Synthetic Identity Fraud: Detecting People Who Don't Exist

Most fraud controls assume a real person is either who they claim to be or someone else. Synthetic identity fraud breaks that assumption. The applicant is nobody — a composite stitched from a valid identifier, invented attributes, and a slowly built history. Because no consumer is impersonated, there is often no victim to file a complaint, and the account can operate for months before the loss surfaces. This makes synthetics one of the hardest cases for a KYC flow to catch.

How a Synthetic Identity Is Built

The typical construction starts with one anchor that verifies cleanly, then layers fabricated data around it. Common patterns include:

• Real identifier, fake owner: a valid national ID or tax number belonging to someone who won't notice — often a minor, a deceased person, or someone with a thin file.
• Plausible but assembled PII: a name, date of birth, and address that individually look normal but have never appeared together before.
• Manufactured history: the fraudster opens a low-limit product, uses it responsibly, and lets a credit or transaction profile accumulate.
• Aging: the identity sits dormant for 6 to 18 months so that by the time it applies for meaningful credit, it looks established.

The result passes document checks and single-attribute lookups because each piece is technically real or technically valid. The weakness is in the relationships between the attributes, not the attributes themselves.

Signals That Expose a Composite

Detection improves sharply when you evaluate correlation rather than individual fields. Useful indicators during onboarding:

• Identifier-to-identity mismatch: a tax or national ID that was issued in a year inconsistent with the claimed date of birth, or tied historically to a different name.
• Sparse footprint: a name and address combination with no prior presence across records that a genuine adult would normally generate.
• Shared attributes across accounts: the same phone, device, or address recurring under different identities — a strong marker of a fraud ring operating at scale.
• Velocity clustering: multiple applications with slight PII variations submitted in a short window.
• Behavioral flatness: a session that fills fields with unusual speed and precision, or reuses copied values, rather than the friction a real person shows entering their own details.

No single signal is conclusive. Synthetics are caught by the combination — an identifier that doesn't correlate with the stated birth year, plus a device seen on three other applications, plus a name with no history. A chat-based flow can gather these signals conversationally without demanding extra documents, keeping data collection proportionate to the risk observed.

Why Document Checks Alone Fall Short

A synthetic often presents no forged document at all, or presents a genuine document for the anchor identifier. Tampering detection and face match remain essential against impersonation, but they do not answer the question a synthetic poses: does this person exist as a coherent whole? That requires cross-referencing attributes against each other and against historical presence, then scoring the coherence. Treat the document as one input among several, not the final word. When correlation checks raise doubt, escalating to a targeted request — a second identifier, or evidence linking the applicant to the claimed address — resolves ambiguity without punishing legitimate thin-file users.

Building It Into the Flow Privately

Correlation checks tempt teams to hoard data "just in case," which raises both privacy exposure and breach liability. The better approach is to run the checks, keep the decision and the signals that drove it, and discard raw lookups you no longer need. Configurable retention lets you hold correlation evidence only as long as your risk and audit obligations require. Log which attributes were compared and the outcome, so a later review can reconstruct the reasoning. For general background on layered onboarding controls, see our other posts on device and phone intelligence. This is general information, not legal advice — calibrate thresholds to your own regulatory obligations.