Synthetic identity fraud and stolen identity

Synthetic identity fraud is the use of a fabricated identity, assembled from real or invented attributes, to obtain financial services or another benefit through deception. It differs from impersonating an existing person and from taking control of an existing account.

Identity construction and account control are separate events

Identity theft uses another person’s identifying information without authority. An application that impersonates a particular existing person concerns that person’s identity, even when the fraudster supplies a new address or phone number.

A synthetic identity combines attributes into a customer who does not exist as represented. A genuine identifier can be paired with an invented name and other details. The fraud does not require the complete impersonation of the person whose identifier was used.

Account takeover concerns control of an established account. The attacker gains access and acts through the account, for example after stealing credentials or compromising a recovery process. The account’s original owner can be entirely genuine.

These categories can overlap in an event sequence. A stolen attribute can help construct a synthetic identity, and an attacker can later take over an account opened under another identity. The labels describe different acts rather than mutually exclusive descriptions of every case.

Successful authentication does not validate the underlying identity

Authentication establishes whether an actor satisfies the account’s access test. Identity verification examines whether the claimed identity is supported by evidence. A person controlling a registered phone and password can pass authentication even when the customer profile was fabricated at enrollment.

Take three applications. The first uses an existing person’s identity without permission. The second combines an existing identifier with an invented persona. The third is a genuine customer relationship whose password is subsequently stolen. A successful login distinguishes none of these cases by itself.

The relevant evidence differs: the first case concerns impersonation, the second the coherence and existence of the represented identity, and the third the change in account control.

Repayment history can strengthen a fabricated profile

A synthetic persona can make payments and accumulate account history before producing a loss. Take an account with a $500 limit whose payments remain current before a later increase to $5,000. The early repayments show that someone serviced the obligation; they do not independently establish that the named customer exists.

This creates a distinction between observed payment behavior and identity validity. A credit model can correctly record the payments while relying on a false customer representation.

Loss classification affects the investigation

A late default alone does not prove synthetic identity fraud. The investigation needs evidence about identity construction, account history, control, and the representation used to obtain the service.

Where a real person’s identifier was incorporated into a synthetic profile, that person can suffer reporting or access problems even without being the intended borrower. The institution’s credit loss and the individual’s identity harm are separate consequences.