How do attackers use Synthetic Identity Fraud?

How synthetic identities are built and why the fraud works

Attackers usually combine a few real attributes, such as a valid SSN fragment, address history, phone number or date of birth, with fabricated details to create an identity that can survive basic checks. The fraud works because many onboarding systems score each attribute separately, so the profile can look plausible even when no real person exists behind it.

The attacker is not trying to “look real” in one step. They are trying to look consistent over time, which is why synthetic identity fraud often starts with low-risk activity, then gradually expands into account opening, credit applications and other trust-building events.

One useful way to read this attack is as a trust-building campaign. The synthetic identity gains a footprint, accumulates positive signals, and only later turns that trust into monetisable fraud when limits rise or credit is extended.

Where attackers win: onboarding, scoring and credit growth

The main objective is to get past initial identity proofing and then use the account lifecycle to extract value. That can mean opening a deposit account, obtaining credit, or passing repeated verification steps by reusing the same attribute set across multiple institutions. The same pattern can also defeat thin-file reviews, because the identity may have too little history to trigger strong anomaly detection.

Attackers often rely on gaps between fraud controls and identity controls. If the first check is weak, the later review can be too late, especially when the profile has already accumulated legitimate-looking activity. That is why reusable attributes, slow-burn account behaviour and inconsistent history matter more than any single suspicious field.

For teams that own onboarding journeys, the practical issue is not just whether an applicant is real at the moment of review, but whether the identity has a coherent history across applications, channels and time. Synthetic identity fraud thrives when those signals are not correlated.

Signals that expose synthetic identity abuse

Defenders should focus on patterns that reveal construction, not just appearance. Thin-file identities, repeated attribute reuse across unrelated applications, mismatched or unstable history, and a profile that changes just enough to pass checks are all stronger signals than a single static anomaly.

• Watch for identities that have new contact details but old identity fragments.
• Correlate reused phone numbers, addresses, device traits and name variants across applications.
• Look for applicants whose identity history is internally inconsistent, especially when the risk score improves faster than the profile should allow.

These signals are strongest when they are combined. A thin-file record by itself may be legitimate, but a thin file plus attribute reuse plus history inconsistency is much harder to explain as ordinary customer behaviour.

Risk and Threat Considerations

Synthetic identity fraud creates both direct loss and delayed exposure. The immediate risk is bad accounts, bad credit and onboarding bypass. The longer-term risk is that the synthetic identity becomes established enough to pass future controls, increasing the blast radius of later fraud and making recovery harder.

Failure mechanism: The attacker exploits weak linkage across onboarding, fraud scoring and account history, then gradually builds a profile that appears legitimate because each step is assessed in isolation.

Impact: Organisations can approve fraudulent accounts, extend credit to non-existent or untrustworthy identities, and miss the early signals that would have prevented the profile from maturing into larger fraud.

Practitioner Guidance

What to prioritise: Treat cross-application correlation as the core control, not an optional enhancement. The most useful detection work is usually the one that joins identity evidence, device signals and historical reuse into a single reviewable picture.

What to verify: Before trusting an onboarding decision, verify whether the profile has a stable identity trail or only a plausible-looking set of fragments. If the identity becomes stronger only after repeated applications or account activity, that is a warning sign rather than proof of legitimacy.

Decision rule: If the identity is thin-file and also shows reused attributes, inconsistent history or rapid trust accumulation, escalate for manual review or step-up verification instead of relying on the baseline score alone.

Practitioner takeaway: Synthetic identity fraud is usually a lifecycle problem, not a single-check problem, so the control objective is to detect identity construction early enough that the attacker never gets the chance to build trust.

Related resources from NHI Mgmt Group

• Guide: Identity Fraud Prevention Guide
• How should security teams reduce fraud when attackers use deepfakes and synthetic identities?
• How should identity teams reduce document fraud when attackers use altered or non-document submissions?
• Why do virtual machines increase fraud risk when attackers use them to hide identity and location?
• Why does identity matter more when vulnerabilities are discovered faster than they can be patched?