Application fraud: what banks need to act on at onboarding

TL;DR: Application fraud now uses synthetic identities, bot attacks and GenAI to bypass onboarding checks and create mule accounts, according to Feedzai, while still forcing banks to balance fraud control against frictionless customer onboarding. Static identity verification is no longer enough when the attack surface is behavioural, device-based and increasingly automated.

Editorial analysis by NHI Mgmt Group, based on content published by Feedzai: “What Is Application Fraud? Detection, Prevention & Real-World Examples”.

By the numbers:

• Identity theft-related crimes, including application fraud, have resulted in $10.2 billion in losses.

Key questions

Q: What breaks when banks rely on static PII for identity verification?

A: Static PII breaks when the same personal data can be stolen, bought, or assembled from breaches and used to pass checks that were designed to prove uniqueness.

Q: Why do digital onboarding flows create less risk than manual KYC when identity fraud and synthetic identities are common?

A: Digital onboarding reduces risk because it can verify identity continuously and at scale, while manual KYC depends on office visits, human review, and slower decision cycles.

Q: What signs show a fraud operation is becoming industrialised?

A: Look for reusable domains, phishing kits, scripted support flows, repeated wallet patterns, and laundering through the same service providers or DeFi paths.

Practitioner guidance

• Strengthen onboarding decision orchestration Route applicants through risk-based flows that combine identity data, behavioural signals and device reputation before account creation is approved.
• Correlate behavioural and device signals Look for copy-paste speed, navigation anomalies, emulators, virtual machines and repeated device fingerprints across separate applications.
• Add explicit synthetic identity review rules Flag combinations of partial real data, inconsistent address history and repeated relationship links that indicate a manufactured persona.

Bottom line: Application fraud now begins with manufactured identity evidence, not just stolen personal data, which makes traditional static checks insufficient.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →