How should organisations detect synthetic identities after onboarding?

Why This Matters for Security Teams

Synthetic identities are rarely exposed at onboarding because the initial signals are engineered to look normal. The real risk appears later, when a fabricated account starts behaving like a real customer or contractor while quietly accumulating trust, access, or fraud value. That makes post-onboarding monitoring a detection problem, not just a vetting problem. NHI Management Group’s Ultimate Guide to NHIs — Key Challenges and Risks shows how often identities are mismanaged after approval, and the same pattern applies to synthetic identities that blend into normal operations.

Security teams often over-rely on document checks, form validation, or one-time fraud scoring. Those controls matter, but they do not tell you whether the identity is still coherent over time. Continuous assessment is the practical gap. The NIST Cybersecurity Framework 2.0 reinforces that identity risk needs ongoing governance, not a point-in-time decision. In practice, many security teams encounter synthetic identities only after an account has already been used to move funds, abuse promotions, or seed larger fraud rings, rather than through intentional early detection.

How It Works in Practice

Effective detection starts by treating post-onboarding behaviour as the strongest source of evidence. A synthetic identity may pass initial checks, but it often leaves a behavioural trail that real users do not. The key is to compare identity age, activity timing, device history, and attribute stability against expected lifecycle patterns. If the account stays dormant for a long period, then suddenly becomes highly active, that shift deserves scrutiny. The same is true when multiple identities share the same device fingerprint, payment instrument, contact pattern, or registration traits.

NHI Management Group recommends anchoring this approach in lifecycle thinking, which is why the NHI Lifecycle Management Guide is useful even for fraud teams. Identity trust should be earned over time, not assumed at creation. Operationally, teams should combine:

• Behavioural monitoring for dormancy, burst activity, and unusual timing patterns
• Device and network correlation to detect reuse across supposedly distinct identities
• Attribute drift checks for repeated names, addresses, phones, or payment metadata
• Velocity rules that flag rapid value extraction after a quiet period
• Manual review for clusters that share features but appear independent on paper

This is where visibility becomes critical. If teams cannot see cross-account linkage, they cannot separate a single benign user from a coordinated synthetic cluster. NHI Mgmt Group notes that only 5.7% of organisations have full visibility into their service accounts, which is a separate identity class but the same governance lesson applies: weak visibility turns correlation into guesswork. The operating model should therefore include rule-based screening plus anomaly detection, with escalation paths for accounts that remain consistent on paperwork but inconsistent in behaviour. These controls tend to break down in high-volume consumer environments with shared devices, disposable contact details, and frequent legitimate account turnover because false positives can overwhelm review queues.

Common Variations and Edge Cases

Tighter post-onboarding monitoring often increases review burden, requiring organisations to balance fraud reduction against customer friction and analyst capacity. That tradeoff is especially real in marketplaces, fintech, gig platforms, and subscription services where legitimate users may also show irregular activity.

Current guidance suggests that no single signal should be treated as definitive. A dormant account is not automatically synthetic, and device reuse can be legitimate in families, offices, or shared environments. Best practice is evolving toward score aggregation, where weak indicators become meaningful only when they recur together over time. For example, a new account with a recycled device, a recently created email domain, and an abrupt surge in value extraction is more actionable than any one indicator alone. The Top 10 NHI Issues also highlights how weak lifecycle controls create blind spots after initial approval, which mirrors synthetic identity abuse in practice.

Edge cases matter. Some legitimate users will stay inactive for months before returning, while some fraud rings deliberately slow their activity to avoid thresholds. That means investigators should look for consistency across the full account story, not just one suspicious event. Where identity assurance is high but post-onboarding behaviour becomes abnormal, the account should be stepped up for re-verification, transaction limits, or controlled suspension pending review.

Related resources from NHI Mgmt Group

• Why do account takeovers create fraud risk even after strong onboarding checks?
• What do teams get wrong about synthetic identities in marketplace environments?
• What do organisations get wrong about deepfakes in financial onboarding?
• When do non-human identities pose the greatest risk to organizations?