Risk-based authentication depends on historical and external data to judge whether a transaction looks normal. Synthetic identities poison that data by introducing fake but plausible identity signals, which can make suspicious activity appear legitimate. Once the data set is contaminated, probabilistic scoring loses accuracy, and fraud teams need stronger identity proofing to restore trust.
Why synthetic identities make risk-based authentication drift off course
Risk-based authentication is only as strong as the data patterns it learns from. Synthetic identities look credible enough to enter those patterns, so the system starts treating fabricated behaviour as normal and weakens its own signal quality. The result is not that authentication stops working, but that the risk score becomes easier to game and harder to trust.
When fraud operations or adversaries repeatedly introduce false but consistent identity attributes, the model can normalise them through identity lifecycle and governance discipline that is built for real entities, and the scoring logic loses contrast between legitimate and deceptive activity.
How contaminated identity data weakens probabilistic scoring
Risk-based authentication usually blends device, behavioural, historical, and external signals into a probability judgment. Synthetic identities distort that evidence base by creating records, transaction histories, and trust cues that appear internally consistent. Once those records feed the scoring engine, the system may interpret low-quality or fabricated signals as normal, which reduces the separation between low-risk and suspicious events.
This matters most where step-up decisions depend on prior enrolment quality, account age, contact-point stability, or cross-channel consistency. A synthetic profile can accumulate enough clean-looking activity to avoid scrutiny, especially when it is supported by weak proofing or permissive account recovery paths, so the model keeps rewarding patterns that should have been discounted.
Stronger identity proofing, phishing-resistant authentication, and more disciplined enrolment checks help restore signal quality by making it harder for fabricated identities to enter the data stream in the first place. The issue is not simply model tuning, it is the trustworthiness of the inputs.
Why the problem gets worse at scale and across fraud operations
Synthetic identity fraud is dangerous because it scales through repetition. Even if one fake profile is detected, many small variations can still poison aggregated analytics, especially in systems that rely on prior behaviour to calculate confidence. That creates a feedback loop: more fabricated records produce noisier risk decisions, and noisier risk decisions create more room for fraud to blend in.
In practice, organisations often discover the weakness when the same control that protects against account takeover performs poorly against low-and-slow fraud. NIST SP 800-63 Digital Identity Guidelines is useful here because it frames identity assurance as a layered problem, not a single score, and it reinforces why weak proofing or overreliance on behavioural confidence creates drift.
Teams also need to recognise that synthetic identity is an upstream data integrity problem as much as an authentication problem. Once contaminated records are accepted into analytics, manual review and exception handling become more expensive, because analysts are no longer seeing a clean separation between genuine customer behaviour and fabricated trust history.
Risk and Threat Considerations
Synthetic identities create a trust contamination problem: the control begins to learn from false legitimacy. That raises fraud exposure, weakens step-up decisions, and can let adversaries move from enrolment abuse into account opening, payment abuse, or credential-based fraud with less resistance.
Failure mechanism: fabricated identity signals are admitted into historical and external data sources, then reused by probabilistic scoring as if they were genuine behavioural evidence.
Impact: risk-based authentication becomes easier to evade, false positives and false negatives both rise, and fraud teams lose confidence in score-driven decisions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Risk-based auth depends on assurance and proofing quality for identity trust. |
| Recommendation — Apply identity assurance and phishing-resistant authentication to raise the quality of trust inputs. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Weak authentication and proofing let fabricated identities influence access decisions. |
| IA-5 — Authenticator Management | Credential and authenticator lifecycle affects whether synthetic identities can persist. | |
| Recommendation — Strengthen identification and authentication controls before trusting risk scores. Manage authenticators tightly so fabricated identities cannot sustain valid access. | ||
| OWASP ASVS | V6 — Authentication | Authentication assurance must withstand poisoned identity signals and weak enrolment. |
| Recommendation — Verify authentication flows resist weak proofing and deceptive account recovery paths. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Synthetic identities can persist when fabricated accounts are not discovered and removed. |
| NHI-02 — Secret Leakage | Fraudulent identities often become dangerous when associated secrets or tokens are exposed. | |
| Recommendation — Remove fraudulent identities quickly and revoke their access paths. Protect secrets so synthetic identities cannot authenticate or persist. | ||
Practitioner Guidance
What to prioritise: Treat identity proofing quality as a control input to risk-based authentication, not as a separate onboarding concern. If the enrolment path can be gamed, the scoring model will eventually inherit that weakness.
What to verify: Check whether step-up outcomes are being driven by account age, address stability, or contact data that can be cheaply fabricated. If those variables carry heavy weight, synthetic identities can bias the score long before obvious fraud patterns emerge.
Practitioner takeaway: The control fails when it confuses accumulated data with accumulated trust, so the most effective fix is to harden the identity evidence feeding the score, not to assume the score itself will self-correct.
Related resources from NHI Mgmt Group
- How should security teams adapt fraud and risk controls when IP-based signals become less reliable?
- Why do location-based signals improve fraud detection when device identifiers become less reliable?
- Why do synthetic identities and video-based impersonation attacks create different risk than traditional account fraud?
- Why do digital onboarding flows create less risk than manual KYC when identity fraud and synthetic identities are common?
