Topic starter
02/08/2026 12:30 pm
TL;DR: Synthetic identity fraud succeeds when KYC stops at static data and never tests whether a real person exists, according to Yoti. Identity programs need layered proof and ongoing monitoring, or long-lived profiles can mature into bust-out fraud.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “What is synthetic identity fraud? How it works and how to prevent it”.
By the numbers:
- Traditional fraud tools fail to detect 85% of synthetic identity fraud cases, according to LexisNexis research cited by Yoti.
- 99% of synthetic identities remain unchanged over 2 years, according to Yoti.
Key questions
Q: When should operators prioritise stronger verification over lower onboarding friction?
A: Operators should prioritise stronger verification when the next action creates financial exposure, such as bonus release, high-value deposits or withdrawals.
Q: What are the signs that a synthetic identity programme is failing?
A: Warning signs include approved accounts with little provenance, slow-building activity followed by sudden value extraction, repeated device patterns across supposedly separate identities, and fraud discovered only after the account has already passed its trust-building phase.
Q: What breaks when banks rely on static PII for identity verification?
A: Static PII breaks when the same personal data can be stolen, bought, or assembled from breaches and used to pass checks that were designed to prove uniqueness.
Practitioner guidance
- Strengthen layered identity verification Combine document authenticity, face matching, liveness detection, and external-record checks so no single signal decides whether a person is real.
- Monitor identity growth patterns Flag short bursts of small credit applications, repeated reuse of contact details, and profiles that remain unusually unchanged over long periods.
- Use trusted record validation Cross-check applicant data against death indicators, government-held records, sanctions, and other authoritative sources before approval.
Bottom line: Synthetic identity fraud succeeds when verification stops at data consistency and never tests whether a real person exists behind the profile.
Glossary terms: Synthetic Identity Document Fraud, Bust-Out Fraud, Identity proofing, Liveness Detection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:28 pm
Static identity verification is the core governance failure synthetic fraud exploits. The issue is not just weak document checks or poor fraud scoring, but a model that treats consistency across a few fields as proof of personhood. Once organisations accept that premise, attackers can assemble identities that look legitimate without ever belonging to a real individual. Practitioners should treat identity assurance as a continuity problem, not a snapshot problem.
A few things that frame the scale:
- Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.
A question worth separating out:
Q: How do fraud teams balance KYC checks with ongoing identity monitoring?
A: KYC should verify the applicant at entry, but synthetic fraud shows that entry checks are not enough. Teams need continuous monitoring for changes, anomalies, and mismatches that appear after onboarding. That means linking verification, fraud analytics, and adverse-record checks into one programme rather than treating KYC as a single gate.
👉 Read our full editorial: Synthetic identity fraud exposes the gaps in identity verification