What is synthetic identity fraud?

Synthetic identity fraud combines a real person's stolen Social Security number with fabricated details to build a credit identity that belongs to nobody, which incubates for months of on-time payments before the fraudster maxes every credit line and disappears.

Author

Theodore Sterling

How synthetic identity fraud works

The fraudster pairs one stolen Social Security number with a made-up name, birth date, and address. Then they build that person a credit file. Each piece checks out on its own, so every field passes its lookup.

The attack runs in three stages:

Creation: pair a stolen Social Security number with fabricated personal details.
Incubation: open small accounts and pay them off to build real credit history.
Bust-out: max every available credit line at once, then vanish.

Incubation is what makes these identities hard to catch. For months the credit behavior looks like a careful new customer.

It is careful by design.

Experian describes fraudsters who incubate these identities for months or even years, then borrow big and disappear.

This fraud needs a deliberate fabrication behind the file. A typo'd digit on a real application is something else.

Why synthetic identity fraud matters for merchants

Synthetic identities cost more per incident than most fraud types. Nothing looks wrong until the bust-out. The loss lands all at once, and there is nobody to chase.

Standard Know Your Customer (KYC) checks confirm three things:

The name: it belongs to a real person on record.
The Social Security number: it was issued and is valid.
The match: the name, number, and address line up with each other.

Nobody built those checks to catch a person made of real parts. Every field traces to something real. The person as a whole traces to nobody.

Lenders take most of these losses. In unsecured consumer credit, Mitek and Datos Insights put 2025 US losses at $2.94 billion, up from $1.8 billion in 2020. They put the growth near 16% a year.

Sell low-ticket goods, and your share of this risk is smaller.

Run your own synthetic-fraud dispute count through our ROI calculator to see what those disputes are costing you.

You usually see it secondhand. An order ships, then reverses, because the credit line behind it was fraudulent.

Synthetic identity fraud vs. account takeover and true fraud

Synthetic identity fraud builds an identity, account takeover hijacks one, and true fraud steals one whole. Here is where each starts, with friendly fraud for contrast:

Fraud type	Whose identity	Where it starts
Account takeover	a real customer's, hijacked	an existing account login
True fraud	a real person's, stolen whole	a stolen card or identity at checkout
Synthetic identity fraud	nobody's, assembled from parts	a new credit application
Friendly fraud	the cardholder's own	a dispute after a real purchase

Each one defeats a different control. Takeover beats your login security, and true fraud beats identity verification.

A synthetic identity beats both at once. It pairs one verifiable data point with details nobody checks against history.

Card testing fraud is a separate category. It verifies a stolen card rather than building an identity.

Some synthetic identities never reach a bust-out at all. Their makers resell them as aged identities with real credit history. That is how one reaches a merchant who never saw the account open.

How to detect and reduce synthetic identity fraud risk

Catching a synthetic identity means checking whether the identity holds up over time. The signal is in the file's history rather than a single snapshot.

Three controls each target a different part of the pattern:

Credit-file age checks: flag a 2-year credit history on a 40-year-old applicant.
Device fingerprinting: flag one device reused across unrelated applications.
Velocity monitoring: flag an account drawing most of its credit inside a few days.

Identity vendors sell the first of these directly. LexisNexis Risk Solutions and Experian both run Social Security number history checks built for this pattern.

Each control gives the fraudster less time and makes each attempt cost more. Most move on to a softer target. The rest take far longer to get anywhere.

Say a fabricated identity buys from you and disputes the charge.

Our chargeback alerts reach you in time to refund first.

FAQ

Does it always need a stolen Social Security number?

No, an identity built from wholly made-up numbers still counts, though it's rarer and easier to catch. A real Social Security number is what lets the fake one pass checks long enough to build credit.

Is synthetic identity fraud the same as a fake account?

No, a fake account is a throwaway signup. A synthetic identity is a credit profile built over months to pass real verification.

Who ends up liable for synthetic identity fraud losses?

Whoever extended the credit usually absorbs it, because no real consumer exists to file a claim. That is why these losses often sit in write-offs rather than fraud reports.