Topic starter
02/08/2026 12:30 pm
TL;DR: Synthetic identity fraud now evades many traditional checks because fraudsters combine real identifiers with fabricated personal data, let profiles age into creditworthiness, and then execute bust-out fraud, according to Yoti. The control gap is not a single weak check but a verification model that treats static identity data as sufficient proof of a real person.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “What is synthetic identity fraud? How it works and how to prevent it”.
By the numbers:
- Traditional fraud tools fail to detect 85% of synthetic identity fraud cases, according to LexisNexis research cited by Yoti.
- 99% of synthetic identities remain unchanged over 2 years, according to Yoti.
Key questions
Q: What breaks when banks rely on static PII for identity verification?
A: Static PII breaks when the same personal data can be stolen, bought, or assembled from breaches and used to pass checks that were designed to prove uniqueness.
Q: When should operators prioritise stronger verification over lower onboarding friction?
A: Operators should prioritise stronger verification when the next action creates financial exposure, such as bonus release, high-value deposits or withdrawals.
Q: What are the signs that a synthetic identity programme is failing?
A: Warning signs include approved accounts with little provenance, slow-building activity followed by sudden value extraction, repeated device patterns across supposedly separate identities, and fraud discovered only after the account has already passed its trust-building phase.
Practitioner guidance
- Strengthen layered identity verification Combine document authenticity, face matching, liveness detection, and external-record checks so no single signal decides whether a person is real.
- Monitor identity growth patterns Flag short bursts of small credit applications, repeated reuse of contact details, and profiles that remain unusually unchanged over long periods.
- Use trusted record validation Cross-check applicant data against death indicators, government-held records, sanctions, and other authoritative sources before approval.
Bottom line: Synthetic identity fraud succeeds when verification stops at data consistency and never tests whether a real person exists behind the profile.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:28 pm
Static identity verification is the core governance failure synthetic fraud exploits. The issue is not just weak document checks or poor fraud scoring, but a model that treats consistency across a few fields as proof of personhood. Once organisations accept that premise, attackers can assemble identities that look legitimate without ever belonging to a real individual. Practitioners should treat identity assurance as a continuity problem, not a snapshot problem.
A few things that frame the scale:
- Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.
A question worth separating out:
Q: How do fraud teams balance KYC checks with ongoing identity monitoring?
A: KYC should verify the applicant at entry, but synthetic fraud shows that entry checks are not enough. Teams need continuous monitoring for changes, anomalies, and mismatches that appear after onboarding. That means linking verification, fraud analytics, and adverse-record checks into one programme rather than treating KYC as a single gate.
👉 Read our full editorial: Synthetic identity fraud exposes the gaps in identity verification