Synthetic Identity Fraud: US Definitions, Signals and What Document and Face Checks Can and Cannot Catch
How US authorities define synthetic identity fraud, the signals they describe, the SSA verification service, and which parts of the problem document and face checks can address.
A document check asks whether the document in front of it is genuine and consistent. A face check asks whether the person in front of the camera matches the portrait. Neither asks the question that a synthetic identity is built to survive: whether the person described by the record exists at all. That difference is why synthetic identity fraud is treated by the American authorities as a problem of its own, with its own definition, its own signals and its own data-verification service, and why onboarding checks are one layer of the answer and not the whole of it.
For information; not legal advice.
This article reads the primary documents of five United States bodies: the Federal Reserve, the Financial Crimes Enforcement Network (FinCEN), the Social Security Administration (SSA), the Government Accountability Office (GAO) and the National Institute of Standards and Technology. It reports what they say, flags where a sentence is our own reasoning, and gives no detection rate for any check. Related reading: how to read fraud statistics, forged document classes and presentation attacks and deepfakes.
What the American authorities mean by the term
The Federal Reserve launched an initiative in 2018 to raise awareness of the problem and has since published white papers, a definition and a mitigation toolkit. The authorities use close but not identical wording, and the differences are worth seeing.
The Federal Reserve convened a focus group of 12 fraud experts, working from fall 2020 to early 2021, to recommend a common definition. Their definition is that synthetic identity fraud is the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain. The Federal Reserve says adoption is voluntary and that the definition does not create any regulatory or reporting requirement or confer any legal status. The focus group divided the information used to build a synthetic identity into two kinds. Primary elements are those that are, in combination, typically unique to an individual or profile, such as name, date of birth, Social Security number and other government-issued identifiers. Supplemental elements help substantiate or enhance the validity of an identity but cannot establish one by themselves, such as a mailing or billing address, phone number, email address or digital footprint.
The Federal Reserve's earlier description, in its press release of 9 July 2019 for its first white paper, was more concrete: a synthetic identity is created by combining real information, such as a legitimate Social Security number, with fictional information, which can include a made-up name, address or date of birth. The release adds that fraudsters increasingly use such identities to commit payments fraud that can escape detection by identity verification and credit-screening processes in use at the time.
GAO, in a report of September 2024, describes the fraud as combining made-up and real information to fake an identity. FinCEN, in its 2024 trend analysis of Bank Secrecy Act data from 2021, uses the same sense and places the typology in the step it calls validation: perpetrators of synthetic identity use a combination of real and fake personal information to fabricate a person or entity so as to pass validation processes. The glossary of SP 800-63A-4 defines it as the use of a combination of personal information to fabricate a person or entity to commit a dishonest act for personal or financial gain, and its threat table describes the attacker as fabricating evidence of an identity that is not associated with a real person.
Two things follow for a reader. The word "synthetic" does not mean AI-generated. In all the sources above it means a fabricated person assembled from elements, some of which may be real and belong to somebody else. And it differs from identity theft, in which a fraudster pretends to be another real person and uses their credit, which the Federal Reserve says is typically detected and reported more quickly because the victim notices unusual charges.
The life cycle that makes it costly
The Federal Reserve's October 2019 white paper on detection describes the sequence in four steps. The fraudster submits an application for credit, which causes a credit bureau to create a credit file and so, in the paper's words, a sort of proof that the identity exists. The fraudster applies repeatedly until approved. The fraudster then legitimises the identity and raises its creditworthiness. Finally the fraudster "busts out", maxing out the credit without intent to repay, and vanishes.
Between the second and third steps the identity may sit quietly. The paper says synthetics can be nurtured for months and sometimes years, with small purchases paid off to build a repayment history, and that once inside a lender's portfolio they initially look and behave like normal customers. It names piggybacking as one tactic: adding the synthetic identity as an authorised user on an account that belongs to a person with good credit, so that the synthetic takes on the established history. It also describes ways to multiply the payout, for example claiming that the fictitious identity was the victim of identity theft so that charges are reversed and credit lines reopened.
Two consequences matter for anyone who designs controls. The paper says the loss is often categorised as a credit loss, because the account looks like a non-paying customer, and that when the institution tries to collect there is no real person to find. So the first problem is that the institution may not know it has been defrauded by a synthetic identity at all. And the paper says fraudsters seek to pass know-your-customer tests by making the identity appear valid, including by fabricating identification credentials, social media profiles and other documentation. It adds that, according to a commercial study cited by the Federal Reserve, only half of synthetics apply for credit using digital channels, and some apply in person to look real. That is the Federal Reserve's reason for saying vigilance is needed even where an institution can verify an applicant in person.
The signals the Federal Reserve describes
The same paper recommends going beyond verifying static identity elements to looking for unusual recurring patterns and relationships between transactions. Its examples of characteristics of synthetic identities are these.
| Signal | What the paper says |
|---|---|
| Credit file depth inconsistent with the customer profile | An applicant aged 40 with a credit file of six months is the paper's example of an anomaly in identity elements |
| Social Security numbers issued after 2011 | The SSA began randomising number assignment in 2011, which removed the geographic meaning of the first digits and the predictable sequence of the rest |
| Multiple applicants with the same address or phone number | Listed as a characteristic, and as a way of finding fraud networks |
| Multiple accounts from the same IP address or device | Listed as a characteristic of synthetic activity |
| Multiple authorised users on the same account | Dozens of individuals added as authorised users on one card is cited as an indicator of synthetics piggybacking on one another |
| Use of secured credit lines to build credit | Listed as a characteristic |
The paper attaches a caution to the first row. Looking only at the length of a credit history could unnecessarily disadvantage or deny credit to legitimate customers such as immigrants and formerly impoverished or incarcerated people who only recently gained access to credit. Its conclusion is to aggregate multiple data sets and connect multiple customer characteristics. We repeat the caution because a signal that is a fraud indicator for one population is an ordinary life circumstance for another, and an onboarding flow that rejects on a single signal turns a fraud control into an inclusion problem.
What the numbers do and do not tell you
The figures in circulation come from different sources with different definitions, and the Federal Reserve says plainly that the full impact is hard to measure because of differing definitions and approaches to detection.
| Figure | Source and year | Definition and caution |
|---|---|---|
| About 3,000 reports and $182 million in suspicious activity | FinCEN Financial Trend Analysis, Bank Secrecy Act data for January to December 2021 | Reports in which the synthetic identity typology was identified, within about 1.6 million identity-related reports out of about 3.8 million in total; FinCEN says the data are not a complete representation of identity-related suspicious activity |
| $182 million in suspicious activity in 2021 | GAO-24-106770, September 2024 | The same 2021 figure, given as what financial institutions reported |
The first two rows give the same number for the same year, so they should not be counted as two confirmations. Reported suspicious activity is also a floor and not a census, because the Federal Reserve notes that these losses are often miscategorised as credit losses and so never appear as fraud. Identity fraud statistics: how to read the numbers goes through this kind of reading in more general terms.
The data service the Social Security Administration built
Section 215 of the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 directed the SSA to develop a database for accepting and comparing fraud protection data provided electronically by a permitted entity, and the SSA created in response the electronic Consent Based Social Security Number Verification service, known as eCBSV. The service allows a permitted entity to verify whether an individual's Social Security number, name and date of birth combination matches SSA records. It needs the number holder's written consent, by wet or electronic signature. It returns a yes or no match, with explanatory information identifying the data elements that do not match, and an indication of death if that is in the records. A permitted entity is a financial institution as defined in the Gramm-Leach-Bliley Act, or a service provider, subsidiary, affiliate, agent, subcontractor or assignee of one.
GAO reviewed the service in a report of September 2024. It records that the service launched in June 2020 and that the SSA spent about $62 million on it from fiscal year 2018 through fiscal year 2023. It found that participation was lower than expected and that industry participants it interviewed, 16 in number, cited factors limiting their use, among them verification results that are difficult to interpret. GAO made seven recommendations, including strategies to expand use and performance measures. We report this because it is a US federal agency's own account of a data check aimed at synthetic identities: it exists, it is narrow in what it compares, and the audit found that its uptake and its output were limits.
Our reading of what the service does and does not answer is this. A yes means the submitted combination of number, name and date of birth matches SSA records; obtaining and evidencing the number holder's written consent is a separate obligation of the user of the service, and a yes does not say the person at the keyboard is the holder. A no is informative where a fraudster has paired a real number with an invented name or date of birth, which is the pattern in the Federal Reserve's description, and says nothing about the elements outside the check, such as address, phone and device.
What the US identity proofing publication says
SP 800-63A-4 lists synthetic identity fraud as one of the threats to identity proofing, defined as the attacker fabricating evidence of an identity that is not associated with a real person, with a credit card opened under a fake name to create a credit file as its example. Its threat table pairs this threat with controls: collection of identity evidence, validation of core attributes with authoritative or credible sources, biometric comparison of the applicant to validated identity evidence or biometric data, and checks against vital statistics repositories. It requires a check that the applicant is not deceased, confirmed with a credible, authoritative or issuing source, and says such checks can aid in preventing synthetic identity fraud. And it calls credible and authoritative sources an essential step in preventing synthetic identity attacks, while warning that sources can introduce inaccuracies, particularly when one source is relied upon for a large volume of users. Note the pairing: the biometric comparison appears in the list alongside, not instead of, the validation against authoritative sources.
What document checks and face checks can and cannot address
The division below is our reasoning from the sources above. It is stated at the level of what a type of check examines, and carries no rate for any product.
| Check | What it examines | What it can help show | What it cannot show on its own |
|---|---|---|---|
| Document inspection of the visual features and the machine readable zone | The document and the consistency of its data | That the document looks genuine and that its printed data are internally consistent; evidence of forgery or alteration | Whether the person described exists beyond the document, or what credit history sits behind the name |
| Reading the chip of an electronic document | The data stored in the chip | That the data come from the chip and not from a photograph of the document | The same limit: the chip carries what its issuer recorded, and says nothing about other accounts opened with those data elsewhere |
| Face comparison with the document portrait | The match between the live capture and the portrait | That the person presenting resembles the portrait | That the portrait belongs to a person with a real record; nor, by itself, whether the same face appears under several names |
| Liveness or capture-integrity checks | Whether a live person or an attack is at the camera | That the capture was not a replay or a presentation instrument, within the limits described in the attack articles | Anything about the identity behind the face |
| Validation of attributes against authoritative sources | Whether claimed data match records held by a source | That a combination of claimed elements exists in a record, such as the SSA's check of number, name and date of birth | That the applicant is the holder, unless paired with a document and face step |
| Cross-application and network signals | Shared addresses, phones, devices, authorised users | Links among identities that look unrelated one by one, which are the patterns in the Federal Reserve table | A single fabricated identity that has not yet been linked to anything |
Four observations follow. First, the document and face checks are strongest on the cases where the fabricated identity is carried by a forged or altered document, or where someone other than the portrait's owner is presenting, and the Federal Reserve confirms that fabricating identification credentials is part of the tactic. Second, they have nothing to say about a synthetic identity that is presented on a document that passes inspection, or whose first appearance is a credit file and not a document, and the Federal Reserve says synthetics are reported more likely to appear first when applying for credit. Third, onboarding is a single moment, and the Federal Reserve's account of sleeper accounts is a story about months and years, so a control that works at the moment of opening cannot by itself address an identity that earns trust afterwards. Fourth, the publication's pairing of evidence, validation, biometric comparison and records checks is an argument for layers, in which each layer answers a different question.
NeuroVision reads the NFC chip of identity documents. By the table above, that gives a stronger statement about where the document data came from, and it does not by itself say whether the identity has a record behind it; our article on NFC chip verification covers what the chip does establish.
A signal review procedure
The Federal Reserve gives the signals but not a working procedure, so the following is ours, built on its list. It is meant for a periodic review of newly opened accounts, run by people who can see the application data.
- Take the accounts opened in the review period and mark, for each, the primary elements and the supplemental elements, as the Federal Reserve's definition divides them.
- Group the accounts that share a supplemental element: the same address, phone number, device or IP address.
- Within each group look for several different names or numbers, which is the pattern of multiple applicants at one address or phone.
- Check each account for an authorised-user link to an account of another person, and flag accounts that share many such links.
- Compare the depth of any credit file with the age of the applicant, and note the use of secured credit lines.
- Treat a single signal as a reason to look, not a reason to reject, because the paper warns that one characteristic alone produces false positives.
- Record the reviewer's conclusion and the classification of any later loss as fraud or credit loss, and feed both back into the onboarding rules.
Questions for a lender or a supplier
These are questions to ask, and each is written so that the answer is a description and not a rate.
- Which fabricated-identity cases is the document step designed to catch, and which does its documentation say it does not address?
- Does the flow validate any claimed attribute against an authoritative source, and how is a mismatch shown to the reviewer?
- Can the system link applications that share an address, phone, device or face under different names, and who looks at the links?
- What happens to an applicant who fails one signal, such as a thin file, and is there a route that does not treat a recent arrival as a fraud?
- How are losses that start as fabricated identities classified after a bust-out, and who reviews the classification?
- Is there a feedback loop from later fraud findings to the onboarding decision, so that a bust-out changes the rules that let the identity in?
- Where an attribute check is used, how are non-matches explained to the reviewer, given the audit finding that results can be difficult to interpret?
- What is retained from the session, and for how long, in light of the data protection duties covered in our articles on retention and erasure?
To discuss mapping your controls against these signals, contact the team.
Sources
All sources were fetched on 28 October 2026.
- Synthetic Identity Fraud, FedPayments Improvement, Federal Reserve.
- Synthetic Identity Fraud Defined, FedPayments Improvement, Federal Reserve.
- Federal Reserve System white paper examines the effects of synthetic identity payments fraud, press release, Board of Governors of the Federal Reserve System, 9 July 2019.
- Detecting Synthetic Identity Fraud in the U.S. Payment System, Payments Fraud Insights, Federal Reserve Banks, October 2019.
- Identity-Related Suspicious Activity: 2021 Threats and Trends, Financial Trend Analysis, Financial Crimes Enforcement Network, January 2024.
- eCBSV Home, Data Exchange, Social Security Administration.
- Social Security Administration: Actions Needed to Help Ensure Success of Electronic Verification Service, GAO-24-106770, Government Accountability Office, published 10 September 2024.
- Special Publication 800-63A-4, Digital Identity Guidelines: Identity Proofing and Enrollment, National Institute of Standards and Technology, page dated 26 August 2025.