Synthetic identities do not steal a person so much as manufacture one. As generative AI lowers the cost of creating convincing documents, faces, voices and digital histories, banks are being forced to rethink a fraud model built around verifying whether data is correct rather than whether a customer is real.
The fraudster does not need to steal you anymore
Traditional identity theft begins with a real victim. Synthetic identity fraud begins with an assembly process. A criminal combines authentic and invented attributes - perhaps a real identification number with a fabricated name, address, date of birth, email account or phone number - until a collection of data points is credible enough to pass onboarding and credit checks. The Federal Reserve has described synthetic identity payments fraud as a fast-growing problem because the resulting identity can look legitimate to systems built to detect stolen identities rather than manufactured ones.
The business model is patient. Fraudsters may open low-limit accounts, make ordinary payments, establish a credit file and gradually increase available credit. Once the synthetic customer has accumulated enough trust, the operator can execute a “bust-out”: maxing out credit lines, drawing loans or acquiring goods before disappearing. Because there may be no single real person behind the account, collections and investigation can lead to a dead end.
What makes this more than another fraud technique is the way digital finance rewards scale. Remote onboarding, instant credit decisions and automated servicing have made financial services faster and more accessible. They have also created an environment in which a plausible digital identity can be economically valuable long before anyone meets the person it supposedly represents.
A $3.3 billion warning from US lending
The clearest recent measure of the problem comes from US consumer lending. TransUnion estimated that lender exposure to synthetic identities across auto loans, bank cards, retail cards and unsecured personal loans reached $3.3 billion at the end of 2024, an all-time high in its dataset. A later TransUnion analysis said synthetic identities were linked to a record number of newly opened accounts and argued that public-record attributes can help lenders distinguish plausible-looking files from identities with no coherent real-world footprint.
The number should be treated as exposure rather than a universal estimate of realized losses. Synthetic identity fraud is notoriously difficult to measure because it is often misclassified as ordinary credit default or first-party fraud. That measurement problem is itself part of the threat: if a bank records a fabricated borrower as a customer who simply stopped paying, the institution may understate both the fraud rate and the weakness in its onboarding controls.
The problem is also becoming more commercially significant beyond individual consumers. In November 2025, Federal Reserve Financial Services warned about the rise of synthetic business fraud, in which criminals manufacture companies using manipulated addresses, phone numbers, officers and other details. Business accounts can provide access to larger credit lines and payment flows, meaning a convincing synthetic company may produce much larger losses than a single fake consumer.
Why the economics now favour the attacker
For years, creating a durable synthetic identity required effort: collecting data, maintaining email and phone accounts, producing documents, warming up credit files and behaving consistently across different channels. Generative AI does not remove those steps, but it can lower the cost of many of them.
Text models can generate credible correspondence and application narratives. Image tools can create or alter supporting documents. Voice and video synthesis can help an operator answer step-up verification challenges. Bots can maintain activity across many accounts. In its 2025 Identity & Fraud Report, Experian found that 72% of surveyed US business leaders expected AI-generated fraud and deepfakes to be a major challenge, while nearly 60% reported rising fraud losses.
TransUnion similarly warned in 2025 that generative AI and deepfake technologies are accelerating synthetic identity fraud and making static verification less effective. Its recommended direction is broader identity intelligence - combining device, behavioural and cross-channel signals rather than treating a document or a selfie as definitive proof. That assessment reflects a structural change: a bank can no longer assume that media which looks human was produced by a human.
The synthetic identity is becoming an economy
The phrase “synthetic identity economy” is useful because the crime increasingly resembles a supply chain rather than a one-off act. Stolen personal data supplies raw material. Data brokers, breach markets and social engineering provide additional attributes. AI tools can generate synthetic media. Mule networks move proceeds. Fraud operators specialize in account opening, credit building, monetisation or laundering.
This industrialisation is visible in the broader fraud environment. The Financial Action Task Force reported in February 2026 that 156 jurisdictions - 90% of those it had assessed - identified fraud as a major money-laundering risk. FATF described cyber-enabled fraud as one of the most widespread and damaging profit-motivated forms of crime.
INTERPOL’s 2026 Global Financial Fraud Threat Assessment goes further, describing the “industrialization of fraud” as criminal networks combine AI, low-cost digital tools and international collaboration. INTERPOL said AI-enhanced fraud was 4.5 times more profitable than traditional methods in the data underpinning its assessment and warned that agentic AI can increasingly automate parts of a fraud campaign.
Synthetic identity fraud fits naturally into that system because it creates reusable infrastructure. A convincing identity can open accounts, obtain credit, receive money, establish merchant profiles, create companies or serve as a mule. The identity itself becomes an asset.
Why traditional KYC can produce false confidence
Know-your-customer controls were built primarily to answer questions such as: Does this name match this document? Is the identification number valid? Does the address exist? Is the applicant on a sanctions list? These remain essential questions, but synthetic identities exploit the gaps between them. Each individual data point can be valid while the person assembled from those data points is not.
That is why the next generation of controls has to test coherence, not just correctness. Does the email address have a history consistent with the claimed age of the customer? Does the device appear across unrelated applications? Does the address connect logically to public records? Does the behaviour after onboarding match the stated profile? Are multiple “customers” sharing hidden infrastructure?
US interagency guidance on authentication already recognises the need for identity-verification methods capable of detecting synthetic identities and impersonation. Federal Reserve-hosted interagency guidance emphasises layered security and risk-based verification rather than dependence on a single credential.
The most dangerous synthetic customers may look excellent
The paradox of synthetic identity fraud is that the riskiest account may initially behave better than a genuine one. A fraud ring building credit has an incentive to pay on time. It may keep utilisation low, maintain consistent contact information and avoid obvious red flags. The account is performing because performance is part of the deception.
That makes conventional fraud scoring difficult. Many systems are optimised to detect anomalies at the moment of application or transaction. Synthetic identities can instead manufacture normality over months or years. Their signal appears not in a single event, but in relationships across identities, devices, addresses, phone numbers, credit files and payment counterparties.
This is where graph analytics and network intelligence become important. Banks need to understand not only whether an applicant looks credible in isolation, but whether supposedly unrelated customers are connected through infrastructure that should not be shared. A repeated device, mailing address, employer, IP range or funding source can reveal a network that individual account reviews miss.
AI is both the accelerant and part of the defence
AI makes synthetic identity fraud easier to scale, but it also gives financial institutions tools to find patterns too complex for static rules. Models can identify behavioural inconsistencies, link apparently separate applicants, detect manipulated documents and adjust authentication requirements when risk changes.
The challenge is that defensive AI needs broad, high-quality data, while criminals need only one exploitable gap. A bank may have excellent document verification but weak device intelligence. Another may have strong transaction monitoring but limited visibility across product silos. Synthetic identities thrive in those seams.
The 2026 fraud environment therefore rewards orchestration more than any single model. Device intelligence, document analysis, biometrics, behavioural analytics, credit data, public records and transaction monitoring need to inform a shared identity-risk view. The aim is not friction everywhere. It is friction when the evidence becomes inconsistent.
Banks also need to share what one institution cannot see
Synthetic identities often move across institutions. One bank may see a new account. Another sees a credit application. A fintech sees a wallet. A telecom provider sees a newly activated number. No single participant has the full pattern.
Information sharing is therefore becoming a central part of anti-fraud policy. In July 2026, the Federal Reserve highlighted FinCEN guidance clarifying fraud-related information sharing under Section 314(b), reinforcing circumstances in which participating financial institutions can share information about suspected fraud associated with money laundering or terrorist financing. The practical significance is larger than the legal detail: networked crime is difficult to defeat with institution-by-institution visibility.
Law enforcement is reaching the same conclusion globally. INTERPOL’s Operation First Light 2026 involved 97 countries and territories, produced 5,811 arrests and intercepted $293 million in illicit assets. The operation targeted social engineering scams and associated laundering rather than synthetic identity fraud alone, but it illustrates the scale of cooperation increasingly required to disrupt cross-border fraud infrastructure.
The customer-experience problem
Banks cannot solve synthetic identity fraud by making every genuine customer prove their identity repeatedly. Excessive friction creates abandonment, pushes customers toward competitors and can disadvantage people with thin credit files or limited conventional documentation.
That creates a difficult optimisation problem. The same digital onboarding that benefits legitimate customers also benefits attackers. The correct response is not to reverse digitalisation, but to make trust adaptive. Low-risk customers should pass with little friction. Inconsistent identities should trigger stronger proofing, additional data checks or human review.
This is also why false positives matter. If a fraud model disproportionately blocks young customers, recent immigrants or people without extensive credit histories, the institution may reduce fraud while creating a new fairness and access problem. Synthetic-identity controls therefore belong not only to fraud teams, but also to compliance, model risk, customer experience and governance.
What financial institutions should change
Treat identity as a lifecycle, not an onboarding event
A synthetic identity can look clean on day one and become suspicious later. Banks should therefore continue assessing identity confidence as account behaviour, devices, counterparties and credit activity evolve.
Join data across products and channels
Fragmented systems allow the same infrastructure to appear under multiple identities without detection. A common entity layer can reveal repeated addresses, devices, telephone numbers, employers, beneficiaries and funding sources.
Separate document authenticity from person authenticity
A genuine document does not necessarily prove that the person presenting it is genuine, authorised or consistent with the wider identity. Deepfake-aware liveness checks, behavioural signals and independent data sources are increasingly necessary complements.
Measure fraud that is hiding inside credit losses
If synthetic bust-outs are classified as bad debt, management may underestimate the control failure. Fraud, credit and collections teams need feedback loops that re-examine suspicious defaults and update origination models.
Design escalation for ambiguity
The hardest cases are not obviously fraudulent; they are internally inconsistent. Human investigators should receive the evidence behind a model’s concern - shared infrastructure, contradictory records, unusual timelines - rather than a risk score alone.
Is synthetic identity fraud really the fastest-growing fraud?
The title captures the urgency, but the claim needs nuance. The Federal Reserve has called synthetic identity payments fraud fast-growing, and recent lender exposure is at record levels in TransUnion’s US data. At the same time, other categories such as account takeover have recently shown extremely rapid growth: TransUnion reported a 141% increase in global digital account-takeover volume between the first halves of 2021 and 2025.
The more defensible conclusion is that synthetic identity fraud is among the most strategically important forms of identity-based financial crime because it is difficult to identify, can mature slowly, can be misclassified as credit loss and is becoming easier to manufacture at scale. Its danger is not just its growth rate. It is its ability to become embedded inside normal financial activity.
Conclusion: the next fraud problem is the customer who never existed
Banking has spent decades learning how to authenticate people. Synthetic identity fraud changes the challenge: institutions must now establish whether the person being authenticated exists in the form presented at all.
That distinction will become more important as AI makes synthetic documents, voices, images and digital histories more convincing. The threat is moving from stolen credentials toward manufactured credibility. A fraudster no longer needs to impersonate a real customer if technology can help create a plausible new one.
The banks best positioned for this shift will be those that stop treating identity as a collection of static fields and start treating it as a living network of evidence. The question at onboarding will no longer be simply whether the data matches. It will be whether the identity makes sense - across time, behaviour, devices, relationships and the wider financial system.
In the synthetic identity economy, the most expensive customer may be the one who was never a person in the first place.
References
1. Federal Reserve - Synthetic Identity Payments Fraud White Paper announcement
2. Federal Reserve Financial Services - Fake companies, real risk: The rise in synthetic business fraud
3. TransUnion - H1 2025 State of Omnichannel Fraud Report
4. TransUnion - Research Highlights $3.3B Synthetic Identity Threat
5. TransUnion - H1 2026 Top Fraud Trends Report
6. TransUnion - Synthetic Identity Fraud 2.0: How AI Is Redefining Fraud Detection
7. Experian - 2025 U.S. Identity & Fraud Report
8. FATF - Cyber-Enabled Fraud: Digitalisation and ML/TF/PF Risks
9. INTERPOL - 2026 Global Financial Fraud Threat Assessment
10. INTERPOL - Operation First Light 2026
11. Federal Reserve - Interagency Guidance on Authentication and Access
12. Federal Reserve - SR 26-3 on Fraud-Related Information Sharing under Section 314(b)