What is synthetic identity fraud? How it works and how to stop it
Synthetic identity fraud blends real and fake details into a person who doesn’t exist. Learn how it works, the red flags, and how to stop it.
Synthetic identity fraud is when a criminal combines fake and sometimes real personal information — for example, a real Social Security number (SSN) with an invented name and date of birth — to create a “person” who doesn’t exist — a synthetic identity — then uses that identity to open accounts and borrow money. Because no single real person is being impersonated, it often goes unnoticed until the money is gone.
In April 2021, the Federal Reserve published an industry-recommended definition: synthetic identity fraud is “the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain.” This guide explains how it works, who gets hurt, the warning signs, and how to detect and prevent it at account opening.
What is a synthetic identity?
A synthetic identity is a made-up person built from pieces of identity data. The Federal Reserve’s definition page lists the core identity elements as “name, date of birth, Social Security number and other government-issued identifiers.” A synthetic identity mixes those elements so they don’t all belong to one real person.
The Fed’s Synthetic Identity Fraud Mitigation Toolkit describes three ways criminals build one:
- Identity manipulation — taking real details and changing them slightly.
- Identity compilation — mixing real and fake details together.
- Identity fabrication — inventing the details outright. The toolkit says synthetic identities are “most commonly created using identity fabrication.”
Once it exists, the identity gets its own email address, phone number and mailing address, and starts to look like any other new customer.
Synthetic identity fraud vs. traditional identity theft
People also search for this as “synthetic identity theft.” It is the same crime under another name, but it works differently from traditional identity theft.
The Federal Reserve’s 2019 white paper Defining Synthetic Identity Payments Fraud draws the line this way:
- Traditional identity theft: the fraudster “pretends to be another real person and uses his or her credit.” The victim gets the bills, so the fraud is usually spotted and reported quickly.
- Synthetic identity fraud: the fraudster blends fake and sometimes real information into a new identity. No real person is billed directly, so it is much harder to detect.
Who the real victims are
Even though the “person” is fake, real people can still be harmed when their SSN is used. The same white paper says that if a valid SSN is used, “it is typically one that belongs to a child or an elderly or homeless person” — people who rarely use or check credit, so the misuse can go unnoticed for years. The Fed’s toolkit likewise says fraudsters often use SSNs of “the elderly, the incarcerated and (most commonly) children.”
A change at the Social Security Administration (SSA) also plays a role. On June 25, 2011, SSA began assigning SSNs randomly, removing the geographic meaning of the first three digits. The Fed’s 2019 white paper notes that as a result, “geographic checks are no longer effective for newly issued SSNs.”
For parents, the Federal Trade Commission (FTC) recommends a free credit freeze for children under 16 to make it harder for someone to open new accounts in a child’s name.
How synthetic identity fraud works
Most schemes follow three stages. They can take years, which is part of what makes them hard to catch.
- Creation. Real and fabricated details are combined into a new identity, as described above.
- Cultivation. The identity applies for credit, is often declined at first, and slowly builds a credit file. One shortcut is “piggybacking”: paying to be “added as an authorized user to an account with good credit,” as the Fed’s 2019 white paper puts it. The toolkit’s example case shows an identity that made on-time payments for three years while its credit line grew from $20,000 to $40,000.
- Bust-out. The white paper defines this as “maxing out the credit line and vanishing.” The fraudster can then build a new synthetic identity and repeat the process.
In a May 2026 Independent Community Bankers of America (ICBA) article, a community banker said many “bust-out schemes involve synthetic identity fraud or counterfeit credentials,” and that once one succeeds, “there’s not much the bank can do, because the person doesn’t exist.”
The losses can also hide in plain sight. In the toolkit’s example, the maxed-out account was “charged off as a credit loss and never reported as fraud.” The Fed’s 2019 white paper explains that some institutions record these losses as credit losses and others as fraud losses, so the true size of the problem is hard to measure.
Synthetic identity fraud statistics
Because losses are often miscategorized, treat any single number as an estimate. Here is what the Federal Reserve and other named sources report:
- The Fed’s mitigation toolkit cites an estimated $20 billion in losses for U.S. financial institutions in 2020.
- The Fed’s synthetic identity fraud page says it has been reported to be “the fastest-growing type of financial crime in the United States,” citing multiple sources including the FBI, Experian and GIACT.
- The Fed’s 2019 white paper cites ID Analytics estimates that 85% to 95% of applicants identified as synthetic identities were not flagged as high risk by traditional fraud models, and that nearly 40% of synthetic identities use a randomized SSN. These are older third-party estimates.
- Deloitte’s Center for Financial Services projected in May 2024 that generative AI could enable U.S. fraud losses to reach $40 billion by 2027, up from $12.3 billion in 2023. That figure covers AI-enabled fraud broadly, not synthetic identities alone — but AI makes fake photos, documents and video much cheaper to produce, which is exactly what a synthetic identity needs.
Warning signs of a synthetic identity
The Fed’s toolkit module on detecting a synthetic identity lists red flags in two groups.
Within one application or account:
- A large amount of unsecured debt.
- A high number of recent credit inquiries, which may mean someone is trying to build credit quickly.
- A mismatch between the applicant’s age and how long their credit history is.
- “Inflation of credit file depth.” In the toolkit’s example case, the credit profile consisted “primarily of authorized user tradelines.”
- A suspicious mailing address.
- Recently issued contact information, such as a brand-new phone number or email.
Across accounts:
- Similar or matching contact details (address, phone, email).
- Matching SSNs.
- An identical digital footprint.
The toolkit says “similar customer information across accounts is the biggest indicator,” and that no single red flag usually proves anything on its own. Look for combinations.
How to detect and prevent synthetic identity fraud
A synthetic identity is designed to pass checks that only look at data: the name, number and address may each “exist” somewhere. Preventing synthetic identity fraud means adding layers that are hard for a fake person to fake. The Fed’s toolkit module on validating identities lists tools including SSA’s eCBSV service, document verification, alternative data, and digital information and user activity.
1. Check the SSN against SSA records
SSA’s electronic Consent Based SSN Verification (eCBSV) service is a fee-based check that tells you whether a name, date of birth and SSN combination matches SSA records, with a “yes” or “no” answer, and flags death information where SSA has it. It was created under Section 215 of the Economic Growth, Regulatory Relief, and Consumer Protection Act. It is open to financial institutions as defined in the Gramm-Leach-Bliley Act and their service providers, and it requires the number holder’s written consent. Confirm eligibility with SSA directly.
2. Ask for a real person, not just real data
What a synthetic identity struggles to produce is a real, present human whose live face matches the portrait on a physical government ID. Identity verification with a document scan, a live selfie compared with the ID photo, and active liveness checks (random movement prompts) makes it much harder to use a printed photo, a screen or a recording. Our post on deepfake red flags at account opening covers the AI-generated side of this in more detail.
3. Look for reuse across customers
Fraudsters reuse pieces of identities. Since matching details across accounts is the toolkit’s strongest indicator, flag the same face, ID document, SSN, phone or address appearing under different names. The Fed’s module on technology notes that link analysis “may help identify synthetics that reuse identity elements.”
4. Cross-check the details you already have
Compare what is printed on an ID with the barcode on the back and with what the applicant typed in. Conflicts don’t prove fraud, but they deserve a human review. Screening against sanctions lists, such as those of the Office of Foreign Assets Control (OFAC), is a separate check — see anti-money laundering (AML) screening — but it works best on a name and date of birth you have already verified.
5. Keep watching after approval
Because cultivation can take years, review accounts again when behavior changes, such as rapid credit-line increases or a sudden jump in balances. Check with your compliance team or counsel on which checks your institution’s rules require.
Frequently asked questions
Is synthetic identity fraud the same as synthetic identity theft?
Yes. Both terms describe creating a fake identity from invented and sometimes real information. It differs from traditional identity theft, where a criminal pretends to be one specific real person.
Why are children’s Social Security numbers used?
Children rarely have credit files and usually nobody checks them, so misuse can go unnoticed for years. The Federal Reserve says children’s SSNs are the most common ones used.
Can a credit check catch a synthetic identity?
Not reliably. After cultivation, a synthetic identity can have a real credit file with on-time payments. Red flags like a thin or “inflated” file, many recent inquiries, or a credit history that doesn’t fit the applicant’s age are clues, not proof.
What is the best way to prevent synthetic identity fraud?
Use layers: verify the SSN where you are eligible, require a government ID plus a live selfie with liveness, and flag shared details across accounts. No single check stops every case.
If you want to try document, selfie and liveness checks on your own applicants, start a 7-day free trial — 20 verifications, no card required.
Related guides
Sources: Synthetic Identity Fraud: Defining It to Fight It (Federal Reserve FedPayments Improvement, April 2021); Synthetic Identity Fraud Defined (Federal Reserve FedPayments Improvement); Synthetic Identity Payments Fraud (Federal Reserve FedPayments Improvement); Synthetic Identity Fraud Mitigation Toolkit (Federal Reserve, modules accessed October 2026); Defining Synthetic Identity Payments Fraud (Federal Reserve white paper, July 2019); eCBSV (Social Security Administration); Social Security Number Randomization (Social Security Administration); How To Protect Your Child From Identity Theft (FTC, October 2024); Revealed: How fraud is evolving (ICBA, May 2026); Deepfake banking fraud risk on the rise (Deloitte, May 2024). This article is general information, not legal or compliance advice.
