Synthetic identity fraud: where onboarding controls break down

TL;DR: Synthetic identity fraud now costs businesses an estimated $20-40 billion globally each year, with U.S. lenders facing $3.3 billion in exposure from new-account abuse through 2024, according to iProov. The structural problem is that fabricated identities remove the victim from the detection loop, so onboarding verification has to do the work that reporting and recovery never can.

NHIMG editorial — based on content published by iProov: synthetic identity fraud and the limits of onboarding verification

By the numbers:

• U.S. lenders faced $3.3 billion in exposure from synthetic identities tied to new accounts through 2024.
• 44% of organizations now rank synthetic identity fraud as their top-tracked fraud type.

Questions worth separating out

Q: What fails when synthetic identity fraud gets past onboarding?

A: The core failure is that the system has already accepted a fabricated person as real, so every downstream control starts from a false identity.

Q: Why do synthetic identities bypass so many fraud controls?

A: They bypass controls because each piece of data can look legitimate on its own, even when the identity as a whole is fictional.

Q: How should organisations verify that a new user is real?

A: Organisations should require real-time genuine presence verification during onboarding for high-risk use cases.

Practitioner guidance

• Move proofing upstream to enrolment Require genuine presence verification before an account is created, not after suspicious activity begins.
• Treat thin-file and newly built identities as high-risk Flag applications built from sparse histories, rapid credit-building, or unusual authorised-user patterns for enhanced review.
• Separate selfie match from liveness assurance Do not rely on static face comparison for high-value onboarding flows.

What's in the full article

iProov's full article covers the operational detail this post intentionally leaves for the source:

• The specific mechanics of Dynamic Liveness, including Flashmark and how each session resists replay and injection attacks
• The workforce identity use cases that extend the same proofing model into remote hiring, shared-device access, step-up authentication, and account recovery
• The testing and certification details behind NIST SP 800-63-4 and CEN/TS 18099 Level High validation
• The article's breakdown of how synthetic identity fraud tools are being industrialised through crime-as-a-service networks

👉 Read iProov's analysis of synthetic identity fraud and onboarding controls →

Synthetic identity fraud: where onboarding controls break down?

Explore further

View Full Forum →  |  NHI Foundation Course →