Synthetic identity fraud succeeds because most onboarding and fraud controls assume the applicant is a real person, and a synthetic identity is not. It is built from a mix of real and invented personal data, passes individual checks, is often cultivated into a creditworthy customer over months or years, and then defaults with no victim to complain. This guide goes deeper than the overview in the Identity Fraud Prevention Guide: it covers how synthetics are classified, the lifecycle to bust-out, US Social Security number (SSN) controls (randomisation and eCBSV), onboarding and post-onboarding signals, authorised user tradeline abuse, generative AI documents, and how the problem maps outside the US. It is written for fraud strategy, identity proofing, credit risk and financial crime teams, and describes detection and prevention only.
Key takeaways
- No single check catches a synthetic. The Federal Reserve toolkit states that "no single indicator signifies a synthetic identity" and that synthetics "often pass initial identity verification"; the strongest signal is matching information across accounts that claim to be different people.
- Existence is not consistency. A synthetic has a credit bureau file because someone applied for credit. Ask whether its history fits its claimed age, and whether an authoritative source confirms the name, date of birth and SSN belong together.
- eCBSV closes one gap, not all of them. The SSA's electronic Consent Based SSN Verification service confirms whether a name, date of birth and SSN match SSA records, with consent, for financial institutions and their service providers only.
- The loss is usually misfiled. Bust-out losses booked as credit losses hide the network. Classify them as fraud so linked accounts can be found before they also bust out.
- Treat it as a lifecycle problem. Onboarding checks, link analysis on the existing book, authorised user monitoring and loss classification each catch synthetics the others miss.
What synthetic identity fraud is
The Federal Reserve, working with 12 fraud experts, defines synthetic identity fraud (SIF) as "the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain." It separates primary elements (name, date of birth, SSN or another government identifier), which together are typically unique to one person, from supplemental elements (address, phone, email, digital footprint), which "cannot establish an identity by themselves." Its 2019 white paper names three construction types, which are the labels to use in loss reporting and models:
| Type | Federal Reserve description | Common industry names | What usually exposes it |
|---|---|---|---|
| Identity fabrication | "a completely fictitious identity without any real PII" | Fabricated identity, manufactured synthetic | Authoritative SSN, name and date of birth check fails; no history before the first credit application |
| Identity manipulation | "using slightly modified real PII to create a new identity" | Manipulated synthetic identity, identity manipulation fraud; often a real person altering a digit or date of birth | Near-duplicate matching against customers and bureau records; one SSN with several dates of birth |
| Identity compilation | "a combination of real and fake PII" | Frankenstein identity, synthetic identity theft | A real SSN belonging to a child, elderly or deceased person, paired with a different name and date of birth |
The Federal Reserve lists the uses as credit repair, "fraud for living" (obtaining housing, utilities, jobs or bank accounts by someone who cannot use their real identifiers), payment default schemes, and crime such as money laundering and trafficking; the toolkit adds money mules and notes one synthetic can defraud government programmes, healthcare and telecoms as well as lenders.
The difference from traditional identity theft is the victim. A real person eventually notices accounts they did not open; a synthetic person never complains. Where a real SSN is used, the Federal Reserve says it typically belongs to "a child or an elderly or homeless person", and the fraud "can lie dormant for years, only being uncovered once individuals turn 18."
The lifecycle, and where each stage can be caught
| Stage | What happens (Federal Reserve) | What the institution sees | Detection opportunity |
|---|---|---|---|
| Creation and first application | Identity assembled from stolen or invented PII; repeated applications until one creates a credit file | Declines, thin or no file, recent inquiries | Application velocity per SSN, device, address and phone; authoritative SSN check; new contact details |
| Cultivation | Small balances paid on time for months or years; secured lines used to build history | A model customer with rising limits | File depth inconsistent with age; few liability accounts |
| Piggybacking | Added as an authorised user so it "acquires the established credit history of the primary user" | A thin-file applicant with an old, well-run tradeline | Authorised user tradelines dominating the file; the same people as authorised users on unrelated accounts |
| Bust-out | Credit maxed out "with no intention to repay" | Sudden utilisation across products, then default | Limit increase and utilisation monitoring; linked accounts busting out together |
| Repeat | False identity theft claims to reverse charges | Disputes on charged-off accounts | Route disputes on suspected synthetics to fraud investigation |
The toolkit's example shows why credit models miss this: a card approved at $20,000, paid on time for three years, raised to $40,000, maxed out and charged off as a credit loss with no fraud indicator ever raised. "Most traditional fraud models are not built around the idea that a person is not real."
SSN verification in the US: randomisation and eCBSV
Most US synthetic fraud turns on the SSN, a nine-digit number the Social Security Administration (SSA) created "solely to track earnings history" that became the key to credit files.
SSN randomisation (2011)
On 25 June 2011 the SSA began assigning SSNs randomly. Area numbers (the first three digits) no longer map to states, group numbers lost their old meaning, the High Group List was frozen at pre-randomisation numbers, and unused area numbers were opened up except 000, 666 and 900 to 999. As the Federal Reserve puts it, "geographic checks are no longer effective for newly issued SSNs": rules comparing the area number with the claimed state of birth, or estimating issue date from the number's structure, tell you nothing about a randomised SSN. The Federal Reserve lists "SSNs issued after 2011" as a common characteristic and cites an industry estimate that nearly 40 per cent of synthetics use a randomised SSN. Treat this as context, not a rule: every child born and every new arrival since 2011 also has one.
eCBSV
eCBSV exists because Section 215 of the Economic Growth, Regulatory Relief, and Consumer Protection Act (Pub. L. 115-174) required the SSA to compare "fraud protection data" submitted electronically. According to the SSA:
- What it checks: whether the SSN, name and date of birth combination matches SSA records.
- What it returns: yes or no, which element does not match, and a death indicator where SSA holds one.
- Who can use it: financial institutions as defined in section 509 of the Gramm-Leach-Bliley Act, or their service providers, subsidiaries, affiliates, agents, subcontractors or assignees. Enrolment has been open since February 2022.
- Consent: the number holder's written consent with a wet or electronic signature, so consent capture must be built into the journey. Fees are annual, in volume tiers.
The original CBSV service (2008) relied on written consent; eCBSV is built for real-time digital onboarding. The Federal Reserve's 2020 paper records two limits: access is restricted to financial institutions, which may push fraud to other sectors, and the SSA has said the Privacy Act prevents screening existing accounts. eCBSV defeats fabricated identities and many compilations, but not a real person's SSN used with their correct name and date of birth, which is stolen identity fraud needing document and biometric checks. See the Identity Proofing and KYC Guide.
Synthetic identity signals at onboarding
Synthetic identity onboarding controls test consistency and history, not existence. NIST SP 800-63A-4 says its lowest assurance level is designed in part "to protect against synthetic identities" and sets fraud management requirements for credential service providers in section 3.2.1.
| Signal | Source | Why it points to a synthetic | False positive risk |
|---|---|---|---|
| Name, date of birth and SSN mismatch | eCBSV | Fabricated or compiled identity | Name changes, typos; allow correction |
| Death indicator | eCBSV; SP 800-63A-4 death records check (SHALL) | Deceased person's SSN in a compilation | Low, but records can be wrong |
| Age and credit history mismatch | Bureau data | The Federal Reserve's "40-year-old applicant with a brief six-month credit file" | High for immigrants, young adults, people previously incarcerated or excluded |
| Recently issued contact details | Email and phone tenure (SP 800-63A-4 SHOULD) | A 50-year-old with a brand new email "should raise a red flag" (Federal Reserve) | Moderate |
| Recently ported phone | SIM swap detection (SP 800-63A-4 SHOULD) | Phone controlled by someone other than the long-term subscriber | Moderate |
| High-risk mailing address | Virtual PO box check (SP 800-63A-4 SHOULD) | Drop addresses shared by many identities | Students, military, shared housing |
| Same device, phone, email pattern or address under different names | Device intelligence, consortium data | The toolkit's "biggest indicator" | Households and shared devices |
| Many recent inquiries and large unsecured debt on a thin file | Bureau data | File creation by repeated applications, then rapid building | Moderate |
Build three SP 800-63A-4 rules into policy: knowledge-based verification "SHALL NOT be used for identity verification" (it may feed fraud scoring); "Knowledge of an SSN is not sufficient to act as evidence of identity"; and every fraud check needs a privacy risk assessment and ongoing performance monitoring.
Synthetic identity document fraud and generative AI
FinCEN alert FIN-2024-Alert004 (13 November 2024) reports criminals who "combined GenAI images with stolen personal identifiable information (PII) or entirely fake PII" to create synthetic identities, and generated or altered images for driving licences and passports. Its red flags include photos inconsistent with date of birth, conflicting documents, third-party webcam plugins during live checks, refusal of MFA, reverse image matches to galleries of generated faces, device or location data inconsistent with documents, and new accounts with rapid transactions or high chargebacks. SARs should carry the key term FIN-2024-DEEPFAKEFRAUD. Liveness and injection detection are covered in the Deepfake and AI Impersonation Guide.
Finding synthetic customer accounts already on the book
- Link analysis across products: the Federal Reserve recommends "robust link analysis processes" looking for one SSN under several identities, several applications from one IP address or device, and identities appearing as authorised users on multiple accounts. Join card, deposit, loan and BNPL data; the 2020 paper urges institutions to "break down their internal barriers".
- Consortium data: "Consortium data is better than organization-level data in detecting trends." Section 314(b) of the USA PATRIOT Act lets participating US financial institutions share information on suspected money laundering under a safe harbour; take legal advice on scope.
- Bust-out early warning: limit increase requests followed by near-full utilisation across products, cash advances concentrated in a short window, and contact changes just before. Linked synthetics tend to bust out at about the same time, so one confirmed bust-out should trigger review of every account sharing an attribute with it.
- Loss classification: some institutions book synthetic losses as credit losses and others as fraud. Agree criteria (for example, an identity that fails eCBSV or shares attributes with a confirmed synthetic) so labels are consistent and feed models.
- Disputes: an identity theft claim on a charged-off account with synthetic indicators needs fraud investigation; a non-existent person cannot be a victim.
Authorised user tradelines and credit profile piggybacking
Adding an authorised user (AU) to a card is legitimate and common, for example a parent adding a child. Tradeline abuse misuses it to lend a synthetic a borrowed history. The Federal Reserve describes piggybacking as "adding a synthetic identity as an authorized user on an account belonging to another individual with good credit", sometimes onto older synthetic "sleepers". Lenders and issuers can see it through:
- Profile composition: the toolkit flags a "Credit profile consists primarily of authorized user tradelines and little to no individual liability accounts." Weight AU tradelines below liability accounts and score the ratio.
- Relationship plausibility: people with no common surname or city appearing as authorised users on several accounts, or primary cardholders adding several unrelated users who never activate a card.
- Issuer controls: limits on AU additions per period, identity data verification at addition, and review where AU additions cluster before those users apply elsewhere.
- Proportionality: families genuinely use AU tradelines to help thin-file members, so down-weight rather than decline.
Choosing controls by organisation type
| Control | Best at | Limits | Fits |
|---|---|---|---|
| eCBSV | Wrong name or date of birth on a real SSN; deceased SSNs | US only; permitted entities; consent; new accounts only | US banks, card issuers, lenders and processors |
| Bureau consistency checks | Age versus history, AU-heavy files, inquiry velocity | Thin files describe many genuine customers | Any lender |
| Consortium and link analysis | Shared attributes across institutions; sleepers | Sharing agreements, privacy basis | Larger institutions; smaller ones via a provider |
| Document authentication with liveness | Synthetic documents and generated faces | Friction; injection attacks; does not prove the SSN | Digital banks, fintechs, telecoms, crypto platforms |
| Post-onboarding behaviour models | Cultivation and bust-out patterns | Needs labelled data; loss may come first | Revolving credit, BNPL, overdrafts |
Smaller institutions such as credit unions gain most from eCBSV through a service provider, a consortium link service and simple rules for age versus history and AU-heavy files. Larger institutions need a cross-product identity graph and their own models, which the Federal Reserve notes "need frequent recalibration to remain effective". Telecoms, healthcare providers and benefits agencies cannot use eCBSV and rely on document, device and history checks.
How this maps outside the US
The UK's Good Practice Guide 45 states that "Synthetic identities can be fictional or based on a real identity" and builds two of its five parts around them: an activity history check that the identity has existed over time (interactions from the last 3 months up to 3 years), and an identity fraud check against authoritative sources for whether the identity is stolen or "suspected to be synthetic", belongs to someone alive and is known to a record-keeping organisation. It also says "A National Insurance number is not evidence of the claimed identity", mirroring NIST on SSNs. Where national identifiers are not credit keys, synthetic risk shifts towards forged or generated documents and fake account creation, so document checks, activity history and shared fraud databases carry more of the load.
Implementing a synthetic identity programme
- Define and label: adopt the Federal Reserve definition and three categories, agree synthetic charge-off criteria, and relabel two to three years of early-life and bust-out losses.
- Baseline: count accounts sharing an SSN, device, phone, email or address with another identity, and files dominated by AU tradelines.
- Add authoritative checks: enrol in eCBSV directly or through a provider, build consent capture, and add the SP 800-63A-4 death records check.
- Shadow mode: score applications for 4 to 8 weeks without acting, compare with outcomes, and measure the effect on thin-file and young applicants.
- Step up, do not decline: route mid-risk cases to document and liveness checks or review; decline only on hard failures the applicant cannot correct.
- Monitor the book: schedule cross-product link analysis and alert on AU and bust-out patterns.
- Roll back safely: version every rule and model, keep the previous one deployable, and revert if review volumes or declines for young applicants jump.
- Share and report: contribute confirmed synthetics to consortium data, use 314(b) where appropriate, and file SARs with relevant key terms.
Measuring whether it works
- Synthetic loss rate: confirmed synthetic losses as a share of credit and fraud losses.
- Detection stage: share of confirmed synthetics stopped at application, in cultivation, or only at bust-out; move detection earlier.
- Network yield: additional synthetic accounts found per confirmed synthetic.
- eCBSV outcomes: no-match and death-indicator rates, and how many no-matches prove fraudulent.
- Genuine customer impact: step-up and decline rates for thin-file, young and newly arrived applicants.
- Time to action: median time from first linked signal to restriction.
Framework and regulatory mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-63A-4 | Section 3.2.1 CSP fraud management | Death records check (SHALL); SIM swap, tenure, address, device and velocity checks (SHOULD); no KBV for verification |
| NIST SP 800-53 Rev 5 | IA-12 Identity Proofing; IA-12(2), IA-12(3) | Evidence collection, validation and verification |
| Federal Reserve | SIF definition, white papers, toolkit | Vocabulary, loss classification, red flags |
| SSA eCBSV | Pub. L. 115-174, Section 215 | Consent-based SSN, name and date of birth verification |
| FinCEN | FIN-2024-Alert004; USA PATRIOT Act s.314(b) | GenAI synthetic identities and SAR key term; information sharing |
| UK GPG 45 | Activity history and identity fraud checks | Non-US test that an identity has existed over time |
Common failure patterns
- Checking existence, not consistency: a bureau hit is taken as proof, when the file may have been created by the fraudster's own earlier applications.
- Booking bust-outs as credit losses: nobody looks for linked accounts, and the rest of the network busts out weeks later.
- Single-signal rules: declining every post-2011 SSN or thin file punishes young people and new arrivals, as the Federal Reserve warns, while fraudsters adapt.
- Siloed portfolios: each product team sees one well-behaved account; only a cross-product view shows the shared device and address.
- Relying on SSN knowledge or KBV: both are answerable from breached data.
- Ignoring disputes: identity theft claims on charged-off synthetic accounts are accepted and losses reversed.
Practitioner checklist
- Adopt the Federal Reserve definition and fabrication, manipulation and compilation labels.
- Agree criteria for classifying charge-offs as synthetic fraud and relabel historic losses.
- Use eCBSV (US financial institutions) with compliant consent, and run a death records check on every application.
- Score age against history, contact tenure, ported phones and risky addresses, without hard declines on one signal.
- Weight authorised user tradelines below liability accounts and monitor unrelated AU additions.
- Run cross-product and consortium link analysis, and review every account linked to a confirmed synthetic.
- Add the FIN-2024-Alert004 document and liveness red flags to digital onboarding.
- Pilot rules in shadow mode, measure thin-file impact and keep a tested rollback.
- Track detection stage, network yield and genuine customer impact monthly.
Standards and references
- Federal Reserve FedPayments Improvement: Synthetic Identity Fraud Defined
- Federal Reserve FedPayments Improvement: Synthetic Identity Fraud Mitigation Toolkit
- Federal Reserve: Detecting Synthetic Identity Payments Fraud
- Social Security Administration: Electronic Consent Based SSN Verification (eCBSV)
- Social Security Administration: Social Security Number Randomization
- NIST: SP 800-63A-4 Identity Proofing and Enrollment
- GOV.UK: How to prove and verify someone's identity (GPG 45)
- FinCEN: Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (FIN-2024-Alert004)
Related NHI Mgmt Group resources: Identity Fraud Prevention Guide · Identity Proofing and KYC Guide · Deepfake and AI Impersonation Guide · Fraud and Cyber Convergence Guide · Payment Fraud Guide