US detection of synthetic identities has shifted at three points in seven years.
- July 2019. A Federal Reserve white paper reported an ID Analytics estimate that 85 to 95 percent of applicants identified as synthetic "were not flagged as high risk by traditional fraud models" (Fed, July 2019, p. 6).
- 7 April 2025. The Social Security Administration (SSA) made its second fee cut of the year for its electronic Consent Based SSN Verification (eCBSV) service, taking the first tier from $6,650 to $5,100 a year (SSA notice).
- 20 October 2026. TransUnion launched synthetic fraud scores that carry adverse action reason codes, so a lender can cite them when it declines (TransUnion).
By definition, synthetic identity fraud (SIF) uses a person who does not exist, built from real and invented personally identifiable information (PII), such as a child's Social Security number (SSN) paired with a made up name.
Such a fake identity is built to pass the application fraud checks on the first form, so fraud detection and prevention has to follow it in layers from the application to collections.
Why do crafted synthetic identities pass onboarding checks?
Take one application at an illustrative card issuer. Name, SSN and date of birth agree with each other at the credit bureau. The file is 14 months old and carries three authorized user lines on other people's cards. The email address was opened four months ago, and the device behind the form sent two other applications this week.
Every field passes. When a lender makes the first inquiry on an identity with no history, the bureau creates a file, even if that application is declined (Fed, July 2019, p. 10). The Fed's 2020 paper warns that a file "can seem to imply 'proof of life'" without proving anything of the kind (Fed, July 2020, p. 17).
Most fraud controls were designed to catch a real customer being impersonated. The Fed's mitigation toolkit puts the gap in one line: "Most traditional fraud models are not built around the idea that a person is not real."
A stolen identity tends to come to light when its owner sees an account or a bill. A synthetic has no owner watching the file, so detection rests on depth and links. Real people, the Boston Fed writes, have longtime email addresses and phone numbers and lengthy credit histories, while synthetic identities are shallow. The same article cites FiVerity's estimate that losses crossed $35 billion in 2023.
Which detection layers catch a synthetic identity, and what does each miss?
Table 1 compares eight. If you lend in the US, read the last column first: it asks whether the layer's output can be stated as the reason for a decline.
Table 1. Eight detection layers: what each sees and misses (as of 2 November 2026; the last column is this page's reading of whether the output names a fact a lender can state)
| Layer | Sees | Misses | When it runs | Gives a specific decline reason? |
|---|---|---|---|---|
| eCBSV (SSA) | Whether SSN, name and date of birth match SSA records, with consent | Who is typing; a stolen real identity matches | Application, for a credit transaction or another section 604 purpose | Yes: a no match is a stated fact |
| Bureau file tests | File age and depth against stated age; inquiries; authorized user lines | Real thin files, such as those of recent immigrants | Application and account review | Yes: each test is one named fact |
| Bureau synthetic scores | A bureau model's synthetic score; TransUnion's of 20 October 2026 carries reason codes | Device, behavior and links outside bureau data | Application, at the credit pull | Yes, where reason codes come with the score |
| Rules | Named conditions, such as an SSN issued after 2011 or one phone number on many applications (Fed, July 2020, p. 5) | Any pattern nobody has written down | Every event | Yes: the rule that fired |
| Link analysis | SSN, IP address or device shared across applications, and identities that are authorized users on many accounts (p. 8) | A synthetic that reuses nothing | New links and batch review | Yes: the shared attribute |
| Machine learning | Patterns across many fields; one credit union's beta flagged about 85 percent of synthetic applications (p. 10) | Patterns missing from its training labels | Every scored event | Only if the model names its drivers |
| Device and behavior | Device or location data that do not fit the identity documents (FinCEN deepfake alert, p. 6); one device behind many applications | A clean device bought for one identity | Every session | Yes, when the score lists its drivers |
| Consortium and 314(b) | Other institutions' signals on the same device, IP address or similar identifying details (FinCEN 314(b) fact sheet, p. 3) | Patterns no member has confirmed yet | Lookup during a case; 314(b) in real time | Informs review; your own facts carry the decision |
Regulation B governs that last column. A creditor that takes adverse action owes the applicant "a statement of specific reasons", in the notice or on a request made within 60 days of it, and saying the applicant failed to reach a qualifying score is "insufficient" (12 CFR 1002.9(a)(2) and (b)(2)). A suspected synthetic may turn out to be a real person with a short history, so the reason given has to be a fact, such as a mismatch or a shared device. The CFPB withdrew its 2022 circular on adverse action and complex algorithms on 12 May 2025 (withdrawal notice), while the regulation itself still stands.
On complead, formerly Sanction Scanner, onboarding, screening, monitoring, fraud prevention and investigations run on one engine, complead Fusion, so each customer has one risk score rather than one per tool. Every alert lists the rule that fired and the signals that matched, which is the fact an adverse action notice needs. An analyst makes the decision, and the case record names that analyst.
Which 2026 updates matter for synthetic identity detection?
- 12 June. FinCEN's updated 314(b) fact sheet confirms that participating institutions can share information on suspected fraud under the safe harbor and lists device identification numbers, IP addresses and "multiple accounts with the same or similar identifying information" among its examples (FinCEN, pp. 3, 4).
- June. In TransUnion's business fraud survey, 18 percent of US business leaders named synthetic identity fraud their largest source of fraud losses in the past year. In the same release, 67 percent expect it to grow over the next two years and 53 percent call it the threat they are least prepared for. Worldwide, 81 percent of suspected digital fraud in the first half took place in interactions with existing customers (TransUnion, 22 October 2026).
- 30 June. TransUnion puts US lender exposure tied to synthetic identities at $2.4 billion as of this date.
How do you validate an identity with eCBSV and credit bureau data?
With the number holder's consent, SSA's eCBSV service tells a permitted entity whether an SSN, name and date of birth match SSA's records. The request must be tied to a credit transaction or another purpose in section 604 of the Fair Credit Reporting Act (SSA notice of 17 January 2025). That notice added two tiers, of 75,000 and 500,000 checks. Small and medium users can now connect directly instead of through a third party service. Since 7 April 2025 the first tier, up to 10,000 checks, costs $5,100 a year; the top tier, up to 200 million, costs $5,878,125.
Run the applicant from the first section through both. The bureau returns a match, because its file grew out of the applicant's own inquiries. SSA returns no match. The number belongs to a child under another name. The Fed's 2020 paper said eCBSV "only allows for customer information validation for new accounts" (p. 15), so read your user agreement before you run it on the existing book.
A yes from SSA means three fields belong together. Who typed them is a separate question. Identity verification adds a document and a selfie, which tie a face to a document, and FinCEN's deepfake alert warns of third party webcam plugins that can show previously generated video in place of a live face (pp. 5, 6).
Beyond the bureau, the Fed points to email age, phone and address ownership, and whether the combination makes sense: a 50 year old with an email address active for only six months and no active account over five years old should raise a red flag (p. 17).
The child in this example can be protected at the source. Under section 605A of the FCRA, a bureau must place a free security freeze on a protected consumer's file when the consumer's representative asks with proof of identity and authority. Protected consumers include children under 16, and a bureau that holds no file must create a record to carry the freeze.
Where does each stage of a synthetic scheme show in your data?
Criminals exploit a synthetic identity for financial gain in stages, from creation through credit building to the bust out, and each stage leaves its trace in a different data source. The synthetic identity fraud entry tells the life cycle; Table 2 maps each stage to the data that shows it and the control that acts on it.
Table 2. Signals and controls by account stage
| Stage | Signal | Data | Control | Who decides |
|---|---|---|---|---|
| Application (creation) | Fields agree with each other but not with the person's age or depth | SSA, bureau file, device | eCBSV, file tests and a link check before approval | Decision engine; an analyst on review |
| Credit building | Authorized user lines on strangers' cards, secured cards, small purchases paid off on time | Bureau tradelines, own payment data | Link authorized users across the book | Fraud analyst |
| Sleeper | On time payments while dozens of names sit on one card (Fed, October 2019, p. 10) | Own card and account data | Periodic review of authorized user counts and shared contacts | Fraud analyst |
| Pre bust out | Cash advances, high value goods, payments from fake accounts or bad checks, a surge of disputes | Transactions, returned payments, disputes | Velocity rules; line increases held for review | Fraud lead |
| Bust out and collections (disappearance) | Lines maxed out, contact details dead | Collections, linked accounts | Book as fraud, trace linked accounts, file a SAR | Financial crime team; the BSA officer files |
Until the bust out, most of these accounts look like good customers. TransUnion's figure in the Fed's October 2019 paper puts the average charge off rate for likely synthetic identities in a lending portfolio below 30 percent, which the Fed reads as 70 percent of them paying like ordinary customers for now (Fed, October 2019, p. 10).
The money goes out in the transaction phase, which "poses the largest financial risk" (July 2019, p. 15), through high value goods, cash advances and sometimes fake businesses. On a card book the loss looks like card fraud; on an installment book, like loan fraud.
Scammers also use the disputes process. Banks and bureaus have limited time under the FCRA to review fraud disputes, so a synthetic can flood the institution with more claims than it can investigate before the deadline (October 2019, p. 12). A surge of disputes on a young file with a clean payment record belongs in the fraud queue as well as the service queue.
How do link analysis, device data and 314(b) sharing expose synthetic accounts owned by one person?
An illustrative issuer's quarterly review turns up 14 card accounts under 14 names. Each pays on time. None breaks a rule alone, yet all 14 share two authorized users and one device. From inside one institution, this is what many synthetic accounts owned by the same person look like.
The Fed's 2020 paper describes link analysis that finds users with the same SSN, applications from one IP address or device, and identities listed as authorized users on many accounts. It adds that link analysis "can be conducted across multiple banks for service providers" (July 2020, p. 8). FinCEN's deepfake alert puts device or location data that do not fit the identity documents on its list of red flags (p. 6).
Past one lender, FinCEN's fact sheet of 12 June 2026 says institutions that meet the 314(b) requirements may share information on suspected fraud, device identification numbers and IP addresses included, and may do so "in real time as activity is occurring" (pp. 3, 4, 7). Section 314(b) does not let them share a SAR or reveal that one exists, outside a joint SAR.
Why book a bust out as fraud, not credit loss, and when is a SAR due?
The Fed found that synthetic losses "often are incorrectly categorized as credit losses", because the identity looks like a customer who stopped paying (October 2019, p. 13). A credit loss closes the file. A fraud flag lets the institution "identify linked accounts" with the same SSN, name or address, and the 2020 paper calls the bust out "another source of data" for that search (July 2020, p. 5). Left as bad credit, the delinquency drops off the bureau file after seven years, and the same identity can be used to rebuild credit and bust out again (October 2019, p. 13).
Take the 14 accounts from the last section, written off at an illustrative $9,000 each. As credit losses they are $126,000 of bad debt. As fraud they open one case, and that case pulls every account sharing their phone, device or SSN.
The case also starts the AML and CFT compliance clock. For a suspicious transaction that "involves or aggregates at least $5,000", a bank has 30 calendar days from first detecting the facts to file a SAR. If no suspect was identified at detection, it may wait up to 30 more days to identify one, but never past day 60 (31 CFR 1020.320).
The same record tells the owners of the customer identification program (CIP) which KYC and customer due diligence (CDD) checks the identities passed, so the onboarding rules can change.
How can a lender stop synthetic identities and still approve thin file customers?
To prevent synthetic identity fraud without turning away real thin file customers, ask for more evidence before saying no.
- Step up before you decline. A short file also fits recent immigrants, and the Fed warns that one characteristic alone "could lead to false positives" (July 2020, p. 5). Ask for a document or eCBSV consent first.
- Decline only on a reason you can state. Regulation B calls a failed qualifying score an insufficient reason, so every model a decline rests on has to name its drivers.
- Match name variants before you call a mismatch. The Fed's example is a customer who applies as Bob and is on file as Robert (July 2020, p. 9).
- Let no single signal decide. The Fed's toolkit is voluntary and is not meant to create any regulatory requirement, so your own policy has to say which combinations decline, review or pass.
- Keep the book under review. Synthetics sit in portfolios as sleepers for months or years, so run the link and file tests on existing accounts as well as new ones.
For the fraud team's next portfolio review:
- Confirm which eCBSV route and tier you use, direct or through a provider.
- Run one query for any SSN, phone number or device that appears on more than one file.
- Recode last quarter's bust outs as fraud where the evidence fits, and pull every linked account.
Sources behind this page. The three Federal Reserve white papers (July 2019, October 2019, July 2020) and its toolkit, SSA's two eCBSV fee notices of 2025, FinCEN's 314(b) fact sheet of 12 June 2026 and its deepfake alert, 12 CFR 1002.9, 31 CFR 1020.320, FCRA section 605A and TransUnion's releases of 20 and 22 October 2026, each read in its own file on 2 and 3 November 2026. Barbaros Sercan wrote the page; Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay, checked the facts on 6 November 2026.
