Synthetic Identity Fraud

Overview

Synthetic Identity Fraud is fraud involving an identity assembled from fabricated information, real personal data belonging to one or more people, or both, and used to create apparently legitimate accounts or credit histories. It differs from straightforward identity theft because the presented identity may not correspond to one real person. It should be interpreted alongside Document Fraud, which may affect the same workflow without representing the same control, event, or risk.

Fraudsters may cultivate accounts over time, exploit inconsistent verification, use mule addresses or devices, obtain credit, process payments, and disappear after trust increases.

Organizations should use layered identity verification, document and data consistency checks, device and network intelligence, velocity controls, graph analysis, behavioral monitoring, and manual escalation.

Retain identity attributes, verification sources, document results, linked accounts, devices, addresses, payment instruments, behavior patterns, analyst rationale, and confirmed outcomes.

Operational review of Synthetic Identity Fraud should reconstruct fraud involving an identity assembled from fabricated information, real personal data belonging to one or more people, or both, and used to create apparently legitimate accounts or credit histories using the identities, communications, devices, and transaction records available for the affected case. Investigators should separate confirmed facts from hypotheses about real personal data belonging to one, more people, and both, preserve the original evidence, and document why the event was cleared, escalated, or treated as a loss. Containment, recovery, and customer communication for the Synthetic Identity fraud pattern should match the harm indicated by real personal data belonging to one, more people, and both.

Quality review for Synthetic Identity Fraud should compare expected and actual outcomes involving real personal data belonging to one, more people, and both, then track false positives, repeat attempts, linked losses, and unresolved remediation.