Synthetic identities expose the gap in modern identity controls

At a glance

What this is: This is a discussion of synthetic identity fraud, showing how fabricated identities can clear onboarding and later cause large losses when they bust out.

Why it matters: It matters because IAM, fraud, and identity verification teams need controls that evaluate behaviour and lifecycle risk, not just document authenticity at signup.

Context

Synthetic identity fraud is the construction of a new persona from a mix of real and fabricated data, usually to survive initial checks and then exploit trust later. In identity governance terms, the weakness is not only verification at onboarding but the absence of ongoing scrutiny across the account lifecycle.

SumSub’s discussion treats this as a cross-sector fraud problem rather than a narrow payments issue. The same pattern now affects fintech, payroll, government programmes, and other environments where identities can be aged, nurtured, and weaponised before loss appears.

The practical governance problem is that a synthetic identity can look legitimate long after the original checks are complete. That makes behavioural evidence, device intelligence, and cross-industry signals more important than static document review alone.

Key questions

Q: How should organisations detect synthetic identities after onboarding?

A: They should treat onboarding as the start of verification, not the end. The strongest signals come from later behaviour, including dormancy followed by sudden activity, device reuse, repeated attribute patterns, and mismatches between identity age and value extracted. Continuous monitoring matters because synthetic identities are designed to look legitimate long after initial approval.

Q: Why do synthetic identities create more risk than simple fake accounts?

A: Synthetic identities can survive early checks, build a believable history, and then exploit the business once trust has been established. They are dangerous because they behave like credible users long enough to pass traditional controls. Teams should focus on how much trust the identity can accumulate before stronger verification is required.

Q: What are the signs that a synthetic identity programme is failing?

A: Warning signs include approved accounts with little provenance, slow-building activity followed by sudden value extraction, repeated device patterns across supposedly separate identities, and fraud discovered only after the account has already passed its trust-building phase.

Q: Should fraud teams treat synthetic identities as an IAM problem or a fraud problem?

A: Both. Fraud teams need behavioural detection and loss prevention, while IAM teams need stronger identity assurance across the full lifecycle. If the two functions do not share signals, synthetic identities can pass one control layer and defeat the other.

Technical breakdown

How synthetic identities pass onboarding

Synthetic identities combine authentic data points, such as a real address or partial personal record, with fabricated attributes that complete the profile. Because many onboarding controls validate consistency rather than provenance, the identity can satisfy checks without belonging to a real, established person. Over time, the account can accumulate trust through normal-looking activity, which lowers suspicion and opens a larger fraud window. This is why synthetic identity schemes often look clean at the point of entry but become visible only after behavioural drift or transaction abuse. The control failure is not one bad check, but a set of checks that assume the applicant is either real or fake, when the actual threat is hybrid.

Practical implication: verify identity provenance and watch for composite profiles that look internally consistent but lack real-world cohesion.

Why bust-out fraud is delayed and hard to spot

Bust-out is the stage where a long-nurtured synthetic identity suddenly extracts maximum value and disappears. The delay matters because many programmes interpret account age, stable usage, and prior approval as evidence of safety. In reality, those signals can reflect successful grooming rather than trustworthiness. This is especially dangerous when fraud rings coordinate many sleeper accounts so that each one looks low-risk in isolation. The mechanism is temporal: a benign-seeming account can become a high-loss event only after enough credit, access, or operational trust has been extended. Teams that rely only on point-in-time onboarding scores miss the lifecycle pattern that makes bust-out effective.

Practical implication: score account behaviour over time and flag dormant or slowly maturing identities that later increase activity or exposure.

Behavioural and device intelligence as fraud signals

Behavioural and device intelligence adds context that static identity proofs cannot provide. Behavioural patterns include typing cadence, login timing, navigation flow, transaction rhythm, and session consistency. Device intelligence looks for recurring device fingerprints, emulator traits, proxy use, or abnormal reuse across supposedly separate identities. For synthetic identities, these signals matter because the account may look valid on paper while the operating pattern reveals coordination, automation, or ring behaviour. This is not a replacement for identity proofing, but a second layer that catches identities that are technically admissible yet operationally suspicious. In practice, these signals are most useful when linked across applications and partners so that one account’s anomalies inform another’s risk.

Practical implication: fuse behavioural telemetry with device reputation to detect coordinated synthetic account networks before payout or credit extension.

Threat narrative

Attacker objective: The objective is to obtain trusted account status long enough to convert that trust into financial loss, benefits fraud, or operational abuse.

1. Entry occurs when a fraudster assembles a synthetic profile from real and fabricated data and uses it to pass onboarding controls.
2. Credential or account access is gained through successful enrolment, after which the identity can operate as a normal user and build trust.
3. Escalation happens as the account ages, accumulates privileges or credit, and joins coordinated sleeper activity with other synthetic identities.
4. Impact occurs when the identity busts out at scale, extracting funds, services, or benefits before detection and recovery can occur.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Synthetic identity fraud is a lifecycle problem, not an onboarding problem. Static verification can tell you whether fields match, but it cannot prove that the person behind the record has real-world legitimacy or future intent. That is why the strongest control failures appear after enrolment, when trust has already been extended. Practitioners should treat identity age, behavioural drift, and account progression as first-class risk signals.

Behavioural intelligence is the missing control layer in synthetic identity defence. When an account is engineered to look valid, the only durable discriminator is how it behaves over time and across sessions. Device reuse, repeated operating patterns, and coordinated timing expose networks that document checks cannot. The implication is that fraud teams need lifecycle telemetry, not just KYC-style gatekeeping.

Synthetic identity programmes expose a broader identity governance gap between proofing and assurance. Many organisations still assume that once an identity clears enrolment, the main risk is contained. Synthetic fraud breaks that assumption because the threat matures after trust has been assigned. The governance lesson is that identity assurance must remain active across the account lifecycle, not end at approval.

Fraud rings now use synthetic identities as infrastructure. These accounts are not isolated bad records, they are reusable assets that can be scaled across sectors, from fintech to payroll and government programmes. That changes the risk model from individual abuse to industrialised identity abuse. Practitioners should think in terms of networked fraud capacity, not single-account anomalies.

Cross-industry collaboration is becoming part of identity defence. Synthetic identities gain power when each organisation sees only one fragment of the pattern. Shared signals about device reuse, behavioural anomalies, and bust-out timing reduce the value of isolated trust decisions. The practical conclusion is that no single programme can see the full lifecycle without external corroboration.

What this signals

Synthetic identity risk is an assurance gap that starts at enrolment and widens over time. Programmes that rely on a single approval event are poorly suited to accounts that are intentionally built to mature into trust. The practical shift is toward continuous risk assessment across the identity lifecycle, especially where account value can be delayed or accumulated.

Behavioural and device telemetry now sit alongside proofing as a fraud control layer. When the identity record itself is engineered to look plausible, the operating pattern becomes the more reliable signal. Teams that can correlate session behaviour, device reuse, and account progression are better positioned to catch synthetic networks before loss.

Synthetic identities turn isolated trust decisions into network risk. One approved account may be less important than the pattern formed by many approved accounts behaving in coordinated ways. That means identity, fraud, and risk functions need shared visibility, or the programme will keep learning about synthetic abuse only after the bust-out phase.

For practitioners

• Strengthen identity provenance checks Go beyond field matching and verify whether the identity has durable real-world anchors, not just internally consistent data points.
• Add lifecycle monitoring after approval Track account age, activity shifts, dormancy, and sudden value acceleration so that trust does not remain static after onboarding.
• Fuse behavioural and device signals Correlate session rhythm, typing patterns, device reuse, and network anomalies to identify accounts that are technically valid but operationally suspicious.
• Share fraud signals across teams Feed suspicious device fingerprints and coordinated activity patterns into fraud, IAM, and risk workflows so one team’s anomaly becomes another team’s warning.

Key takeaways

• Synthetic identity fraud works because the account can appear legitimate long after onboarding, which makes static verification insufficient on its own.
• The real loss often arrives at bust-out, after the identity has accumulated enough trust, age, or exposure to cause meaningful damage.
• Detection improves when teams combine behavioural, device, and lifecycle signals instead of treating approval as the end of identity assurance.

Key terms

• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• Bust-Out Fraud: Bust-out fraud is the moment a trusted-looking account is used to take maximum value and then abandoned. The account may appear healthy for a long period, which is why lifecycle monitoring matters more than point-in-time approval. The loss often arrives late and at scale.
• Behavioral Intelligence: Behavioral intelligence is the use of session patterns to judge whether an action looks normal for a specific user. In banking, it compares cadence, navigation, pauses, and correction patterns against prior sessions to detect coercion, guidance, or automation that authentication alone cannot reveal.
• Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.