What is synthetic identity fraud — and why a live face check matters
Synthetic identities are built from real and invented data to create a person who doesn’t exist. Here’s how they work and where they break down.
In 2021 the Federal Reserve published an industry-recommended definition of synthetic identity fraud: “the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a deceitful act for private monetary benefit.”
Unlike classic identity theft, there is often no single victim who notices. The “person” is assembled — a real Social Security number paired with a different name, an invented date of birth, a new email and phone number — and then used patiently.
How a synthetic identity is used
- Creation. Real and fabricated details are combined into a new identity.
- Cultivation. The identity applies for small amounts of credit, is often declined at first, and gradually builds a credit file and history.
- Bust-out. Once limits are high enough, balances are maxed out and the identity disappears. Because the person never existed, there is little recourse.
The Independent Community Bankers of America has described how bust-out schemes often rely on synthetic identities or counterfeit credentials, leaving the institution with the loss.
Why generative AI makes it worse
Generative AI lowers the cost of the hardest part: making the identity look real. Convincing ID templates, profile photos and even video can now be produced in minutes. Deloitte’s Center for Financial Services projects that generative AI could enable fraud losses to reach US$40 billion in the United States by 2027.
Where synthetic identities break down
A synthetic identity can pass checks that only look at data: the name, number and address may all “exist” somewhere. What it struggles to produce is a real, present human being whose live face matches the portrait on a physical government ID — repeatedly, without reusing the same face under other names.
- Document plus live selfie. The applicant photographs both sides of an ID on their own phone and takes a selfie that is compared with the ID portrait.
- Active liveness. Random movement prompts make it hard to substitute a photo, a screen or a recording.
- Duplicate detection. The same face or document appearing under different names is flagged across all verifications.
- Consistency checks. Conflicts between the printed ID, its barcode and the application are surfaced for review.
Data checks still matter — but pairing them with evidence of a real person is what closes the gap synthetic identities rely on.
Sources: Federal Reserve, Synthetic identity fraud definition (April 2021); ICBA, Revealed: How fraud is evolving; Deloitte, Deepfake banking fraud risk on the rise (2024).
