Why does proof of possession reduce synthetic identity fraud?

Proof of possession reduces fraud because it asks whether the applicant controls a trusted device or phone number at verification time, not just whether they know personal data. Fraudsters can often buy or steal data, but they cannot as easily maintain a credible, stable possession signal tied to the same identity.

How possession changes the fraud test

proof of possession works because it changes the verification from “can this person answer knowledge questions?” to “can this applicant demonstrate current control of the thing that should stay with the real holder?” That matters in synthetic identity fraud, where the attacker often combines real and fabricated attributes to look consistent on paper. Possession adds a live, harder-to-lift signal at the point of verification.

In practice, that signal is strongest when it is tied to an established trust anchor, such as a device, a phone number, or a session-bound authenticator, rather than a reusable static secret. Standards such as RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP) show the same security idea at the protocol level, sender-constraining a credential so theft alone is not enough.

The practical distinction is that synthetic fraud can scale with purchased data, but possession requires continuity. A fraudster may borrow or assemble identity attributes once, yet still struggle to keep control of the same number, device, or authenticator long enough to pass a challenge that is checked in real time.

Why synthetic identities break on possession signals

Synthetic identity fraud usually succeeds by blending fragments, real personal data, fabricated history, and a plausible account opening story. Proof of possession disrupts that strategy because the attacker must present more than stitched-together records. They must also show they are the same party currently in control of a physical or digital possession that is difficult to counterfeit at scale.

That is why possession checks often become more useful as the fraud journey progresses. A fabricated identity may survive document checks or profile screening, but it becomes weaker when the system asks for a live response from a bound phone, device, or app. The attacker then has to solve not just “what do they know?” but “what can they still control right now?”

This also explains why possession-based controls work best when paired with lifecycle-aware identity verification. Identity Proofing and KYC Guide and Identity Fraud Prevention Guide both reflect the same operating reality, the verification signal must stay hard to replay across onboarding, account access, and later recovery steps.

What makes the signal harder to fake than data alone

Possession is useful because it usually has friction that synthetic data does not. A phone number may be portable, but not instantly and not without operational effort. A device may be cloned in part, but not always convincingly enough to satisfy a stronger challenge. A trusted authenticator may be enrolled, but its proof remains time-sensitive and environment-sensitive, which raises attacker cost.

The most important mechanism is that the fraudster cannot separate the signal from the current holder as easily as they can separate personal data from the real person. Data can be stolen, sold, enriched, and recombined. A current possession signal, especially one that is tied to device state or active control, is much more resistant to offline preparation.

That is why organizations often combine possession checks with other controls that look for consistency over time, not just a single yes or no result. A stable, credible possession pattern is much harder to manufacture across repeated verification moments than a one-time identity claim.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-02 — Secret Leakage	Synthetic fraud often exploits stolen or reused secrets and access signals.
Recommendation — Limit reusable secrets that can be replayed during verification or recovery.
NIST SP 800-63	Proofing and authentication guidance	The question centers on proofing strength and possession-based verification.
Recommendation — Use phishing-resistant proofing and authenticators that bind control to the claimant.
OWASP API Security Top 10	API2 — Broken Authentication	Possession-based verification reduces replay and token abuse paths in verification flows.
Recommendation — Bind verification credentials so stolen values alone cannot authenticate.
CIS Controls v8	5 — Account Management	Fraud-resistant verification depends on controlling account and recovery binding points.
Recommendation — Review and harden account binding and recovery steps that accept possession signals.

Practitioner Guidance

What to verify: Treat possession as a fraud-resistance test, not as proof of identity by itself. It is strongest when you can confirm both current control and continuity, for example that the same channel or device remains bound through the part of the journey where fraud loss would be highest.

Common mistake: Do not rely on possession signals that are easy to recycle, forward, or broker. If a signal can be cheaply transferred between actors, it may still reduce casual abuse, but it will not reliably separate synthetic applicants from legitimate ones.

What good looks like: The control should make fraudsters spend more time, more infrastructure, or more operational risk to keep the same identity believable. When the possession check is effective, failed verifications should cluster around inconsistent devices, unstable contact points, or repeated attempts to rebind the same profile.

Practitioner takeaway: Proof of possession is valuable because it shifts the burden from static identity data to live control of a binding signal, and that is exactly the kind of condition synthetic identity fraud is least able to sustain.