What is Synthetic Identity Theft?Defining the Threat Posed by Synthetic Fraud Attacks
What Defines a Synthetic Identity Theft Attack? How do Scammers Make Fake Identities?
Synthetic identity theft involves combining real and fake information to create new identities. Fraudsters use these synthetic identities to open fraudulent accounts, obtain credit, and make purchases.
In this first chapter, we’ll discuss what synthetic identity theft is and how it works. As we delve deeper, we’ll also explain why it matters, and how both consumers and merchants can avoid it altogether.
What is Synthetic Identity Theft?
- Synthetic Identity Theft
Synthetic identity theft, sometimes known as synthetic identity fraud, occurs when cybercriminals combine stolen personal data to create new identities, then use those fake identities to commit fraud.
[noun]/sin • THe • dik •ˌī • den •ˌtə •ˌdē • THeft/
According to a report by TransUnion, synthetic identity fraud was the fastest growing form of fraud in 2024. A subset of identity fraud, synthetic identity theft is when a scammer combines stolen personally identifiable information (PII) with fabricated data to create new fake identities.
Starting with bits of real data as a base, fraudsters “invent” virtual identities by filling in the remaining details with either real information from other sources, or seemingly genuine (but made-up) data. They could also make use of any combination of the two. The synthesized ID can then be used to acquire credit, open bank accounts, steal tax refunds or government benefits, or even take out car loans or mortgages.
A typical synthetic attack could look something like this:
Essentially, the fraudster builds a fake person out of multiple parts from other identities. No wonder why some people have taken to describing these synthetic profiles as “frankenstein” identities.
That said, synthetic and traditional identity thieves have much the same goals: co-opting a victim’s PII for their own financial gain.
Any type of identity fraud can slam you with chargebacks.
We can show you how to fight back.
Request a Demo
How Do Scammers Create Synthetic Identities?
The fact that synthetic fraudsters don’t need all of a victim’s real information simplifies things for them. However, they still need to acquire a bit of PII, preferably from more than one source.
While tricks like phishing still work for this, that technique can be slow. Purchasing large batches of information off the dark web is usually more efficient. Personal data is plentiful and cheap, given that there were over 3000 data breaches in the US last year alone, exposing over a billion records.
While combining one or two of these factual elements can make a synthetic persona more realistic, some fraudsters don’t stop there. They may add complete backstories, including work, education, and credit histories. These can even be made public through fake social media accounts.
AI has provided synthetic fraudsters with a powerful tool. Deep fakes – computer generated pictures of the alleged consumer – can help bypass even more sophisticated identity validation methods.
What Do Scammers Do After Creating a Synthetic Identity?
A long con based on synthetic identities takes patience.
Fraudsters may cultivate the fake profile, making normal-looking transactions and regularly paying bills for several months, or even years. During this period, they’re qualifying for higher credit limits and more lines of credit.
Eventually, the scammer will abruptly “bust-out,” meaning every credit card gets maxed out, including cash advances. After that, the fraudster disconnects themselves from all the accounts, effectively disappearing and dropping the liability on other parties.
Instead of busting out, some fraudsters may try to maintain false identities as part of a money-laundering scheme.
Synthetic fraud is difficult to detect and almost impossible to prosecute. The accounts don’t belong to actual consumers, meaning there is usually no one to complain and no one party that can be taken to court. Stolen personal information may go undetected for years, and fraudsters are careful to erase any communication avenues that might lead law enforcement to their door.
