Synthetic Identity Fraud in the USA: Stop It With Layered KYC

Synthetic identity fraud is the fastest-growing financial crime in the United States. Unlike stolen-identity fraud, it does not impersonate a single real person. Instead, criminals stitch together real and fabricated data — a valid Social Security Number paired with a fictitious name and date of birth — to create a persona that passes many single-point checks. The Federal Reserve has flagged it as a persistent driver of account opening fraud, and the losses are difficult to trace because there is no victim who reports the activity.

How synthetic identity fraud actually works

The construction of a synthetic identity usually follows a predictable sequence:

• Seed the identity: Fraudsters obtain an unused SSN, often one issued to a child or a person with no credit history, since SSNs became randomized in 2011 and are harder to validate by issuance pattern.
• Attach fabricated attributes: A name, address, and date of birth that do not match any real record are combined with the SSN.
• Cultivate credit: The persona applies for credit repeatedly. Early denials still generate a credit file. Authorized-user tradelines and small approvals build a thin but real profile.
• Bust out: After months of on-time behavior, the identity draws maximum credit across accounts and disappears — leaving lenders and fintechs holding the loss.

Because the SSN is genuine, basic SSN verification against a name may return a partial match, and traditional credit checks reward the manufactured history. That is why any single control fails.

Why single-point identity verification in the USA falls short

Regulators expect institutions to form a reasonable belief that they know the true identity of each customer under the Customer Identification Program rules issued under the Bank Secrecy Act and enforced by FinCEN. But CIP compliance is a floor, not a guarantee against synthetic personas. A document that looks valid, an address that resolves, and an SSN that pings positive can all coexist in a fabricated identity. Effective identity verification in the USA requires correlating attributes across independent sources rather than trusting any one of them in isolation.

Layered controls for fraud prevention in fintech

Strong fraud prevention for fintech teams treats verification as a stack, where each layer catches what the previous one misses:

• Document verification: Capture a government-issued ID, check security features, and match the extracted data to the applicant. Pair it with a liveness selfie to defeat borrowed or edited images.
• SSN and attribute correlation: Confirm that the SSN, name, and date of birth are consistent with authoritative records — not just internally consistent.
• Device and behavioral signals: Flag device farms, velocity across applications, and reused metadata that suggest coordinated account opening fraud.
• Ongoing monitoring: Synthetic identities often behave normally before a bust-out, so post-onboarding transaction monitoring under BSA/AML obligations remains essential.

A chat-based onboarding flow can orchestrate these steps in sequence, requesting the document, the selfie, and consent for SSN checks within a single conversation while collecting only the data each step requires.

eCBSV: authoritative SSN verification at the source

The Social Security Administration operates the eCBSV — the Electronic Consent Based Social Security Number Verification service — created under Section 215 of the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018. With the customer's written consent, a permitted entity submits the SSN, name, and date of birth and receives a yes/no match indicating whether they align with SSA records, plus a death indicator. eCBSV does not return underlying data, which supports data minimization. It directly attacks synthetic identities because a fabricated name-and-DOB attached to a real SSN returns a mismatch. Consent handling and the Fair Credit Reporting Act should be reviewed with counsel, as this is general information rather than legal advice.

Building durable defenses

No single check stops synthetic identity fraud. The combination — document verification, authoritative SSN verification through eCBSV, behavioral analytics, and continuous monitoring — raises the cost of fabricating a persona beyond what most fraud rings will absorb. When these controls run through a conversational verification flow with configurable retention, institutions can meet CIP expectations while limiting the personal data they store. That balance — thorough verification, minimal footprint — is where effective fraud prevention and privacy meet.