Synthetic identity fraud exposes the limits of onboarding checks

At a glance

What this is: This is an iProov analysis of synthetic identity fraud and why onboarding controls fail when the identity being checked never existed in the first place.

Why it matters: It matters because fraud teams, IAM leads, and identity proofing owners need controls that verify a live person at enrolment, not just match data fragments that can be stolen or fabricated.

By the numbers:

• Synthetic identity fraud costs businesses an estimated $20-40 billion globally per year, according to iProov.
• U.S. lenders faced $3.3 billion in exposure from synthetic identities tied to new accounts through 2024, according to iProov.
• 44% of organizations now rank synthetic identity fraud as their top-tracked fraud type, according to iProov.

Context

Synthetic identity fraud is the creation of a fabricated person from real, stolen, and invented data, then using that identity to open accounts or access services. The core governance problem is not just fraud volume but identity proofing failure: organisations optimise onboarding for speed while assuming the applicant is a real, monitorable person.

That assumption breaks when there is no victim to alert the institution, no genuine credit history to cross-check, and no downstream recovery path that can unwind the loss. For IAM and identity-proofing teams, the control question shifts from data matching to proving that a live human is actually present at enrolment.

Key questions

Q: What fails when synthetic identity fraud gets past onboarding?

A: The core failure is that the system has already accepted a fabricated person as real, so every downstream control starts from a false identity. Behavioural monitoring, credit checks, and complaint-based detection become weak because there is no real victim to surface the fraud. The right response is to strengthen proofing before account creation, especially where access or financial value can be built over time.

Q: Why do synthetic identities and identity theft create such high risk in new account origination?

A: They defeat traditional checks because the profile can look consistent across multiple data sources while still being fabricated. That makes early-stage verification critical, especially before account creation, credit approval, or transaction access. Strong programmes look for cross-channel inconsistency, device anomalies, and weak evidence of real-world identity rather than relying on a single signal.

Q: What are the signs that onboarding verification is too weak for synthetic identity risk?

A: Warning signs include heavy reliance on data matching, thin or unusually clean identity histories, rapid account creation, and controls that stop at document checks. If the process cannot prove a live person is present, it is validating inputs rather than authenticating personhood.

Q: How should organisations respond when remote onboarding can be abused by fabricated identities?

A: They should raise assurance at the first trust decision, not after the account is live. That means stronger proofing for remote enrolment, liveness and session-integrity checks, and consistent standards across customer and workforce onboarding paths where the same identity risk exists.

Technical breakdown

Why synthetic identities bypass onboarding checks

Synthetic identity fraud works because each fragment of the identity can appear legitimate in isolation. A real social security number, a plausible address, and a fabricated name can satisfy many onboarding controls that are built to validate fields rather than prove personhood. In practice, this creates an identity proofing gap: the control confirms consistency, not reality. That is why fraudsters can seed an identity, cultivate credit, and later cash out after the account has been treated as trusted. When detection depends on behavioural deviation, the synthetic identity itself becomes the baseline, so nothing looks anomalous until losses appear.

Practical implication: treat field-level validation as insufficient for onboarding and require proof of a real person before the account is activated.

Why basic biometrics are not enough

A selfie match or document comparison can still be defeated if the attacker uses a deepfake, a replayed video, or an identity mule. The critical difference is between matching appearance and proving genuine presence. Genuine presence detection tests that a living human is physically there during the session and that the interaction is happening now, not from a pre-recorded or synthesised source. That distinction matters because synthetic identity fraud is not solved by stronger static checks alone. The weakness is not the face comparison itself, but the assumption that any captured image necessarily represents an authentic, live enrolment event.

Practical implication: require liveness and session integrity checks where onboarding risk is high enough that a simple face match cannot be trusted.

Why workforce onboarding is now part of the same problem

The article extends the same fraud pattern into hiring, where fabricated identities can be used to pass remote onboarding and then gain access to systems and funds. That turns identity proofing into an enterprise control, not just a customer onboarding concern. The same lifecycle weakness appears in both contexts: if the organisation cannot establish that the person exists at the moment of enrolment, every downstream access decision inherits that error. This is a governance issue, not only a fraud issue, because the identity lifecycle begins with a proofing decision that can either create a trusted subject or a durable blind spot.

Practical implication: align workforce onboarding, customer onboarding, and step-up verification to the same identity proofing standard where remote enrolment is used.

Threat narrative

Attacker objective: To create a trusted but fictional identity that can be monetised through accounts, credit, or services and then abandoned after cash-out.

1. Entry occurs when the fraudster assembles a synthetic identity from a real identifier, fabricated biographical details, and sometimes a supporting backstory that can survive onboarding scrutiny.
2. Credential or account access begins when the fabricated identity passes enrolment checks and is issued a new account, credit line, or service relationship.
3. Escalation happens during the cultivation phase, when the account gains trust, higher limits, or added legitimacy through small payments and low-friction interactions.
4. Impact occurs at bust-out, when the attacker maxes accounts, takes loans, or abuses the trusted identity and then disappears, leaving losses with no real victim to recover from.

Breaches seen in the wild

• Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity proofing breaks when the enrollee is fictional: Synthetic identity fraud is not a better version of identity theft, it is a different governance failure. The control problem is that onboarding systems are asked to validate an identity that has no real-world owner to monitor, contest, or recover the loss. For practitioners, the implication is that proofing must establish presence, not just consistency, before trust is extended.

Invisible-victim fraud is structurally harder to govern: Traditional fraud programmes rely on a victim loop, where anomalies are noticed by the person being harmed and then reported. Synthetic identity fraud removes that loop, so detection shifts entirely onto the organisation and its own onboarding controls. That changes the governance burden from reactive fraud handling to front-end identity assurance.

Onboarding speed has created identity blast radius: The more aggressively organisations optimise digital enrolment, the more room they create for fabricated identities to enter trusted systems. The named failure mode here is onboarding verification that assumes the applicant is already a real person. Practitioners should treat that assumption as the control boundary, because once it is crossed, downstream monitoring can only measure damage.

Genuine presence verification is the decisive control at creation time: Basic data matching, knowledge checks, and document comparison all fail when the attacker can manufacture inputs. The article’s strongest lesson is that the decisive control must live at the moment of identity creation, before credit cultivation or account abuse begins. That reorders identity governance around issuance-time assurance instead of post-issuance detection.

Synthetic identity fraud now spans consumer and workforce lifecycle decisions: The same proofing gap appears in remote hiring, shared device access, and account recovery when the person behind the credential is not strongly established. That makes identity proofing a lifecycle discipline across customer, employee, and contractor populations, not a siloed onboarding step. Practitioners should unify assurance standards wherever a new identity is first trusted.

From our research library:

• Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.

What this signals

Identity proofing has become the real control plane for fraud prevention: When fabricated identities can survive data checks, the organisation’s first trust decision matters more than any later anomaly score. Teams should move from simple validation to controls that prove a live person is present at enrolment.

Identity proofing and fraud governance are converging: Synthetic identity risk now affects consumer onboarding, remote hiring, and account recovery through the same structural weakness. The practical shift is to manage enrolment assurance as a lifecycle control, not a point-in-time friction problem.

For practitioners

• Tighten onboarding proofing thresholds Require stronger identity proofing for high-risk onboarding paths where fabricated identities can enter through remote or low-friction enrolment flows.
• Add genuine presence verification Use liveness and session-integrity checks so account creation depends on a real, physically present person rather than a replayed image or deepfake.
• Review fraud controls at issuance time Shift control design toward the point where the identity is first trusted, because post-onboarding anomaly monitoring cannot recover a fabricated enrolment.
• Extend proofing to workforce onboarding Apply the same identity assurance standard to remote hiring and privileged access onboarding so fabricated employees do not bypass the same control gap.
• Separate verification from simple attribute matching Treat document checks and data matching as inputs, not proof, and require controls that confirm a live enrollee before activation.

Key takeaways

• Synthetic identity fraud exploits a structural gap in onboarding because fabricated people can satisfy checks that were never designed to prove real-world presence.
• The article cites $20-40 billion in annual global losses, $3.3 billion in U.S. lender exposure through 2024, and 44% of organisations tracking it as their top fraud type.
• The control boundary is creation time: if organisations cannot verify that a live person is present at enrolment, later monitoring is already starting from the wrong identity.

Key terms

• Synthetic Identity Document Fraud: Synthetic identity document fraud is the use of fabricated or AI-generated identity documents to impersonate a real or invented person. It targets verification workflows by presenting fake passports, driver’s licences, or IDs that can look credible enough to pass basic checks unless teams use stronger authenticity and anomaly detection controls.
• Genuine Presence Verification: Genuine presence verification is a biometric control that checks that a real human is physically present during the session, not a replay, photo, mask, or deepfake. It adds a live assurance layer to identity proofing, which is especially important when the person being enrolled may not exist at all.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Bust-Out Fraud: Bust-out fraud is the moment a trusted-looking account is used to take maximum value and then abandoned. The account may appear healthy for a long period, which is why lifecycle monitoring matters more than point-in-time approval. The loss often arrives late and at scale.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.