Why do synthetic identities make structuring harder to detect?

Why synthetic identities are hard to spot at onboarding

Synthetic identities are built to look ordinary at the exact point where institutions have the least context: account opening. They can combine real and fabricated attributes, pass basic checks, and behave like low-risk new customers long enough to establish credibility. That makes the earliest decision, whether to issue an account, the most important control point.

The detection problem is structural rather than purely analytical. Transaction monitoring works best when there is a stable identity history to compare against, but synthetic identities are designed to have little or no prior history. By the time structuring becomes visible, the account may already have been accepted as legitimate and allowed to accumulate trust.

That is why stronger onboarding controls matter more than heavier post-onboarding review alone. If the identity proofing step does not create reliable assurance, later AML and fraud controls inherit a polluted baseline and have to distinguish genuine customer activity from manufactured legitimacy after the fact.

Why structuring blends in once a synthetic identity is accepted

Structuring depends on repeated activity staying below obvious thresholds, so the account must first survive long enough to look established. Synthetic identities help because they often behave like fresh but plausible customers: modest balances, routine interactions, and gradual transaction patterns that avoid immediate suspicion. The deposits can then be distributed across time and channels to reduce obvious spikes.

What makes this hard is that the behavior is not always anomalous in isolation. A small cash pattern from a newly opened account can resemble normal early-life customer activity, especially when the onboarding record itself supplied few strong risk signals. Without a trustworthy identity anchor, the same transactions can be read as cautious customer behavior instead of placement activity.

This is why investigators often need to correlate onboarding evidence, device and linkage data, funding sources, and account velocity, not just transaction thresholds. synthetic identity activity is often revealed by inconsistencies across those layers rather than by any single large movement.

Why the control problem starts before AML

The deeper issue is that synthetic identities exploit the boundary between customer due diligence and financial crime monitoring. If onboarding assurance is weak, the institution may issue an account, assign it a clean risk profile, and only later notice that the profile was manufactured. That is a control failure in identity proofing and account issuance, not only in monitoring.

For that reason, the most effective response is to treat onboarding as part of the detection stack. Identity proofing, document verification, liveness checks, linkage analysis, and step-up review all help reduce the chance that a synthetic record becomes a trusted mule account. Once the account exists, every downstream control is working with less certainty.

In practice, the challenge is less about spotting one suspicious payment and more about proving that the customer behind the account is real, unique, and consistent across the lifecycle. Identity Proofing and KYC Guide is useful here because it focuses on the assurance layer where synthetic identities first get their foothold. Identity Fraud Prevention Guide adds the lifecycle view, including how mule accounts, fake accounts, and early-life fraud patterns surface after onboarding.

Risk and Threat Considerations

Synthetic identities are attractive because they let criminals convert weak onboarding into durable access to financial rails. Once a mule account is trusted, it can absorb structured deposits, support layering, and move value while appearing ordinary enough to evade threshold-based review.

Failure mechanism: The institution accepts a fabricated identity as genuine, assigns it normal customer status, and then loses the reliable baseline needed to distinguish legitimate low-value activity from staged placement patterns.

Impact: AML teams see fewer clean signals, investigations start later, and losses can spread across multiple accounts or channels before the pattern becomes obvious.

Practitioner Guidance

What to prioritise: Treat onboarding assurance as the first anti-structuring control, not just a compliance formality. The key question is whether the account-opening process can reliably separate a real new customer from a manufactured one before transactions begin.

What to verify: Check whether your review process can link identity proofing outcomes to later transaction alerts. If a suspicious account has weak provenance, reused contact details, or thin verification evidence, escalate the case as an onboarding failure as well as an AML case.

Common mistake: Relying on transaction thresholds alone. By the time structuring is visible in payments data, the synthetic identity may already have done the work of creating false trust.

Practitioner takeaway: The best signal is not a larger payment, it is a weakly established account that was allowed to become operationally trusted before its identity was well proven.

Related resources from NHI Mgmt Group

• Why do synthetic identities make trust and safety programmes harder to run?
• Why do synthetic identities make modern KYC harder?
• Why do spoofed developer identities make supply chain attacks harder to detect?
• Why do synthetic identities and deepfakes make ecommerce fraud harder to stop?