How it works
A synthetic identity combines genuine data, such as a real identity number belonging to a child or someone who has died, with an invented name, date of birth, address or phone number. Because no real person matches the full profile, there is no victim to notice and complain, and the identity can pass basic document and database checks.
Fraudsters nurture these identities over months, opening accounts, taking small credit facilities and repaying them on time to build a good record. Once limits have grown, they draw down every facility at once and disappear, a pattern known as bust-out. Synthetic identities are also used as ready-made mule accounts.
A single synthetic application usually looks clean. The weakness is reuse: the same phone numbers, email addresses, physical addresses and devices appear across many identities, because building fully independent profiles at scale is costly. With mobile-first onboarding and remote verification, device reuse is often the strongest link.
Red flags
- A thin or new credit history for an applicant whose stated age suggests a long one
- An identity number that appears with different names or dates of birth across applications
- Phone number, email, address or device shared with other, apparently unrelated applicants
- An address that is a mail drop, a vacant property or shared with many unrelated customers
- Steady repayment followed by limit-increase requests on several products at once
- Simultaneous draw-down of all available credit, followed by no further contact
Signals the engine evaluates
- Clusters of applicants that entity resolution links through shared phones, emails, addresses, devices or ID numbers
- Consistency of name, date of birth and identity number across applications and internal records
- Number of new applications sharing an identifier within a rolling window
- Credit utilization over time across linked profiles, flagging coordinated limit increases and full draw-down
Investigation and response
- 01Expand from the flagged application to every profile sharing an identifier, and review the cluster as one case.
- 02Re-verify identity for linked customers through a stronger method, such as in-person verification or a check against the authoritative population register.
- 03Reduce or freeze unused credit limits across the cluster before a coordinated draw-down.
- 04Report confirmed synthetic identities to the financial intelligence unit and, where available, to industry fraud-sharing databases.