The Fraud With No Victim to Call

Most fraud training draws a clean line. Identity theft on one side, where a real person’s identity gets used without consent. Identity fabrication on the other, where the person is entirely invented.

Synthetic identity fraud lives in the gap, which is precisely why it is so hard to catch. It borrows just enough real data to pass verification and invents just enough fiction to be untraceable to any actual victim.

What it actually looks like

A typical synthetic identity pairs a genuine, valid identifier — most often a Social Security number or national ID number, and frequently one belonging to a child, an incarcerated person or someone deceased — with a fabricated name, date of birth and address. Supporting documents are either generated from scratch or built from breached template data. And because no real victim is sitting there watching credit reports or account statements, it can run undetected for a very long time.

That time is the point. These identities are built to be aged, not used:

• Seasoning. The identity applies for low-limit, high-approval products — a secured card, a subprime retail card, sometimes a prepaid account — and pays them on time for months. Sometimes years.
• Piggybacking. Where possible it gets added as an authorised user on an existing account with a strong payment history, inheriting that history to accelerate its own credit profile.
• Bust-out. Once it has enough history and limit to look legitimate, it maxes every line it can reach — cards, loans, credit lines — inside a short window, and disappears.

By the time anyone notices, there is no real owner to pursue, no real address, and often no real photograph on file mapping to an actual missing person. It simply stops being used.

One note on jurisdiction, because this typology travels badly. The classic seasoning-then-bust-out version is documented most extensively in the US market, largely because US consumer credit underwriting leans so heavily on the credit bureaus — Experian, Equifax, TransUnion — and on a single national identifier, the Social Security number, which doubles as a de facto identity key across the whole financial system. The UK equivalent behaves differently. NI numbers aren’t used as a credit-file key in the same way, and UK credit referencing agencies build files differently. In UK and EU practice the same underlying technique, a real identifier plus fabricated supporting details, aged deliberately, shows up more often in bank and e-money account onboarding fraud than in the revolving-credit bust-out pattern above. The detection principle holds either way, since a file that looks clean at onboarding but was never a real person accumulates identically. But the red flags below are written from the credit-bureau version, and the mechanics are worth adapting rather than assuming they transfer.

Generative AI didn’t create this typology. It removed the bottleneck

Synthetic identity fraud has existed for decades. What changed in the last two or three years is the cost of the hardest step.

That step was producing a full, internally consistent set of supporting documents — utility bill, payslip, bank statement — all agreeing on the same fabricated name and address, with correct fonts, correct layouts and correct institutional branding for whichever provider is being impersonated. It used to require either real design skill or a criminal supply chain selling templates. Generative AI collapses it to a prompt.

The consequence is more distinct fraud, not simply more of it.

A criminal operation forging documents by hand reuses templates, because building each one from scratch is expensive. Reused templates are exactly the pattern-matching signal fraud teams learn to catch. Remove the constraint and every document can be uniquely generated, so the “same template across twelve applicants” tell decays over time even while the volume of synthetic identities being seeded goes up. Detection has to shift accordingly, away from document-matching and toward the behavioural and network indicators below, which don’t depend on the attacker being lazy or short of resources.

Why it evades the controls built for other fraud types

Conventional fraud detection hunts for mismatch. A name that doesn’t match an SSN. A device that doesn’t match a claimed location. A document that doesn’t match a face.

Synthetic identity fraud is engineered to minimise mismatch over time. The SSN is real, just misused. The payment history is real, because the fraudster genuinely pays the bills during seasoning. And the behavioural pattern looks exactly like a thin-file consumer building credit for the first time — which, in a sense, is precisely the profile it was designed to imitate.

Which is also why it correlates so strongly with thin-file and credit-invisible populations as cover. New-to-credit applicants are expected to look like this, and that makes the typology hard to separate from ordinary first-time applicants without additional signal.

A red flag that quietly stopped working in 2011, and most training material hasn’t caught up

For decades one of the more reliable checks was comparing an SSN’s first three digits, the “area number”, against the applicant’s claimed birth state and approximate birth year, because the Social Security Administration issued numbers geographically and sequentially. An SSN whose issuance pattern didn’t fit the applicant’s stated age or origin was a strong tell.

It broke on 25 June 2011.

That was when the SSA switched to full randomisation, specifically to stop SSNs being guessable or inferable. Area numbers stopped mapping to any state. Issuance order stopped mapping to any timeframe. For any SSN generated after that date, the check returns nothing.

Here is the consequence most analysts don’t connect. Synthetic identities built around a child’s SSN — one of the most common source identifiers, precisely because a minor’s credit file sits dormant and unmonitored for years — are now built almost entirely from post-2011 numbers. So the exact red flag a decade of training material teaches you to check no longer applies to the exact population most likely to be targeted by it.

There is no smarter SSN check waiting to replace it. There isn’t one. What replaces it is leaning harder on the behavioural and network indicators below, because the document-level tell that used to do this job is gone.

Other red flags that hold up better than name/SSN matching

• A credit file with no linkage to any prior address, employer or phone number predating the account relationship. A synthetic identity’s history tends to start abruptly rather than accumulating the way a real consumer’s financial footprint does.
• Authorised-user additions inflating credit history disproportionately relative to the primary account’s own applicant profile.
• Clustering across “unrelated” applicants sharing a device, IP range or mailing address, often a mail drop or a vacant property. These operations rarely run one identity in isolation, because the unit economics need volume.
• On-time, low-balance activity showing no organic life event. No fluctuation for seasonal spending, no missed payment during a plausible hardship. The seasoning behaviour is scripted rather than lived, and scripts don’t have bad months.

What this means for how you review a file

Synthetic identity review cannot stop at onboarding.

A file that looks clean at account opening can still be synthetic, and the tell is usually only visible in the pattern of account behaviour over the following months — which means CDD and transaction monitoring have to stay linked rather than being treated as separate stages with a handoff between them. If your organisation treats “passed KYC at onboarding” as a closed question, this is specifically the typology that will get through. It was built, deliberately, to pass exactly that gate.