What Is Synthetic Identity Fraud? How Fraudsters Create Customers Who Don't Exist

Synthetic identity fraud has now become one of the most challenging financial crimes, mostly because fraudsters can create customer profiles that appear legitimate but belong to no real person. By blending authentic identity details with fabricated information, these synthetic identities can successfully pass onboarding checks, establish credit histories, and remain active for months before being used for fraud. Because there is often no direct victim to report suspicious activity, traditional verification processes struggle to detect them. This makes synthetic identity fraud a growing concern for banks, fintechs, and other organisations that rely on digital onboarding.

What Is Synthetic Identity Fraud?

Synthetic identity fraud is a financial crime where criminals mix real personal data (like a stolen Social Security number) with invented information (like a made-up name, a false address, and a date of birth) to create a brand new, fictitious person or persona. Unlike identity theft, synthetic identity fraud does not rely on stealing a person’s complete identity. Fraudsters combine real details, such as a valid PAN or Aadhaar number, with false information. These include a new mobile number, a fresh email address, and a synthetic photograph, used to build a customer profile that looks entirely legitimate. Because there is no single victim to get flagged during the activity, these identities can remain undetected for months. Fraudsters build credibility through on-time payments, then “bust out”: maxing out available credit and disappearing. A recent case in India highlights how sophisticated identity fraud can evade the method of traditional verification. Between 2022 and 2025, Delhi Police uncovered 683 fraudulent gold loan accounts worth approximately ₹3.81 crore at an NBFC, created using forged KYC documents and fake identities. The case revealed that fraud was carried out with the involvement of company insiders and came to light only after an internal audit discovered gold worth ₹14.11 lakh missing from the vault. The incident demonstrates how fraud built on seemingly valid identities can remain undetected for years when onboarding relies primarily on document validation.

Why Traditional Identity Verification Struggles

Most onboarding systems just confirm if the document is genuine and whether it matches the applicant presenting it. PAN validation, Aadhaar verification, OTP confirmation, and facial matching all authenticate individual credentials well. This is where traditional onboarding risk assessment falls short, as it validates individual credentials but cannot determine whether they belong to a genuine identity.

Synthetic identity fraud is engineered to pass exactly this kind of check, since most of what is submitted was never stolen from anyone. Instead, it combines genuine identity elements with false information to create a profile that appears legitimate.

Traditional verification systems can only confirm that individual credentials are valid, but they cannot determine whether those credentials genuinely belong to the same person or whether the same combination of identity elements has been used elsewhere under a different identity.

That blind spot is why document-first identity verification, however advanced, needs to be paired with digital footprint analysis and a broader view of digital behaviour.

Synthetic Identity Fraud vs Identity Theft

Identity theft and synthetic identity fraud are distinct concepts and behave differently. The table below lays out where they actually diverge and why synthetic identity fraud is usually hard to detect:

That difference in visibility is what makes synthetic identity fraud so much more expensive to detect immediately. By the time fraudulent activity occurs, the fraudster has usually been building credibility for months.

Looking Beyond Documents: The Case for Fraud Intelligence

If documents alone cannot confirm that an identity is genuine, what can? The answer lies in fraud intelligence. Instead of evaluating individual credentials in isolation, fraud intelligence connects multiple digital signals to determine whether an application represents a legitimate customer or a coordinated fraud attempt.

Device Intelligence

Device intelligence analyses the device used during onboarding to identify patterns associated with fraud. A single device is not suspicious on its own, as genuine customers may apply for multiple financial products or share a device with family members. Risk emerges when the same device is repeatedly linked to numerous unrelated identities or applications, particularly across different financial institutions.

Behavioural Intelligence

Every applicant leaves some behavioural signals while completing an application. Behavioural intelligence analyses typing cadence, scrolling behaviour, touch interactions, and overall session activity to understand how an application is completed. Together, these evaluate a pettern and distinguish genuine human behaviour from scripted, automated, or manipulated activity.

Network and Link Analysis

Synthetic identities rarely operate in isolation. Network and link analysis uncovers hidden relationships between applications. It is performed through identifying shared devices, IP addresses, phone numbers, email addresses, or other digital connections. While each application may appear legitimate on its own, these shared connections can reveal coordinated fraud that traditional identity verification cannot detect. This is where Sign3 adds an intelligence layer to identity verification. Rather than replacing document checks, it enriches them by analysing device, behavioural, and network signals together in real time. This broader view helps financial institutions detect hidden relationships between applications and identify coordinated fraud before an account is approved.

Case Study: How Sign3 Detected a Sophisticated SIM-Swapping Fraud Ring

A financial institution observed that multiple loan applications were successfully clearing identity verification despite some similarities in device and behavioural signals. Individually, each application appeared legitimate, making the fraud difficult to detect through document validation alone.

Solution: Sign3's fraud intelligence platform analysed device, behavioural, and network signals across applications rather than evaluating each application in isolation. The analysis revealed that a single device was linked to 27 phone numbers across 13 states, with repeated activity in Brave Browser's privacy mode and 42% of sessions using ad blockers. Behavioural intelligence also identified recycled SIMs and persistent device characteristics connecting otherwise unrelated applications.

Outcome: When viewed individually, none of the applications appeared suspicious. When analysed together, these connected signals exposed a coordinated single-device SIM-swapping fraud operation. The case illustrates how layered fraud intelligence can uncover organised fraud rings before fraudulent accounts are approved.

How Connected Fraud Intelligence Strengthens Identity Verification

As fraud rings grow more sophisticated, a single-signal approach to verification is no longer enough. Official data from the Ministry of Home Affairs confirms that the Indian Cyber Crime Coordination Centre (I4C) shared details of more than 2.73 million suspected Layer 1 mule accounts. The number highlights why financial institutions should adopt behavioural analytics, biometrics, and real-time risk intelligence alongside traditional KYC. By layering behavioural, device, and network intelligence into onboarding decisions, Sign3 changes what financial institutions and banks can see and when they can act on it.

Surfaces Coordination, Not Just Anomalies

A device or SIM reused across dozens of unrelated-looking applications is a stronger fraud signal than any single flagged document, and it is only visible when applications are analysed together.

Reduces False Positives

Genuine customers rarely share devices or contact infrastructure with other applicants, so connected signals separate real anomalies from coordinated fraud rather than penalising legitimate customers.

Shifts Detection Earlier

Behavioural biometrics and network patterns can flag risk at onboarding, before an account is opened, rather than after a fraudulent case has already occurred.

Scales with Evolving Tactics

As fraud rings evolve by rotating devices and SIM cards, connected intelligence detects hidden links between applications rather than relying solely on predefined thresholds.

Together, these signals are evaluated through real-time risk scoring, allowing financial institutions to prioritise high-risk applications before accounts are approved. These reveal whether an identity is consistent, connected, and genuinely trustworthy before an account is approved.

By making fraud intelligence a part of the onboarding decision rather than a post-fraud investigation, financial institutions can identify coordinated attacks before fraudulent accounts are opened and losses occur.

Conclusion

Synthetic identity fraud succeeds because it is built to pass the checks banks already trust. As synthetic identity fraud evolves, financial institutions need to look beyond document verification. They need an intelligence layer to evaluate the connected signals that reveal whether an identity can be trusted.

Platforms like Sign3 are built around this approach, giving financial institutions a real-time view of applicant risk. Hence, coordinated fraud can be stopped during onboarding rather than investigated later.

FAQs

How to identify synthetic identity fraud?

Start by identifying inconsistencies in the user’s profile. These include - checking for an SSN issued before a birth date, a thin or newly created credit history for an older applicant, or multiple unrelated names or applications sharing the same phone number or address.

What is the meaning of identity fraud?

Identity fraud is an illegal use of a genuine person’s identity or real data such as name, documents, or financial information. Fraudsters use this data to commit a crime, deceive others, or indulge in money scams.

How to prevent synthetic identity theft?

To prevent synthetic identity theft, start by evaluating multiple sources of identification that include data, documents, and whether the person is easily reachable. Also, leverage advanced identity verification through machine learning and network fraud intelligence. Together, they help to reduce risk when confirming a user’s identity.

How to report synthetic identity theft?

To report synthetic identity theft, immediately contact your bank or financial organisation or contact local law enforcement. If you are in India, you can report cyber fraud through the National Cyber Crime Reporting Portal or call 1930.

What is synthetic identity theft and how to detect it online?

Synthetic identity theft is a crime where scammers use real data of a person with fake information and use it for fraudulent activities. To detect it online, a multi-verification approach is necessary, including cross-checking data from credit bureaus, government databases, and behaviourial analytics.