. The credit profile analyst finds files first seen in 2023 and 2024 at ages 33 to 42, seven of nine built on borrowed authorized-user cards. The device and contact checker traces one handset on seven applications, the mail-receiving store and IP addresses 340 miles from Columbus.

The document checker compares seven ID images: six share one template, and four of them have the birth date in a different typeface. The case writer drafts an action for every application and account.

5

Darnell Okafor: eight checks, seven flags

A-58201, a $12,000 card, applied October 5 from the mobile app. SSA says the name, birth date and SSN do not match. Issuance data puts the number after 2011, against a 1984 birth date. The file was first seen in January 2024, with three borrowed authorized-user cards added in its first 90 days, one of them the ring's card. The phone is the internet line on 13 applications; the address is a box at the mail-receiving store; the Ohio license shares the ring's template.

Every check carries a Source link. The recommendation is to decline, with Marcus Tran as second signer and an adverse action notice that says the identity could not be verified.

6

Simone Ajuluchi: a real customer, cleared the same morning

Simone is in the cluster only because three ring applicants claim to work where she does. She gave her employer's main line; they gave an internet "HR" number. Her SSN matches SSA's records, and its issue in Ohio in 1995 is consistent with her 1979 birth. Her file goes back to June 1998, with 11 accounts and no borrowed cards, and her license and live selfie pass.

Score 212. Elena clears her $11,000 card to underwriting. A weak link alone held her overnight; her own checks let her out.

7

An action for every application and account, then two signatures

The case writer recommends: decline five applications ($72,000), deny three limit increases ($16,000), close four booked cards ($14,500 of open lines; the $2,140 already drawn goes to recovery), and hold the $3,600 payment from the shared account until it clears. Credit kept from the ring: $102,500.

Elena signs at 9:16 a.m. Every decline and closure needs a second person, so Marcus Tran co-signs the five declines and four closures. Only then are the five adverse action notices and four closure notices sent.

8

The case file, on its 30-day clock

The case writer drafts a four-part narrative (summary, identities, activity, action) with eight exhibits that each open at their source. Detection was Sunday, October 11, so at a bank the report is due Tuesday, November 10: 29 days left. Simone Ajuluchi is left out of the report.

Elena refers it to Graham Oyelaran, the anti-money-laundering officer, who decides whether to file.

The solution's design target is every ring held at application, before funding, with 100% of holds carrying the link and the document that caused them. These are targets, to be measured on your own applications. The 23.6 seconds is the sample run shown on the screen.

Shared phones, the ring's timeline, a booked card's checks and the bank's fraud policy on screen

In shortOne ring is the story. These screens show the rest: what a one-application check sees, a shared element opened with every application behind it, the identities table and the ring's timeline, a booked card's checks, the signature and the notice, the list of rings, the live monitor, the weekly pattern report and the settings.

Select any screen to open it larger. The bank, applicants, people and figures are fictional sample data.

What each fraud agent may do, and who must sign every decline and closure

In shortEach agent has one job and limits it does not cross. None declines an applicant, sends a notice or files a report. The application linker can hold an application; the fraud analyst holds, clears or recommends; every decline and closure needs the fraud investigator's second signature; the anti-money-laundering officer decides whether to file.

Six agents link applications and check each identity

People decide; every hold is explained

The head of fraud strategy owns the thresholds and link weights and approves suggested rules; changes are versioned. Every link names the element and the applications it came from, every check has a source, agent steps and human decisions are kept apart on the audit trail, and the SSA check runs only with the consent captured at application.

Elena Sorvino's application fraud team

The application stream and identity checks it reads, and the rings, notices and case files it leaves

In shortIt reads the application stream and the identity checks you already buy, links them under your fraud policy, and leaves behind rings with their evidence, a signed action for every application and account, notices, a case file for AML and a weekly pattern report. Your origination system stays the system of record.

Origination, bureaus, eCBSV, device data and ID services to connect

For each, check whether it has an API, a file feed or only screens, and who owns it.

Your origination system, bureau scores and SSA check stay in place

Explained holds, no protected traits as links, people decide

What synthetic identities, slow ring investigations and wrong holds cost a card or loan issuer

In shortStart from your own losses. Industry figures only frame the question: a bureau's average loss per synthetic identity, the hourly cost of an analyst, the price of the government SSN check. The number that matters is how many of your own charge-offs had no real person behind them, and how many good applicants your rules hold to find them.

Find the synthetic losses hiding in your charge-offs

The ring's other names, held good customers and misused children's SSNs

Synthetic losses, investigator days and wrong holds: the return from linking every application

In shortPut in your own numbers. The calculator starts from a bureau's average loss and a published analyst wage and asks you for the rest: how many synthetic identities reach approval today, how many you would stop at application, how many rings you investigate and what the tool costs. Every default marked illustrative is an assumption to replace.

Stopped at the door, closed before the bust-out, fewer wrong holds

Price application linking on your own synthetic losses

A large issuer that books dozens of synthetic charge-offs a month clears this easily. A small lender with a few a year should ask whether a bureau score and the SSA check, without a full linking tool, cover most of its risk.

Fraud team self-check for synthetic identities: application volume, labeled charge-offs, device data and the SSN check

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

Next steps for your fraud team, from charge-off review to live linking

Eighteen tests for a synthetic identity vendor: what it links, how it explains a hold, the SSA check and consent

In shortAsk every vendor the same questions, us included. The answers show what the tool links, how it explains a hold, how it handles the SSA check and consent, who decides, what happens to your data, and how you would measure it on your own applications.

We found no published independent test comparing synthetic identity detection vendors, as of October 2026. A back-test on your own applications is the fairest comparison, and the same test measures your current rules.

A twelve-week synthetic identity pilot: label young-account charge-offs, replay past applications blind, then run live in parallel

In shortMeasure first, then replay your own past applications whose outcome you already know, then run in parallel with your analysts deciding. Decide with three numbers. None of these steps commits you to a vendor.

1. Review a year of charge-offs on accounts under two years old and label the synthetic ones. That is your loss baseline.
2. Time three ring investigations from first hold to signed case, and count holds cleared as genuine.
3. Assemble 12 to 18 months of applications with device, phone and outcome data, and an approval path to share them.
4. Replay them blind and compare what linking would have held with what actually charged off.
5. Run in parallel on live applications for six weeks; decide with three numbers: synthetics caught at application, real applicants held, analyst minutes per ring.

Synthetics caught, real applicants held and days to referral

CPNs, bust-outs, piggybacked tradelines, eCBSV and SAR filing: synthetic identity fraud questions answered

In shortThe questions fraud teams and buyers search for most, each answered on its own.