Synthetic identity fraud examples: six cases from the court record

Ask for examples of synthetic identity fraud and you will mostly be offered estimates. The federal court record is better evidence, because the government had to prove it: six prosecutions between 2013 and 2022 set out how the identities were assembled, which elements the applications shared, and how long each scheme ran before anyone joined the dots. The pattern in all six is the same, and it is the pattern Botminds' Synthetic Identity Fraud Detection is built to read — the drop address, the borrowed card, the recycled phone number and the shell company are all elements that repeat across applications, which is why a lender scoring one application at a time never saw them.

The largest of the six was, in the prosecutor's words, one of the largest credit card fraud schemes the Justice Department had ever charged. "The defendants and their conspirators stole hundreds of millions of dollars through a scheme repeated thousands of times to create more than 7,000 false identities and fraudulently obtain tens of thousands of credit cards," the complaint said (U.S. Attorney, District of New Jersey, February 2013). The smallest was one man with a telephone. Both used the same mechanism.

Charges in a complaint or an indictment are allegations; where a defendant was sentenced, that is noted. The screens on this page are the solution's sample data, on a fictional issuer and fictional applicants, shown to make the mechanism concrete — they are not any of these cases.

Real examples of synthetic identity fraud, and where they come from

There is a reason this guide is built from court filings rather than from published figures. The best-known numbers in this field — the industry's annual loss, the share of credit losses, the proportion of applicants conventional models miss — all originate in studies by firms that sell detection, and the Federal Reserve's own white papers reproduce them with that attribution attached. They may well be right. They are not evidence anyone can check, so they are not quoted here.

Indictments and sentencing records are different. They name the method, the dates, the institutions and the amounts, and they were tested somewhere. They also have one property no survey has: prosecutors must explain the mechanism to a jury, so the documents define the technique in plain words. One of the clearest public definitions of the authorized-user trick is in a 2017 indictment announcement, not in a research paper.

Case one: 7,000 identities, 25,000 cards and 1,800 drop addresses

The 2013 New Jersey case is the reference case, and its three-step description of the technique has never been bettered. The defendants would "make up" a false identity "by creating fraudulent identification documents and a fraudulent credit profile with the major credit bureaus"; "pump up" its credit "by providing false information about that identity's creditworthiness to the credit bureaus," which the bureaus incorporated "believing the furnished information to be accurate"; and "run up" large loans, because "the higher the fraudulent credit score, the larger the loans that the defendants could obtain."

What makes it instructive is the infrastructure. The ring "maintained more than 1,800 'drop addresses,' including houses, apartments, and post office boxes, which they used as the mailing addresses of the false identities." It created "dozens of sham companies that did little or no legitimate business," obtained card terminals for them, and used those companies as credit-reporting furnishers "providing the credit bureaus with false information about the credit history of numerous false identities of people who purportedly worked at or owned the Sham Companies." When processors shut an account for fraud, "they would apply for new terminals and create new companies."

It also describes the tradeline market in the government's own words. "Primary tradelines are lines of credit in a credit history," the announcement explains, while an authorized-user tradeline is where "a credit card holder adds another, so-called 'authorized user,' to a credit card account. This raises the credit score of the authorized user, who inherits some of the primary user's credit history." The defendants trafficked in both: fraudulent primary tradelines to raise limits, and authorized-user tradelines "to create new identities."

No single lender could have assembled this. Analysis of 169 bank accounts identified $60 million flowing through them, money was wired to seven countries, and the investigation ran more than eighteen months across the FBI, the Postal Inspection Service, the Secret Service and the Social Security Administration.

Case two: 750 applications with limits of $100 to $500

The 2017 North Carolina case is the opposite shape, and more representative of what a mid-sized issuer actually faces. One defendant was alleged to have submitted "more than 750 new credit card applications to financial institutions via the Internet and by telephone, using synthetic identity information," over roughly three and a half years, for "more than $340,000." The cards had "credit limits ranging from $100 to more than $500."

Small limits are a deliberate choice. They sit below the threshold at which any individual application earns manual review, below the amount at which a charge-off justifies an investigation, and below the level at which a loss gets escalated. Seven hundred and fifty of them is a programme. One of them is a rounding error.

The same indictment supplies the best public definition of the authorized-user technique, and it is worth reading twice because it explains why a ring's members appear on each other's credit files.

"Pollinated synthetic identity means a synthetic identity is added as an authorized user of an existing credit card account. This enables fraudsters to inherit the credit history of the existing credit card account holder, and makes it easier to get multiple new credit card accounts and higher credit limits."

U.S. Attorney, Western District of North Carolina, May 2017, describing allegations in the indictment

Case three: the credit-repair front and the CPN

The Eastern District of North Carolina case is the one to read if you want to understand supply. The defendant, sentenced in December 2021 to 100 months and $412,885.17 in restitution, ran what looked like a credit-repair business: the indictment charged that he "accepted fees from clients for alleged credit repair services" while "creating fictitious credit profiles and fraudulently altering client credit data through the use of fictitious police reports." Family members and clients were charged alongside him; the court held him accountable for "intended losses and fraudulent gains of more than $3.4 Million." The lenders named were a store-card issuer and two card banks.

The United States Attorney used the announcement to warn the public about the product being sold, and the warning names the artefact lenders see: "If someone offers to get you an alternate social security number, credit profile number, ('CPN') so that you can open credit lines or obtain loans – they are inviting you to participate in a crime."

That matters for how a lender reads a no-match. The Federal Reserve explains what a so-called credit privacy number usually is: nine digits sold by disreputable credit-repair operations that "may be valid but unissued SSNs, which are SSNs not yet assigned by the SSA," and whose use to obtain credit "is considered illegal by law enforcement officials, whether there is criminal intent or not" (Federal Reserve, July 2019). An applicant presenting one is not necessarily a ring leader; they may be a customer who paid for a crime without understanding it. The consent-based government number check is what separates the two, and it is the reason the second of the solution's six agents exists.

Case four: the mail receiving agency in Georgia

The 2022 Central District of California case joins the drop address to the children whose numbers were used. The defendant, sentenced to 94 months and $1,908,481 in restitution, was part of "a nationwide fraud ring that used stolen Social Security numbers – including those belonging to children – to create synthetic identities used to open lines of credit, create shell companies, and steal nearly $2 million from financial institutions."

The address arrangement is described precisely enough to be used as a control specification: he "maintained a commercial mail receiving agency space called 'Pak Mail' in Georgia where he and his co-conspirators received correspondence related to the synthetic identities, including bank account and credit card statements, while insulating their personal addresses from detection." He also "rented an apartment in Atlanta under the name 'Jason Brown'" using a stolen number and a fake licence, where cards in other invented names were found.

Prosecutors put the victim question on the record in their sentencing memorandum: the defendants "built their wealth off the backs of the people whose identities they stole, many of them children," and "both the effects on these victims' credit histories and their sense of violation are impossible to quantify." A child whose number was used may discover it only at eighteen, when they are the second applicant to use their own number and have to prove they are the first.

A rented mailbox and a recycled line, as the solution reads them

Case five: a minor's date of birth, altered

The December 2021 New Jersey indictment is the clearest statement of how the identity is assembled. The defendant and his conspirators were alleged to have used real people's dates of birth, licence numbers and Social Security numbers to create synthetic identities "sometimes by pairing the name and Social Security number of actual persons with a fictitious birthdate, and sometimes by pairing the person's Social Security number with a fictitious name and birthdate." And then the detail that explains the whole category: "They often used the name and Social Security number of a minor and altered the birthdate to make the identity appear to be that of an adult." The indictment alleges he did this to his own spouse and minor child.

The cultivation is described in the same paragraph. "The fraud cards were maintained in good standing with the financial institutions long enough to establish the creditworthiness of the stolen and synthetic identities," after which the conspirators "'busted out' the fraud cards by making large purchases and never repaying the debts." A conspirator's shell companies were used to run "hundreds of thousands of dollars' worth of charges" that were then deposited into the companies' own accounts.

Altering a minor's date of birth is also what the Red Flags Rule's eleventh example is about — "a lack of correlation between the SSN range and date of birth" — and it is one of the three flags a single application can genuinely answer. The other nine that bear on a ring need the rest of the book, which is the subject of the guide on which red flags a ring trips.

Case six: cashing out through card processing

The Northern District of Georgia case shows the back half of the machine. The defendant, sentenced in April 2017 to three years and ten months for wire fraud, "obtained and created synthetic identities to obtain credit cards in the names of fictional individuals," then "used online credit card processing services to charge transactions to the credit cards, directing all the stolen funds obtained to himself." A search warrant at his home turned up "information for over 300 synthetic identities, fake driver's licenses, a fake social security card, and numerous credit cards held in the names of individuals other than" him. He attempted $435,862.10 and obtained about $350,000.

The announcement is also an early official statement that the category was growing: the United States Attorney's office said it was "prosecuting increased numbers of these cases to stay in front of this trend," and named a second defendant sentenced three months earlier for a comparable scheme.

The merchant side of the method has not gone away. In March 2026 five defendants in the Southern District of Florida were sentenced — the lead defendant to 132 months — for a scheme that, as the prosecutors describe it, used both real businesses and shell companies to obtain card terminals from merchant processors, ran fraudulent transactions through them, and moved the proceeds out of the linked bank accounts quickly, before the processors noticed (U.S. Attorney, Southern District of Florida, March 2026). The identities and the terminals are two halves of one business.

What the six have in common, and how long each ran

Three things, and all three are relational. First, every scheme reused a physical or electronic element across many identities: 1,800 drop addresses, one mail receiving agency, one home address rented in an invented name. Second, every scheme borrowed credit history rather than building it honestly, whether through authorized-user tradelines, fraudulent primary tradelines or sham-company furnishing. Third, the schemes that state their dates ran for years: the 2017 North Carolina case about three and a half, the 2017 Georgia case three, from January 2013 to December 2015.

What ended them was never a single application being declined. It was a search warrant, a cross-institution investigation, or a collections team that could not find a person. The Federal Reserve describes that last route as the normal one: a lender "may not identify an account holder as synthetic until after a fraudster busts out and the collections team is unable to find a real person to pay the debt" (Federal Reserve, October 2019).

What a lender can do with a casebook

Two things, neither of them abstract. The first is to check whether your own controls would see the elements these cases turned on — not whether they would catch a ring, which nobody can promise, but whether the data needed to answer the question is being read at all. Address type, phone line type, tradeline type, device and funding account are the five, and a lender that validates an address without resolving whether it is a mailbox has four of them.

The second is to look backwards. All six schemes were visible in applications the lenders already held; what was missing was the comparison between them. Replaying a closed book in application order, scoring each application only against the ones before it, turns the casebook into a number for your own portfolio, and the method for running that test honestly is set out separately. One warning from the same record: a ring whose accounts were written off as credit losses may have had its bad history disputed away since, because a consumer reporting agency must block information identified as identity theft within four business days of receiving the required documents (15 U.S.C. 1681c-2), and whether the loss was coded as fraud or credit decides what you still have to find. That coding problem is a guide of its own.

If you have not yet settled the definition — how the identity is assembled and why every application looks clean — start there. To see the links, the ring and the recommendation on your own applications, start from Synthetic Identity Fraud Detection.

Questions people ask

What is a drop address?

A mailing address used to receive cards and statements for identities that do not live there. The 2013 New Jersey case describes 1,800 of them, "including houses, apartments, and post office boxes"; the 2022 California case used a rented space at a commercial mail receiving agency. The Red Flags Rule names the category directly: an address that is "fictitious, a mail drop, or a prison" is one of its 26 illustrative red flags.

What is a CPN, or credit privacy number?

Nine digits sold, usually by disreputable credit-repair operations, as an alternative to a Social Security number. The Federal Reserve records that these are often valid but unissued numbers, and that using one to obtain credit is treated as illegal whether or not the user intended a crime. A United States Attorney put it plainly in 2021: anyone offering you one "is inviting you to participate in a crime."

How large do synthetic identity rings get?

The range in the court record is wide. The largest case here involved more than 7,000 invented identities, more than 25,000 cards and over $200 million in confirmed losses, and the Justice Department called it one of the largest credit card fraud schemes it had ever charged. At the other end, one defendant filed about 750 applications for limits between $100 and $500. Both were prosecuted as the same kind of scheme.

How are synthetic identity rings actually caught?

In these six cases: by search warrants, by investigations spanning several institutions and agencies, and by collections teams discovering there was no person to pursue. None was stopped by a single application being declined, which is the argument for comparing applications with each other before any of them is approved.

Do small and mid-sized lenders get hit too?

Yes. One of these cases was a single person filing hundreds of applications for limits of a few hundred dollars, a scale any card programme can meet. The Federal Reserve says information sharing "is particularly important for smaller financial institutions, which may not have the same technology or personnel resources as larger companies," and a smaller lender also has less data of its own in which to see a pattern.

What sentences do these cases carry?

In the sentenced cases above: 100 months and $412,885 in restitution in the Eastern District of North Carolina; 94 months and $1,908,481 in the Central District of California; three years and ten months in the Northern District of Georgia; and 132 months for the lead defendant in the 2026 Florida case. One of the leaders of the 2013 New Jersey ring was later sentenced to 80 months. Charges in pending or indicted cases are allegations.