TL;DR: Synthetic identity fraud remains hard to measure because losses are often misclassified as credit charge-offs, according to Mitek Systems research, and Datos Insights says U.S. unsecured credit losses reached approximately US$2.94 billion in 2025 and are projected to reach US$3.12 billion by 2026. Lifecycle visibility, not stronger onboarding alone, becomes the control boundary when fraud is cultivated over months before bust-out.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Mitek Systems's blog post: Synthetic identity fraud hides inside credit losses, and the effective response is lifecycle visibility rather than onboarding-only controls.
Why it matters: This matters because fraud, credit risk, and identity teams need shared visibility across the full customer lifecycle to detect synthetic identities before bust-out losses are absorbed.
By the numbers:
- U.S. unsecured credit synthetic identity fraud losses reached approximately US$2.94 billion in 2025, up from US$1.80 billion in 2020.
- By 2026, U.S. unsecured credit synthetic identity fraud losses are projected to reach US$3.12 billion.
- 84% of fraud executives identify synthetic identities as a high or moderate threat to their institutions’ application processes.
Context
Synthetic identity fraud is a governance problem, not just an onboarding problem. A synthetic identity can pass early checks, build a plausible credit history, and only reveal itself when losses have already accumulated, which is why point-in-time verification misses the lifecycle risk. In financial services, that gap affects fraud, credit risk, provisioning, and regulatory reporting.
The issue becomes harder because the fraud often leaves no victim who will report it, so institutions may never classify the loss correctly. Identity fraud prevention has to cover the full relationship, from first contact through account use and eventual termination, or the control boundary ends too early.
Key questions
Q: How should organisations detect synthetic identities after onboarding?
A: They should treat onboarding as the start of verification, not the end. The strongest signals come from later behaviour, including dormancy followed by sudden activity, device reuse, repeated attribute patterns, and mismatches between identity age and value extracted. Continuous monitoring matters because synthetic identities are designed to look legitimate long after initial approval.
Q: Why do synthetic identities often appear as credit losses instead of fraud?
A: Synthetic identities often show up as credit losses because they are built to pass initial checks, then run accounts until the issuer writes them off after missed payments or a deliberate bust-out. The loss may be recorded as a charge-off rather than confirmed fraud because the identity data can look legitimate enough to defeat early fraud controls.
Q: How does lifecycle monitoring reduce synthetic identity bust-out risk?
A: Lifecycle monitoring reduces synthetic identity bust-out risk by watching for behaviour changes after onboarding, such as rapid credit-line use, address churn, payment anomalies, device changes, and repeated applications across linked profiles. background risk scoring helps by re-evaluating the account as new signals appear, instead of relying only on opening checks.
Q: What is the difference between onboarding checks and lifecycle controls?
A: Onboarding checks assess identity and application risk at the point of enrolment or account opening, while lifecycle controls monitor the account afterwards for changes in behaviour, ownership, or entitlement. Onboarding may use document checks and bureau data, but lifecycle controls rely on ongoing review, velocity rules, alerts, and periodic re-verification.
Technical breakdown
Why synthetic identities evade point-in-time verification
Synthetic identity fraud succeeds when controls judge consistency rather than authenticity. A fabricated identity can accumulate a credit file, make on-time payments, and appear legitimate to bureau checks even though the underlying person does not exist as a real consumer. Onboarding controls can catch weak documents or obvious mismatches, but they are designed for a snapshot, not a long-running identity that has been cultivated to look normal over time. See the Identity Proofing and KYC Guide.
Practical implication: Treat onboarding as one signal in a broader risk model, not as the control that proves identity legitimacy.
How lifecycle monitoring changes the fraud detection model
Lifecycle monitoring extends detection beyond account opening into usage patterns, behavioural drift, and termination events. That matters because synthetic fraud often becomes visible only after the account is active, when cash advances, balance transfers, and spend acceleration begin to match bust-out behaviour. The control problem shifts from blocking every suspicious application to detecting the transition from plausible identity to monetisation pattern before the loss is complete. Read Fraud Prevention Guide for Digital Businesses.
Practical implication: Correlate application, account, and repayment signals so review decisions can happen after onboarding as well as before it.
Why siloed fraud and credit teams miss synthetic identity fraud
Synthetic identity fraud is frequently misclassified because the evidence is split across functions. Fraud teams may see onboarding anomalies, while credit teams only see charge-offs, and neither group gets a full view of the identity’s history. That separation creates a structural blind spot: the institution books the outcome as credit loss even when the root cause was fraud activity that unfolded across multiple stages of the customer lifecycle. See the Identity Fraud Prevention Guide.
Practical implication: Break data and workflow silos so charge-off review, fraud investigation, and credit risk analysis operate on the same identity record.
Threat narrative
Attacker objective: The attacker’s objective is to extract credit value at scale while keeping the fraudulent identity invisible long enough for the institution to misclassify the loss.
- Entry occurs when a synthetic identity is created and used to pass early onboarding checks with plausible documents and bureau data.
- Credential or account access is established once the synthetic identity is approved and the fraud ring gains a live credit relationship with the institution.
- Escalation happens as the account is cultivated through on-time activity and then pushed toward cash advances, balance transfers, and rapid utilisation.
- Impact follows when the ring executes bust-out activity across one or many accounts and the institution absorbs losses as ordinary charge-offs.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Synthetic identity fraud is a lifecycle governance failure, not an onboarding defect. The article shows that the same identity can look suspicious at creation and credible months later, which means a single gate cannot govern the risk. Once fraud is cultivated into a usable account, the problem becomes a relationship-control issue across the full customer lifecycle. Practitioners should treat identity assurance as continuous governance, not a one-time approval decision.
Misclassification is part of the loss mechanism. When synthetic identities never produce a victim report, institutions can book fraud as credit loss and underestimate exposure. That creates a governance assumption failure: the portfolio view is only as accurate as the reporting trigger, and synthetic fraud often suppresses that trigger entirely. Practitioners should assume that absent customer complaints do not mean absent fraud.
Lifecycle visibility is the named control gap this threat exposes. The article makes clear that the missing capability is not more friction at every touchpoint but continuity across inquiry, onboarding, usage, and termination. That is an identity governance problem because the organisation needs to know when a real-looking file stops behaving like a real customer file. Practitioners should measure coverage across the whole journey, not just onboarding pass rates.
Fraud prevention, credit risk, and identity verification need a shared operating model. Separate teams, separate data, and separate escalation paths turn synthetic identity fraud into an organisational blind spot. This is where lifecycle fraud becomes an identity governance issue in the broader sense: without shared records and shared review logic, the institution cannot connect the signals that matter. Practitioners should align ownership so the same identity record follows the account from first contact to closure.
From our research library:
- Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.
What this signals
Lifecycle visibility becomes the real fraud control boundary. Institutions that only score the application step will keep discovering synthetic fraud too late, because the strongest indicators often appear after the account is live. The operational shift is to treat account behaviour, not just identity proofing, as a governance signal.
Shared identity records matter more than isolated controls. When fraud, credit risk, and onboarding operate from different datasets, the organisation cannot reconstruct the full synthetic identity path. That means the control failure is structural, not merely procedural: the institution lacks a single view of the identity over time.
AI-assisted fraud raises the speed of adaptation. As criminal networks use automation to test and refine synthetic identity behaviours, static rules lose value faster. Teams need monitoring models that can absorb new patterns without waiting for a manual rule change cycle.
For practitioners
- Map synthetic identity exposure across the full customer lifecycle Audit first contact, onboarding, active account behaviour, and termination to find where the institution can and cannot observe synthetic identity signals.
- Reclassify charge-offs with fraud review logic Review historical and current charge-off portfolios for synthetic identity indicators so fraud losses are not left buried inside credit loss reporting.
- Connect onboarding checks to downstream monitoring Link document verification, bureau checks, behavioural analytics, and account activity triggers so a passing application does not become a blind spot later.
- Break fraud and credit risk data silos Share alerts, case notes, and identity histories across fraud and credit risk teams so one function can see what the other misses.
- Test for bust-out behaviour before the full drawdown Watch for cash-advance spikes, rapid balance transfers, and spend acceleration that indicate monetisation rather than normal customer activity.
Key takeaways
- Synthetic identity fraud is hard to see because it often looks like ordinary credit loss until the account is already drained.
- The evidence points to a multi-billion-dollar problem with losses that continue to rise as fraud rings use more automation and more realistic identity files.
- The most effective response is lifecycle visibility that connects onboarding, account behaviour, and portfolio review into one operating model.
Related NHI Mgmt Group resources: Identity Fraud Prevention Guide · Identity Proofing and KYC Guide · Fraud Prevention Guide for Digital Businesses · Synthetic Identity Fraud Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-63 sets the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Synthetic identities persist across the customer lifecycle because the institution does not always identify when the relationship should end. |
| NHI-04 — Insecure Authentication | The article shows that weak authentication signals can let cultivated synthetic identities pass verification. | |
| Recommendation — Review lifecycle controls so fraudulent identities are removed before they can be used for bust-out activity. Strengthen identity assurance so approved accounts still face ongoing authentication and validation checks. | ||
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | Enrollment is the first gate where synthetic identities are tested and sometimes wrongly accepted. |
| SP 800-63B — Authentication | Ongoing authentication matters because synthetic identities are often cultivated after initial approval. | |
| Recommendation — Use identity proofing evidence and assurance levels to reduce acceptance of fabricated customer identities. Apply stronger authentication checks when account behaviour shifts away from normal customer patterns. | ||
| GDPR | Art.5 — Principles relating to processing of personal data | Identity and fraud teams processing customer data need accurate, purpose-bound handling of records and risk signals. |
| Recommendation — Limit identity data processing to what is necessary and keep fraud classification accurate and defensible. | ||
Key terms
- Synthetic Identity Fraud: Synthetic identity fraud is the creation of a fake identity from a mix of real and fabricated personal data. Fraudsters use it to open accounts, build credit, and evade standard checks. Defenders look for thin-file identities, inconsistent identity attributes, repeated reuse of contact details, and unusual account-age patterns across applications.
- Bust-Out: Bust-out is a fraud pattern in which an account is built up over time and then rapidly used to extract value before payment stops. It usually involves a synthetic or stolen identity, with losses realised when the account is maxed out and charged off.
- Credit Bureau Data: Credit bureau data is information held by a credit reporting agency about a person’s borrowing history, accounts, repayment behaviour, and related identifiers. Lenders use it for identity matching, credit decisioning, and fraud screening, so inconsistent or thin-file data can affect both approval and risk assessment.
- Charge-Off: Charge-off is the accounting treatment used when a lender writes a debt down as unlikely to be collected. It removes the receivable from active balance tracking, while collection efforts may continue and the loss is reflected in financial and credit reporting.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps practitioners connect identity controls to the operational realities of access, assurance, and lifecycle risk.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org