What is synthetic identity fraud? The applicant who does not exist

Synthetic identity fraud is the manufacture of a person. A real Social Security number is joined to a name, a date of birth and an address that belong to nobody, the combination is used to apply for credit until a lender says yes, and the resulting account is paid carefully for months or years until the limits are large enough to be worth taking. The National Institute of Standards and Technology defines it in one line — "the use of a combination of personal information to fabricate a person or entity to commit a dishonest act for personal or financial gain" (NIST SP 800-63-4, July 2025). Botminds' Synthetic Identity Fraud Detection is built for the consequence of that definition: because each application is genuinely clean on its own, the fraud can only be seen across applications, so every new card and loan application is scored against every one that came before it.

That is the difference from the fraud most people mean when they say identity theft. In identity theft there is a victim, and the victim notices. In synthetic identity fraud there is no victim to notice, which is why the Federal Reserve's own research found that a lender often "may not identify an account holder as synthetic until after a fraudster busts out and the collections team is unable to find a real person to pay the debt" (Detecting Synthetic Identity Fraud in the U.S. Payment System, October 2019). By then the money is gone and the loss has usually been written off as credit.

The screens and the worked ring on this page come from the sample data that ships with the solution: a fictional issuer, Corvane Bank, and fictional applicants. Every figure drawn from it is marked as sample data. The research figures come from the Federal Reserve, the Treasury's Financial Crimes Enforcement Network, NIST and federal court records, linked where they appear.

What is synthetic identity fraud, and what it is not

The Federal Reserve's definition is the one most practitioners work from: "a crime in which perpetrators combine fictitious and sometimes real information, such as SSNs and names, to create new identities to defraud financial institutions, government agencies or individuals" (Synthetic Identity Fraud in the U.S. Payment System, July 2019). The same paper separates three methods inside that definition: identity fabrication, where nothing is real; identity manipulation, where real information is slightly altered; and identity compilation, where real and invented elements are mixed. Most of what lenders see is compilation, because a real Social Security number is what makes the rest credible.

What it is not is theft of a living person's credit. The Federal Reserve draws the contrast in three columns: a traditional identity fraudster "pretends to be another real person in order to use his or her credit"; a legitimate applicant "uses valid information to set up accounts and obtain credit"; a synthetic identity fraudster "combines fake and sometimes, real information to establish a credit record under the new synthetic identity." The third column is the one no fraud model was originally built for, because the first two both assume a real person exists somewhere in the transaction.

The last row is where most of the money is lost, and it is covered in its own guide: first-party, third-party or synthetic, and why the label decides the loss.

How a synthetic identity is created, in five moves

The sequence is well documented, because federal prosecutors have had to prove it. In the largest case charged to date, the complaint described a three-step process the defendants repeated thousands of times: "make up" a false identity by creating documents and a credit profile, "pump up" its creditworthiness by feeding false information to the bureaus, then "run up" large loans that were never repaid (U.S. Attorney, District of New Jersey, February 2013). The Federal Reserve's version has five steps rather than three, because it separates the declined first application and the borrowed history. Both describe the same machine.

Step four has a name in the court record. A 2017 indictment in the Western District of North Carolina explained it for the jury: "Pollinated synthetic identity means a synthetic identity is added as an authorized user of an existing credit card account. This enables fraudsters to inherit the credit history of the existing credit card account holder, and makes it easier to get multiple new credit card accounts and higher credit limits." The same defendant was alleged to have filed more than 750 credit card applications with limits of "$100 to more than $500" — small enough that no single one was worth investigating.

Step one is the part that makes the crime hard to feel. The Federal Reserve's research is blunt about whose numbers are used: the personally identifiable information of people "such as children, the elderly or homeless – who are less likely to access their credit information and thus, discover the fraud." A 2021 indictment in New Jersey went further, alleging the defendants "often used the name and Social Security number of a minor and altered the birthdate to make the identity appear to be that of an adult" — including, in that case, the defendant's own child.

Why a credit file is not proof that a person exists

This is the mechanism that does the most work, and almost nobody outside fraud teams knows it. When a lender pulls a report on an applicant with no history, the inquiry itself creates a file. The Federal Reserve states the consequence plainly: "Even if the financial institution rejects the credit application, the credit bureau automatically creates a new credit profile, since the applicant is considered new. The new credit profile becomes the synthetic identity's so-called 'proof' of existence."

The 2020 paper traces it to the statute. "The Fair Credit Reporting Act requires that when a credit inquiry is submitted to a credit reporting agency, the credit reporting agency must create a credit file – whether or not the customer's identity has been validated," it says. "The existence of a credit file can seem to imply 'proof of life' and validation of the identity, but it does not" (Mitigating Synthetic Identity Fraud in the U.S. Payment System, July 2020). A declined application is therefore not a dead end for a fraudster. It is the first rung.

It also explains why the law's own identification requirements do not catch this. A bank's customer identification programme must collect a name, a date of birth, an address and an identification number before opening an account (31 CFR 1020.220). A synthetic identity supplies all four, and three of them are invented. NIST says the same thing about the number itself: "Knowledge of an SSN is not sufficient to act as evidence of identity" (NIST SP 800-63A-4, §3.3.2).

Resolution, validation, verification: three questions, not one

The clearest framework for where synthetic identities are caught is a government one, and FinCEN now uses it too — its 2024 analysis says explicitly that it "based these identity processes on the NIST Special Publication 800-63A Digital Identity Guidelines." NIST splits identity proofing into three steps, and they ask three different questions.

Resolution asks who else this might be: it is the "collection of the minimum amount of identity evidence and attribute information that is needed for identity proofing and to distinguish a unique identity in the population served." NIST adds the sentence that matters most here: "Identity resolution is the starting point in the overall identity proofing process, including the initial detection of potential fraud." Validation asks whether any of it is real — "confirm that supplied identity evidence is genuine, authentic, and accurate." Verification asks whether the applicant is the person the evidence describes — "confirm that the applicant is the genuine owner of the presented evidence and attributes."

A synthetic identity passes validation, because the number is real. It can pass verification, because the face in the selfie matches the face on the licence the ring made. It fails resolution, because the identity is not unique in the population — it shares a phone, a device, an address or a funding account with the other identities the same people built. That is why the first of the solution's six agents is the one that links applications, and why the eight checks worth running, and what each one needs, are ordered resolution first.

Resolution, drawn: every application since February, and every shared element

The cultivation period: how long a synthetic identity takes to build

Longer than most lenders assume, and that is a design choice by the fraudster rather than an accident. The Federal Reserve found that synthetic identities "can be nurtured for months – and sometimes, years – to achieve higher credit limits," with accounts cultivated "by making small purchases and paying them off to build good repayment histories." The patience is rational: a traditional identity thief has days before the victim calls, while a synthetic identity has as long as it wants, because there is nobody to call.

That patience produces a particular shape in the data. An account in its cultivation phase is a model customer — low utilisation, on-time payments, gradual limit growth — so portfolio monitoring reads it as a good account and marketing sometimes reads it as a candidate for a pre-approved offer. The Federal Reserve raised exactly that risk: "a synthetic with a high credit score could be targeted by an institution's marketing campaign and receive a pre-approval offer for a new account."

What a bust-out is, and why it is not a default

A bust-out is the end of the plan. The Federal Reserve defines it as the moment when, "as a synthetic identity's credit score rises, the fraudster can secure larger extensions of credit until ultimately, the fraudster 'busts out.' This term refers to maxing out the credit line and vanishing."

The refinement that doubles the payout is a payment that will not clear. Because a card's available credit is restored when a payment posts rather than when it settles, a fraudster can max a line, pay it with a bad cheque or an invalid account, draw the restored limit again, and disappear with twice the money before the payment is rejected. The Federal Reserve draws this as a loop and names the other tactics beside it: claiming identity theft to have charges reversed, initiating chargebacks, and disputing the resulting bad record with the bureaus.

None of that is a default. A default is a customer whose circumstances changed; a bust-out is a plan completing on schedule. The distinction has a practical edge, because the solution's settings include holding a payment that frees credit until it clears, and pausing limit increases on booked accounts while a ring is open — two controls that only make sense once a lender has decided this is fraud rather than credit risk.

Why traditional fraud models miss synthetic identities

Because a model trained on identity theft is trained on the wrong signal. The Federal Reserve puts the problem in one sentence: synthetic identities "can behave like legitimate accounts and may not be flagged as suspicious using conventional fraud detection models." The features that catch a stolen identity — a sudden change of address, a mismatch against the real person's file, an unusual first transaction, a device the real customer has never used — all assume a real customer whose normal behaviour is on record. There is no such baseline here.

The signals that do work are relational rather than individual. The Federal Reserve's 2020 paper recommends "robust link analysis processes – processes that look across various banking instruments (such as checking accounts, lending accounts and other financial instruments) to identify relationships or common characteristics of synthetic identities," and its 2019 detection paper gives the most useful single example: these checks "help identify indicators of possible fraud networks – for example, individuals without a common city or surname who appear as authorized users on multiple accounts."

It also warns, in the same paragraph, about the cost of getting this wrong, and the warning is worth quoting whenever a vendor claims a detection rate. "Focusing solely on one particular characteristic could lead to false positives," it says. "Looking only at the length of a credit history could unnecessarily disadvantage or deny credit to certain types of legitimate customers – such as immigrants and formerly impoverished or incarcerated people who only recently gained access to credit." A thin file is not evidence of fraud. It is evidence of a thin file, and tens of millions of real people have one.

Who is the victim of synthetic identity fraud, when the applicant does not exist?

Three parties lose, and only one of them finds out quickly. The lender bears the money: the Federal Reserve records that "financial institutions bear the majority of the cost of this type of fraud," and that the loss surfaces as a charge-off with no one to collect from. The person whose Social Security number was used bears the mess: they are generally not liable for the debt, "as long as they can prove they are not behind the synthetic identities" — a burden that falls on a child who will not apply for credit for another decade, and who will then be the second person to use their own number.

The third loser is the genuine applicant who happens to share one element with a ring. In the sample ring, Simone Achebe is linked only because three of the ring's applicants claim to work at the same employer she really works for; she gave the company's main line and they gave a made-up one. A control that holds her is a control that has traded a fraud loss for a lost customer, which is why the solution's design is to clear her on the strength of the signals that are hers — and why there is a step-up band, between passing and holding, where an applicant is asked for a photo identification and a selfie instead of being stopped.

The same ring with every link switched off, which is what one-at-a-time looks like

Where the fraud is actually visible, and what that changes

Everything above adds up to one structural fact: in synthetic identity fraud the evidence does not live in the application. It lives in the relationship between applications, so a lender that reviews applications one at a time has no procedure capable of finding it, however good the review is. The Federal Reserve's 2020 paper notes the corollary inside a single institution — synthetic identity fraudsters "generally open multiple accounts at the same organization," and "if the identity busts out on one account, it's likely to bust out on other accounts around the same time."

That is the whole design of Synthetic Identity Fraud Detection. An application linker scores each arriving application against every earlier one, weighting each shared element and grouping linked applications into a ring; an identity verifier runs the consent-based government Social Security number check and reads the file's first-seen age; a credit profile analyst reads tradelines for borrowed cards and for payments that free credit before they clear; a device and contact checker reads the handset, the line type and the address type; a document checker compares identification images; and a case writer drafts the recommendation for every application and account. No agent declines anything. The analyst holds or clears, and a second person co-signs every decline and closure.

What a reader should take away is narrower than "use link analysis". It is that the question changes. Instead of asking whether this applicant is real, which a synthetic identity is built to answer, the useful question is how many other applications this one resembles, and whether any of the elements they share is the kind that never repeats by accident. A rented mailbox, a recycled voice-over-internet number and a borrowed card on seven files are not coincidences. A surname is. The solution's link weights set a protected characteristic and a surname at zero for exactly that reason.

The regulation that most lenders already answer to asks for a version of this comparison, and eight of the Red Flags Rule's own examples need more than one application. If you would rather start from real cases than from rules, six federal prosecutions show how the rings were actually built. To see the link graph, the ring and the signed decision on your own applications, start from Synthetic Identity Fraud Detection.

Questions people ask

Is synthetic identity fraud illegal, if nobody's identity was stolen?

Yes. Federal prosecutors charge it as bank fraud, wire fraud, mail fraud and access device fraud, and where a real Social Security number was used, as aggravated identity theft. In the Eastern District of North Carolina a ring leader was sentenced to 100 months and $412,885 of restitution; in the Central District of California a defendant received 94 months and $1,908,481. The absence of a complaining victim affects detection, not legality.

What is the difference between synthetic identity fraud and identity theft?

Identity theft uses a real person's identity as it stands, so the real person is harmed directly and usually reports it within weeks. Synthetic identity fraud builds a new identity around one real element, usually a Social Security number belonging to someone who does not check their credit, so no one reports anything and the account can be cultivated for months or years before the loss appears.

Can the government Social Security number check stop it on its own?

No, and it is not meant to. The Social Security Administration's electronic consent-based service returns only whether a submitted name, date of birth and number match its records, with the number holder's consent. That catches a fabricated or unissued number; it does not catch a real child's number used by an adult, where the name and date of birth are the invented parts. NIST is explicit that knowledge of a number is not evidence of identity.

How do you tell a synthetic identity from a genuine thin-file applicant?

Not from the thinness of the file, which is the mistake the Federal Reserve warns about by name — immigrants and people who have only recently gained access to credit look identical on that measure. The separation comes from relationships: whether the applicant shares a device, a phone, a funding account or a borrowed card with other applicants, and whether the elements that are theirs alone hold up. In the sample data, a genuine applicant linked only by her employer's name is cleared on that basis.

Does synthetic identity fraud only affect large card issuers?

No. The Federal Reserve's 2020 paper notes that the smaller-institution figures it collected matter precisely because "many small to mid-size financial institutions do not believe they are potential targets of this fraud threat," and points out that smaller lenders generate less data of their own to detect patterns in. Federal cases include schemes aimed at store-card programmes and at credit unions.

Where should a lender look first?

At the applications it has already decided. Replaying a closed book in date order — scoring each application only against the ones that preceded it — shows how many of last year's charge-offs were linked to one another, and that is both the cheapest test and the most convincing one. The method is set out in the guide on testing detection on your own closed files.