Topic starter
10/06/2026 10:41 pm
TL;DR: Synthetic identities are built from real and fabricated data, can pass onboarding for months or years, and then bust out at scale, according to SumSub’s conversation with fraud investigator Steve Lenderman. The threat now spans fintech, payroll, government programmes, and AI-assisted fraud, which means identity controls must move beyond static verification to behavioural detection and lifecycle scrutiny.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Synthetic Identities: When Data Becomes a Persona”.
Key questions
Q: How should organisations detect synthetic identities after onboarding?
A: They should treat onboarding as the start of verification, not the end.
Q: Why do synthetic identities create more risk than simple fake accounts?
A: Synthetic identities can survive early checks, build a believable history, and then exploit the business once trust has been established.
Q: What are the signs that a synthetic identity programme is failing?
A: Warning signs include approved accounts with little provenance, slow-building activity followed by sudden value extraction, repeated device patterns across supposedly separate identities, and fraud discovered only after the account has already passed its trust-building phase.
Practitioner guidance
- Strengthen identity provenance checks Go beyond field matching and verify whether the identity has durable real-world anchors, not just internally consistent data points.
- Add lifecycle monitoring after approval Track account age, activity shifts, dormancy, and sudden value acceleration so that trust does not remain static after onboarding.
- Fuse behavioural and device signals Correlate session rhythm, typing patterns, device reuse, and network anomalies to identify accounts that are technically valid but operationally suspicious.
Bottom line: Synthetic identity fraud works because the account can appear legitimate long after onboarding, which makes static verification insufficient on its own.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/06/2026 2:50 am
Synthetic identity fraud is an identity governance failure, not just a fraud-control failure. The core problem is that programmes often treat onboarding as a binary decision instead of the first checkpoint in a longer trust lifecycle. Once an identity is accepted, many controls assume the subject remains the same as the one originally verified. That assumption breaks when the identity is synthetic and intentionally designed to mature into legitimacy. The implication is that identity assurance must be maintained across the full account lifecycle, not only at creation.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who should own synthetic identity risk in an organisation?
A: Ownership should be shared across IAM, fraud, risk, and operations because the problem crosses onboarding, access, and transaction stages. When only one team owns it, the organisation misses the identity signals that appear in other systems and loses the chance to stop abuse before the bust-out stage.
👉 Read our full editorial: Synthetic identities expose the gap in modern identity controls
12/06/2026 4:23 am
Synthetic identity fraud is a lifecycle problem, not an onboarding problem. Static verification can tell you whether fields match, but it cannot prove that the person behind the record has real-world legitimacy or future intent. That is why the strongest control failures appear after enrolment, when trust has already been extended. Practitioners should treat identity age, behavioural drift, and account progression as first-class risk signals.
A question worth separating out:
Q: Should fraud teams treat synthetic identities as an IAM problem or a fraud problem?
A: Both. Fraud teams need behavioural detection and loss prevention, while IAM teams need stronger identity assurance across the full lifecycle. If the two functions do not share signals, synthetic identities can pass one control layer and defeat the other.
👉 Read our full editorial: Synthetic identities expose the gap in modern identity controls
This post was modified 1 day ago by NHI Mgmt Group