Who signs a synthetic identity decline, and what each signature means

Who signs off on a fraud decline is not one question but four, and the four are assigned by different rules to different people. The hold is an operational act an analyst can take alone. The decline is a credit decision that must carry a specific, accurate reason to the applicant under Regulation B. The closure of a booked account is a second decision that most lenders put behind a second signature. And the decision to report the activity to the Treasury belongs to whoever the institution has made responsible for that, on a clock that starts at detection rather than at conclusion. Botminds' Synthetic Identity Fraud Detection is built around that split: six agents link, check and draft, and no agent decides anything — the fraud analyst holds or clears, a fraud investigator co-signs every decline and closure, and the report decision stays with the anti-money-laundering officer.

The reason to be precise about this is not tidiness. A ring decision that cannot say who decided what, and on what evidence, is a decision that will be re-made from scratch the first time anyone asks — by a second-line reviewer, by an examiner, or by a consumer whose application was held because they share an employer with a fraudster.

The worked ring and the screens are the solution's sample data, on a fictional issuer with fictional applicants. The rules are quoted from the regulations, linked where they appear.

Four signatures on one ring

A single ring of ten identities generates four distinct commitments, and conflating them is the most common design error in a fraud operation. The first is a hold: this application stops moving while somebody looks. The second is an adverse decision: this applicant is refused, and a reason goes to them in writing. The third is action on money already lent: an account is closed, a limit increase denied, a payment held until it clears. The fourth is a statement to the government that the institution suspects a crime.

Each has a different standard of proof and a different consequence of being wrong. A hold that is wrong costs a customer a day. A decline that is wrong costs a customer a credit opportunity and the lender a fair-lending question. A closure that is wrong costs a customer their account. A report that is wrong costs almost nothing, which is precisely why the decision has to be made by someone whose job is to weigh it rather than by whoever is clearing the queue.

The hold: an agent may stop an application, never decline it

The first signature is the cheapest, and it belongs to the machine. In the solution the application linker may place a hold when a cluster crosses the hold line — a setting, 700 by default on a scale that runs to 900 — and is explicitly forbidden from declining. That is a deliberate asymmetry: stopping an application for a few hours is reversible, and refusing credit is not.

It is also where the step-up band earns its place. Between passing and holding, the solution asks for a photograph of an identity document and a selfie rather than stopping the applicant, which is the Red Flags Rule's own "contacting the customer" and "authenticating customers" expressed as a product decision. A lender that only has pass and hold will hold people it should merely have asked a question.

NIST frames the same point as a requirement on whoever runs an identity check. A provider "SHALL establish procedures for redress to allow applicants to resolve issues associated with fraud checks and mitigation technologies," and should offer a trained human reviewer to applicants who fail an automated fraud check in an unattended process, "provided with a summary of the results of the fraud failures" (NIST SP 800-63A-4, §3.2.3). A hold with no route back is not a control; it is an outage.

The decline: who decides a fraud decline on one application

A person, and the reason they give is part of the signature. Regulation B requires a creditor to notify an applicant of action taken within 30 days of receiving a completed application, and where that action is adverse, the notice must contain a statement of specific reasons or an offer to supply them. The standard for those reasons is strict: the statement "must be specific and indicate the principal reason(s) for the adverse action," and "statements that the adverse action was based on the creditor's internal standards or policies or that the applicant, joint applicant, or similar party failed to achieve a qualifying score on the creditor's credit scoring system are insufficient" (12 CFR 1002.9(b)(2)).

Read that beside a linkage score and the problem is obvious. "You scored 904 on our ring model" is both unhelpful and, as a reason, inadequate under the rule. What the rule will accept is the factor actually relied on — that the name, date of birth and number submitted could not be verified against Social Security records, say — and that factor has to be true of this applicant, not of the cluster. This is the hardest part of running a link-based control well, and it has a guide of its own on what the notice may and may not say.

The practical consequence for the sign-off is that the analyst's recommendation has to be per application, not per ring. In the sample ring the recommendation is exactly that: five applications declined for $72,000, three limit increases denied for $16,000, four booked cards closed with $14,500 of open lines, one payment held until it clears — and one applicant, linked only by her employer's name, cleared to underwriting for $11,000.

The second signature on an account closure

Closing a booked account is a different act from refusing a new one, because the customer already has the money and the relationship. In the solution every decline and every account closure requires a second person's signature — the fraud investigator by default, with a fraud manager or any second analyst as alternatives — and the adverse action notices are released only after that signature.

Nothing in federal law prescribes a second signature on a fraud closure. What makes it worth building anyway is the asymmetry of the error: a wrongly closed account is the single most expensive mistake a fraud team can make with a genuine customer, and it is the one most likely to be made at speed, because a ring is discovered all at once and the natural instinct is to shut everything. A second reader is the cheapest available brake.

It also changes what the first signer does. An analyst who knows a second person will read the file writes the file for a reader, which is the difference between "linked to R-2291" and "the same borrowed card number appears on seven of these fourteen credit files, and here is the report page for each." The solution drafts the second version because the case writer has the evidence links; the analyst's job is to agree or disagree with it.

The second signature, and what it releases

The report decision, and how long you have to file

This is the signature most often misunderstood, and the misunderstanding is about when the clock starts. A bank must file a report "no later than 30 calendar days after the date of initial detection by the bank of facts that may constitute a basis for filing," with a further 30 days available only "if no suspect was identified on the date of the detection of the incident requiring the filing," and in no case more than 60 (31 CFR 1020.320(b)(3)). The clock runs from the facts being detected, not from the investigation being finished — so the day the cluster crossed the hold line is a candidate start date, and the day the analyst signed is not.

In a ring that distinction is sharp, because detection is a visible event: the sample ring's score moves from 540 to 904 on one night when a seventh application arrives on the same handset. The solution therefore records the detection date and counts the report clock from it, with the deadline on the case file; the sample case detected on a Sunday in October is due early the following month, with the days remaining shown. A 25-day internal target is available as a setting, which is what most compliance functions actually run.

Who signs is an institutional choice, but the reporting rule frames it: the obligation falls on the bank, and the institution designates who discharges it. In the solution the referral goes to the anti-money-laundering officer, who decides whether to file and files; the case writer drafts the four-part narrative and the numbered exhibits and is forbidden from filing. The reporting floor is worth remembering too — the rule attaches to transactions involving or aggregating at least $5,000 — and a ring of small-limit cards can sit under it individually and over it together.

Who owns the written programme

The fourth signature is the one nobody in the queue thinks about. A lender's identity theft prevention programme must be written, and "approval of the initial written Program" must come "from either its board of directors or an appropriate committee of the board of directors," with the board, a committee or a designated senior manager involved in its oversight, development, implementation and administration (16 CFR 681.1(e)).

That has a direct consequence for thresholds. If the hold line, the step-up band and the link weights are the mechanism by which the board-approved programme detects red flags, then moving the hold line from 700 to 600 is a change to the programme, not a tuning exercise. In the solution those values are settings whose changes are versioned and attributable, which is the same obligation expressed as software: a date, a person, and the previous value. The weekly pattern report is the other half — rules the agents suggest are tested against the last 90 days before the head of fraud strategy approves them, so what reaches the board is a proposal with evidence rather than an instinct.

Which red flags the programme is actually detecting, and which of them cannot be answered without comparing applications, is set out in the guide on the Red Flags Rule's 26 examples.

What the record has to show an examiner

Two separate records, with different retention. The reporting rule requires a bank to keep a copy of any report filed and "the original or business record equivalent of any supporting documentation for a period of five years from the date of filing," identified and maintained as such, and to make it available on request to the Treasury, to law enforcement and to its regulators. Regulation B's own record requirements sit alongside, and the reason given to the applicant is part of them.

What makes a ring file awkward is that the evidence is relational. "Held because of a link" is not a record; the element, the applications it was found on and the document it was read from are. In the sample case the file carries a four-part narrative with eight numbered exhibits that each open at their source, which is the shape worth copying whether or not the solution is in the picture.

Can you tell the applicant anything?

Yes, and you must — but not about the report. The reporting rule is absolute on that one point: "No bank, and no director, officer, employee, or agent of any bank, shall disclose a SAR or any information that would reveal the existence of a SAR." The rule then carves out what can be discussed, on a condition: provided "that no person involved in any reported suspicious transaction is notified that the transaction has been reported," the prohibition does not stop a bank disclosing "the underlying facts, transactions, and documents upon which a SAR is based."

That is the line that makes both rules satisfiable. The facts are discussable; the report is not. A notice may say that the information supplied could not be verified, because that is a fact about the application. It may not say, or imply, that anything was reported to the government. In the sample case the notice "says only what could not be verified, nothing about the ring" — and the solution's case writer is forbidden from sending any notice itself, precisely so a person reads it against both rules before it leaves.

There is a wider version of the same question, about telling other institutions. The Federal Reserve notes that section 314(b) of the USA PATRIOT Act lets participating institutions share customer information with one another in support of their own compliance and reporting work, and that it "also allows for sharing information that relates to specified unlawful activities – which could be inclusive of fraud" — while recording that "some financial institutions are uncertain which information would qualify for 314(b) safe harbor," which limits how much is shared in practice (Federal Reserve, July 2020).

Where the people's week goes instead

The four signatures are the part of the work that should not move. Almost everything around them can. On the solution's own estimate for one ring of about ten identities, the hours fall from roughly 24 to roughly 3.5, and the saving is entirely in the assembly: spotting that applications are linked, pulling number checks and credit files for ten names, tracing devices and addresses, comparing identification images, and drafting the case file and the notices. The decision and the second signature are the one line that does not fall, because they were never the slow part.

One number is worth holding up against the four signatures, because it is the scale the whole arrangement exists for: FinCEN found roughly 1.6 million bank reports in 2021 — 42% of all of them — related to identity, covering $212 billion of suspicious activity (FinCEN, January 2024). Reports at that volume are only possible if the drafting is mechanical and the deciding is not.

If the vocabulary is still unfamiliar, start with what a synthetic identity is and how it is built; if the question is whether the write-off should have been a fraud loss in the first place, the classification guide covers it. To see the signatures, the clock and the case file on your own applications, start from Synthetic Identity Fraud Detection.

Questions people ask

Can a model decline a credit application on its own?

Regulation B does not forbid an automated decision, but it does require the applicant to receive the specific principal reasons for it, and it rules out reasons like internal standards or a failing score. In practice that is what keeps a person in the loop on a link-based control: the model produces a cluster, and someone has to state why this applicant was refused. In the solution no agent may decline at all — the linker holds, and a person decides.

When does the 30-day reporting clock start?

At initial detection by the bank of facts that may constitute a basis for filing — not when the investigation concludes. A further 30 days is available only if no suspect had been identified on the detection date, and the total may never exceed 60 calendar days. Recording the detection event, with its date and what triggered it, is therefore part of the case file rather than an afterthought.

Does a second signature on a closure come from a regulation?

No. No federal rule requires two signatures on a fraud closure; it is a control institutions choose because a wrongly closed account is the most costly error available with a genuine customer, and rings are discovered all at once. In the solution it is a setting, with a fraud investigator, a fraud manager or any second analyst as the options.

Can you tell an applicant that a report was filed?

No. The reporting rule prohibits disclosing a report or any information that would reveal its existence. It does permit discussing the underlying facts, transactions and documents, provided no person involved is notified that the activity was reported — so a notice may say what could not be verified about the application, and may not say or imply anything about a filing.

Who should own the hold threshold?

Whoever owns the written identity theft prevention programme, because the threshold is how the programme detects. The rule puts approval of the initial written programme with the board or a board committee and expects continuing oversight from the board, a committee or a designated senior manager, so threshold and weight changes belong on a dated, attributable record rather than in a configuration file nobody reads.

What happens to a genuine applicant caught in a ring?

They should be cleared on the strength of what is theirs alone, and the clearance should be recorded as carefully as a decline. In the sample data an applicant linked only because three ring members claimed to work at her real employer is cleared to underwriting: her number check matches, her credit file goes back to 1998, and her licence and selfie pass. She is also left out of the case file, because she did nothing.