Application fraud now blends synthetic identity, bots and GenAI

At a glance

What this is: This is an analysis of modern application fraud in banking, showing how synthetic identity, bots and GenAI now defeat static onboarding checks.

Why it matters: It matters because fraud and AML teams need controls that judge intent and behaviour at account opening, not just document validity, or they will keep admitting high-risk accounts as legitimate customers.

By the numbers:

• Identity theft-related crimes, including application fraud, have resulted in $10.2 billion in losses.

Context

Application fraud is the use of stolen, manipulated or fabricated information to open a new account, and it has become a front-door governance problem for banks rather than a narrow verification problem. The challenge is not just stopping obvious fraud, but doing so without turning onboarding into an unacceptable customer-friction exercise.

The article shows that modern onboarding control fails when institutions treat identity as a static document instead of an evolving trust signal. That shift matters because application fraud now sits at the intersection of identity verification, AML controls and non-human automation, including bot activity and synthetic identities.

Key questions

Q: What breaks when banks rely on static PII for identity verification?

A: Static PII breaks when the same personal data can be stolen, bought, or assembled from breaches and used to pass checks that were designed to prove uniqueness. It also fails when fraud models score risk using the same compromised attributes. Banks need layered verification that includes behavioural signals, device intelligence, and document authenticity.

Q: Why do digital onboarding flows create less risk than manual KYC when identity fraud and synthetic identities are common?

A: Digital onboarding reduces risk because it can verify identity continuously and at scale, while manual KYC depends on office visits, human review, and slower decision cycles. Automated checks can compare document data, biometric signals, and database records in one flow, which makes impersonation harder. The trade-off is that controls must be tuned carefully to avoid blocking legitimate users.

Q: What signs show a fraud operation is becoming industrialised?

A: Look for reusable domains, phishing kits, scripted support flows, repeated wallet patterns, and laundering through the same service providers or DeFi paths. Those signals show the scam has become a modular service chain rather than a one-off attack. At that point, individual takedowns matter less than disrupting the infrastructure that keeps the campaign running.

Q: How should teams balance fraud prevention with low-friction customer onboarding?

A: Use risk-based orchestration. Low-risk users should move through the shortest safe path, while higher-risk cases trigger stronger checks such as liveness, document validation, or manual review. The goal is not maximum friction, but proportional assurance. Teams should measure abandonment, false matches, and fraud capture together so they can tune policy without degrading the customer journey.

Technical breakdown

How synthetic identity fraud defeats static onboarding checks

Synthetic identity fraud blends real stolen data with fabricated details to create a persona that can survive ordinary onboarding checks. The key technical weakness is that point-in-time identity verification assumes the applicant is either real or fake at a single moment, while synthetic identities are designed to mature over time. Fraudsters can seed an account, build history, and then exploit the trust that the institution has allowed to accumulate. The control failure is not just weak screening, but a model of identity that does not account for temporal behaviour, device reuse, or relationship patterns across applications. See the NHI Lifecycle Management Guide.

Practical implication: Treat application review as a lifecycle problem, not a one-time verification event.

Why behavioural biometrics and device intelligence matter at the front door

Behavioural biometrics looks at how a person interacts with the application, including typing cadence, cursor movement and navigation rhythm. Device and network intelligence adds context such as emulators, virtual machines, residential proxies and repeated use of the same terminal across multiple identities. Together, these signals help distinguish a real customer from a fraud operation that has the right data but the wrong behavioural signature. This is especially important because GenAI can make documents and lures look convincing, but it cannot easily hide the operational footprint left by automation at scale. See the Identity Fraud Prevention Guide.

Practical implication: Use behavioural and device signals together so fraud detection does not depend on documents alone.

How explainable AI supports fraud decisions without hiding the rationale

Explainable AI is essential when onboarding decisions must be defensible to fraud analysts, compliance teams and customer operations. A risk score without reasoning can reduce trust in the control itself, especially when the business is trying to balance speed with false-positive reduction. In this context, explainability means surfacing the specific signals that drove the decision, such as device linkage, unusual typing cadence or shared identity attributes across applications. That allows analysts to tune thresholds, defend decisions and separate true fraud patterns from legitimate customer variation.

Practical implication: Demand decision rationale that analysts can inspect, tune and audit.

Threat narrative

Attacker objective: The attacker wants a trusted bank account that can be monetised for credit, laundering or downstream fraud.

1. Entry begins with stolen or fabricated identity data, often assembled from breaches, phishing or social media scraping.
2. Credential and identity abuse follows when the fraudster uses that data, plus proxies, spoofed devices or deepfake liveness checks, to pass onboarding controls.
3. Escalation occurs after the account is opened and seasoned with low-risk behaviour that builds trust and evades new-account monitoring.
4. Impact comes when the account is used for credit abuse, mule activity or rapid cash-out, often across borders and payment rails.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Application fraud is now an identity-governance problem, not just a fraud-engine problem. Banks are no longer deciding whether a name, document or selfie is real in isolation. They are deciding whether the applicant’s behaviour, device and identity trail make sense across time, channels and counterparties. That means the control model has to move from static verification to governed identity evidence, with fraud, AML and onboarding all participating in the same decision.

Static onboarding checks create a verification trust gap. The article makes clear that GenAI and deepfakes reduce the cost of generating convincing identity artefacts, while bot infrastructure scales the attempt volume. The result is a gap between what looks legitimate at the point of entry and what behaves legitimately after account opening. Institutions that keep relying on document-centric controls will continue to overestimate the value of first-touch assurance.

Seasoned fraud is the named concept here: a fraudulent account that is deliberately aged and normalised before monetisation. That pattern matters because it defeats controls that only watch for immediate anomalies after account creation. Once a risk team understands that fraud can be patient, it can stop treating “no early alert” as evidence of safety.

NHI governance matters here because automation is part of the threat model. Botnets, scripted submissions and synthetic behavioural traces are non-human activity patterns that overwhelm manual review and distort risk scoring. Top 10 NHI issues is relevant here because the same governance instinct applies: know what automated actors are present, how they behave and where they are allowed to influence trust decisions. Practitioners should govern the machine side of onboarding as tightly as the human side.

The most important control change is not better friction, but better intent detection. The article shows that customer experience pressure can push banks toward thinner checks, which criminals exploit. The governance answer is to preserve low-friction onboarding for low-risk applicants while reserving deeper scrutiny for cases where behavioural, device and network signals fail to align. Practitioners should treat risk-based orchestration as a core control, not an optimisation layer.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.
• Read next: NHI Lifecycle Management Guide

What this signals

Front-door fraud is now a trust-engine problem. The programme challenge is not simply stopping more applications, but separating genuine customer intent from manufactured identity behaviour before an account becomes a liability. Banks that still optimise only for conversion will keep creating the very footholds that fraudsters need.

Identity evidence has to become continuous. The practical shift is from checking whether a customer looks real at submission time to checking whether their data, device and behaviour remain coherent as the relationship begins. That change will increasingly shape onboarding design, AML escalation and the quality of downstream fraud decisions.

Non-human activity now belongs in onboarding governance. When bots, scripted submissions and synthetic profiles are part of the attack surface, teams need controls that watch for machine-scale patterns as well as human deception. Practitioners should expect the boundary between fraud detection and identity governance to keep narrowing.

For practitioners

• Strengthen onboarding decision orchestration Route applicants through risk-based flows that combine identity data, behavioural signals and device reputation before account creation is approved.
• Correlate behavioural and device signals Look for copy-paste speed, navigation anomalies, emulators, virtual machines and repeated device fingerprints across separate applications.
• Add explicit synthetic identity review rules Flag combinations of partial real data, inconsistent address history and repeated relationship links that indicate a manufactured persona.
• Use explainable AI in analyst workflows Expose the specific reasons behind each alert so analysts can tune thresholds, defend decisions and distinguish fraud from legitimate variation.

Key takeaways

• Application fraud now begins with manufactured identity evidence, not just stolen personal data, which makes traditional static checks insufficient.
• The article links the threat to $10.2 billion in identity theft-related losses, showing that the problem is already large enough to drive material bank losses.
• Banks need behavioural, device and explainable AI controls to decide whether an applicant is coherent over time, not merely plausible at the point of entry.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Identity Fraud Prevention Guide · Synthetic Identity Fraud Guide · Top 10 NHI Issues

Key terms

• Application Fraud Signals: Application fraud signals are the indicators used to detect suspicious account creation attempts, such as inconsistent personal data, repeated failed verification, or abnormal application patterns. They help banks and fraud teams decide when to escalate review, reject the application, or request stronger proof of identity.
• Synthetic Identity Fraud: Synthetic identity fraud is the creation of a fake identity from a mix of real and fabricated personal data. Fraudsters use it to open accounts, build credit, and evade standard checks. Defenders look for thin-file identities, inconsistent identity attributes, repeated reuse of contact details, and unusual account-age patterns across applications.
• Behavioral Biometrics: Behavioral biometrics uses patterns such as typing rhythm, swipe style, device handling, and session timing to infer whether the same user is still present. In practice, it supports continuous verification, but it also demands careful tuning because legitimate behavior can change with context.
• Explainable AI: Explainable AI is the practice of making an AI system’s decisions understandable to the people who have to review, validate, or rely on them. In financial services, that means producing explanations that can support compliance, model validation, customer communications, and audit, not just technical curiosity.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps identity and security practitioners connect governance models to the broader controls their programmes depend on.