06/30/2025
Blog
Money 20/20: What's Behind the Rise in Synthetic Identity Fraud
Last October at Money 2020, the premiere event for financial services, identity and fraud were front and center as major challenges faced the industry. Specifically, synthetic identity fraud was again a hot topic — not surprising since this type of fraud is expected to generate at least US $23 billion in losses by 2030, according to the Deloitte Center for Financial Services.
What is synthetic identity fraud?
There’s no common definition for synthetics, even within the same organization. Synthetic identities are commonly understood as identity fabrication, compilation or manipulation. What further complicates a clear understanding of synthetic identities is recognizing there’s no single way bad actors perpetrate this fraud. Once an account is created with a synthetic identity, fraudsters may choose to immediately take the money — or they may maintain the account in good standing while building up credit history.
When synthetic accounts finally default, there’s also no common way financial institutions categorize this loss. For instance:
- Never pay default — A borrower fails to make any payments
- Early life defaults — A borrower stops making payments within the first six months
- Straight rollers — A credit card or loan account moves directly into default without the borrower making any payments
- Bust-outs — A borrower makes monthly payments until they max the loan amount and stop making payments, typically over a two-year time period
- Over-limits — Quick overextension of credit
With no agreed-upon definition and understanding of synthetic identity, the FedPayment Improvement initiative — part of the Federal Reserve Bank — undertook the task of coming up with a universal definition industry can use. That definition is: The use of a combination of personal identity information (PII) data to fabricate a person or entity in order to commit a dishonest act for personal or financial gain.
Without consistent categorization of the problems synthetic identities pose, financial services organizations don't necessarily track it properly, often simply bucketing it under credit risk losses. This lack of visibility limits most organizations’ abilities to understand the scope and scale of the problems they face, impacting loss prevention strategies.
What does a synthetic identity attack look like?
Synthetic identity fraud can be difficult to spot. Synthetic identities are crafted using a mix of real and fabricated data — often including stolen Social Security numbers (SSN), false names, digital contact details and legitimate-appearing behavioral histories. These identities are designed to appear credible, frequently evading traditional identity verification processes.
Synthetic identity fraud attacks are especially challenging to uncover because they start their journeys by applying for a low-level credit line, often springboarding to creditworthiness by becoming an authorized user on an existing person’s credit line. They then build positive credit history over time by using small amounts of credit and paying it off on time. They continue this process until they finally bust out; maxing out their available credit and disappearing.
How do synthetic identities happen?
A perfect storm around synthetics developed in the past decade:
- Data breaches: With tens of billions of records breached over the past decade, organized crime rings have an unprecedented amount of data at their disposal to fuel their identity-compilation and identity-manipulation efforts.
- Consumer social engineering scams: More than half (52%) of consumers reported being targeted by email, online, phone call or text messaging scams in Q4 2024. The most frequent scams reported by consumers included phishing, smishing and vishing; scams meant to steal personal information from consumers.
- SSN randomization: The Social Security Administration (SSA) used to issue sequential Social Security numbers (SSN) where the first three digits represented the location of the SSA office that assigned the number. This was a very useful tool for identifying SSNs validity. Unfortunately, rather than keeping a specific issuance formula based on the date and geographic region, the SSA began randomizing the issuance of SSNs in 2011 — thus eliminating the financial institutions’ abilities to check validity at the time of account onboarding.
- Organizations’ risk thresholds: Some organizations, be they lenders, telecommunications firms or gaming firms, set their own levels of acceptable risk for existing credit or payment terms. Organizations that serve higher-risk individuals (those with little to no credit history) are more exposed to synthetic identities than those originating credit for low-risk individuals. And once established at one organization, a criminal can use that synthetic identity to attack any organization.
- Credit repair: Credit repair agencies abounded over the past decade, offering credit profile numbers (CPN). They sold these nine-digit numbers to consumers with bad credit to “get a fresh start.” They’re also often used by undocumented immigrants to access credit. The intent is to obfuscate creditors’ inquiries to credit bureaus and establish new records for the consumer.
- Gen-AI deepfakes: Generative AI enables fraudsters to create fake documents and images, including driver’s licenses and passports, designed to fool organizations’ identity proofing tools. The issue is so serious the US Treasury FinCEN issued an alert about deepfake media to financial institutions late last year.
US data breaches increasing in volume and severity — fueling and shaping future fraud
According to TransUnion’s H1 2025 Update: State of Omnichannel Fraud Report, the number of data breaches in the US exceeded 16,000 over the past five years, expediting the access and sale of personally identifiable information to then create synthetic identities. While the volume of US data breaches rose to 3,092 in 2024, the average breach risk severity (the ability of a breach to enable identity fraud), as measured by TransUnion TruEmpower™ Breach Risk Score (BRS), increased 34%, its highest point ever since TransUnion initiated studies in 2020.Increasingly, cybercriminals have begun targeting third parties to acquire identity information; these are organizations that process data on behalf of the organization holding the consumer relationship.
How much is lost to synthetic identity fraud?
Synthetic fraud losses are often reported as charge-offs due to bad debt, so overall estimates vary widely. TransUnion’s internal analysis recently showed US lender exposure to synthetic identities for credit cards, auto loans, personal loans and retail cards totaled $3.3 billion in potential losses at the end of 2024. That’s an increase of 3% over the end of 2023 and an all-time high going back to TransUnion’s first measurement in 2009.
Based on the percentage (0.32%) of attempted account openings with synthetic identities, the market faces continued threat of charge-offs in the future. While auto loans continued to represent the largest exposure by trade, incidences of synthetic identities in bankcard credit inquiries was the highest among credit types analyzed, surpassing 1% at the end of 2024 — a first since TransUnion began reporting synthetic identity exposure.
While potential losses are worrisome, the fact much of synthetic identity fraud is written off as bad dept — meaning organizations often never uncover the synthetic identities behind these losses — makes them even more problematic and damaging.
How can financial institutions combat synthetic identity fraud?
Mitigating synthetic identity fraud requires a companywide effort within financial institutions. The federal government is trying to support industry solutions but with mixed results. The electronic Consent Based Social Security Number Verification (eCBSV) Service, for example, isn’t a silver bullet to protect organizations from synthetic identities. The system is limited by its requirement to match names exactly as they exist in SSA’s files. Submissions with small variances will not pass eCBSV checks, requiring financial institutions to verify identities some other way.
As mentioned, many organizations simply charge off losses from synthetic accounts as bad debit. However, these accounts represent a significant compliance challenge for organizations in regard to know your customer (KYC) and anti-money laundering (AML) regulations. To mitigate synthetics, organizations need to take a layered approach: combining identity verification, device-based risk assessment and portfolio reviews using a synthetic fraud model. By doing so, organizations can improve their abilities to detect suspected synthetic identities at the front door and take steps to prevent future losses.
Enhance your strategies for detecting synthetic identities before they open accounts.
Information for Good®.
Connect with us
