Synthetic Identity Theft: How Banks Detect It and How to Protect Your SSN

Somewhere in a credit bureau file sits a person who doesn’t exist. They pay their bills on time. They’ve had a credit card for two years. They have a Social Security number, just not their own. No real person filed a police report about this identity. No real person’s life got stolen. That’s what makes it so hard to catch.

Marcus Delray

Banking Technology & Fraud Detection Writer

Synthetic Identity Fraud Bank Fraud Detection

About the author →

✅ Fact Checked & Reviewed by Marcus Delray — July 2026

According to research from Mitek and Datos Insights, synthetic identity fraud has become an “industrialized threat.” The Deloitte Center for Financial Services identifies it as the fastest-growing financial crime in the United States. US credit losses tied to synthetic identities jumped from $1.8 billion in 2020 to $2.94 billion in 2025 — a 16% rise in a single year.

What Is Synthetic Identity Theft?

Synthetic identity theft — also called synthetic identity fraud — is the deliberate construction of a fictitious credit identity using a real Social Security number combined with invented personal information. The real SSN is typically harvested from a child, an elderly person, or someone who has died: individuals least likely to monitor their own credit. The fabricated name, address, and birthdate attached to that SSN are entirely invented.

This distinguishes synthetic identity fraud from traditional identity theft. In traditional theft, a real person’s full identity is stolen. In synthetic fraud, the “person” built around the SSN does not exist — which means no one reports the crime and the fraud can persist undetected for years.

How Do Banks Spot Synthetic Identity Theft in the First Place?

Banks detect synthetic identity theft primarily by spotting what is missing, not what is wrong. With regular identity theft, a bank checks a claim against a real record and finds a mismatch. But synthetic identity fraud has no real record to check against.

The Deloitte Center for Financial Services calls synthetic identity fraud the fastest-growing financial crime in the US. According to Plaid’s fraud data, synthetic activity in bankcard credit inquiries crossed 1% at the end of 2024 — the first time on record.

Fraudsters build a synthetic identity slowly and deliberately:

1. A real SSN — typically belonging to a child, elderly person, or deceased individual — is paired with a fabricated name, birthdate, and address.
   
2. Early credit applications are submitted. Most get rejected, but each rejection creates a bureau entry. That thin file becomes the seed.
   
3. Small credit products are gradually acquired and paid off on time. The fake profile is “fattened up” over months or years.
   
4. Once the credit profile looks healthy, the fraudster maxes out available credit lines and disappears — a tactic known as a “bust-out.”

Some fraudsters sell assembled synthetic identity packages illegally, marketing them as “Credit Profile Numbers” (CPNs) and falsely describing them as a legal credit workaround.

CBSV verification is one of the few direct tools targeting this fraud vector. The Social Security Administration’s Consent-Based SSN Verification service allows banks to confirm in real time whether a submitted name, birthdate, and SSN genuinely match the SSA’s records — catching the name-and-number mismatch that other checks miss.

Why Is a “Real” Social Security Number the Weak Point?

Because it’s the one piece that passes every basic check. That’s exactly why fraud rings build around it, instead of faking it too.

Fraudsters usually target SSNs from children, elderly people, or the deceased. These are people unlikely to check their own credit for years. The fraudster pairs that real number with a fake name, birthdate, and address. Early credit applications often get rejected. But even a rejection creates a bureau entry. That thin file becomes the seed. From there, the fraudster slowly applies for small credit products. They pay them off on time. Bit by bit, the fake profile gets “fattened up.”

Some fraudsters sell this fake identity kit illegally. They call it a “Credit Profile Number,” or CPN. It’s marketed as a legal workaround. It isn’t. Banks do have one direct tool against this. The Social Security Administration runs a Consent-Based SSN Verification service, known as CBSV. It lets a bank confirm, in real time, whether a name, birthdate, and SSN actually match. It’s one of the few checks aimed straight at the identity’s one real piece.

What Does a “Fragmented” Credit History Actually Look Like to a Bank?

A fragmented credit history looks thin, disconnected, and strangely clean. A real credit file has texture: a mortgage inquiry here, a missed payment there, an old student loan closed a decade back. A synthetic identity’s file often looks too tidy for someone supposedly in their thirties or forties.

Banks and bureaus look for one clear pattern:

• No credit footprint before a specific date. That absence says more than anything suspicious after it.
  
• A sudden, careful build-up of small, well-managed accounts following the “start date.”
  
• Missing background connectors — no childhood address, no old phone number, no employment record from ten years ago. A synthetic identity’s story only starts recently. And it starts too clean.

This is where identity stitching becomes a defense. Investigators cross-reference fragments of an identity across databases to determine whether the pieces belong to one real, continuous life — or were assembled after the fact.

How Do Cross-Bureau Verification Tools Catch What One Bureau Misses?

Cross-bureau verification catches mismatches that only appear when bureaus are compared side by side. A single credit bureau only sees what has been reported to it. A synthetic identity might look clean at Experian, show gaps at TransUnion, and carry a mismatched address at Equifax.

Cross-bureau checks examine specific signals:

• Do the name, SSN, and birthdate reported to different bureaus actually align?
  
• Does the same address, phone number, or device appear across supposedly unrelated applicants?
  
• Is one government ID number linked to more than one name simultaneously?

These mismatches are also a recognized signal for identifying mule accounts, which frequently share the same fragmented, patchy data trail as synthetic identities.

The core challenge remains data siloing. No single bank sees the full picture. A synthetic identity can hold accounts at several institutions simultaneously. Without cross-institutional data sharing, the fragmentation itself becomes the hiding place.

Can Machine Learning Actually Spot This Better Than Humans?

Yes — and the performance gap between AI-based and legacy rule-based fraud detection is substantial

Old rule-based fraud systems struggle here on purpose, in a sense. Synthetic identities are built specifically to avoid tripping obvious rules. In one benchmark test, a rule-based system caught fraud at a 62.4% rate. A modern AI setup, mixing graph analysis with multi-agent review, hit 91.3% on the same data. The false-positive rate, where good customers get wrongly flagged, dropped too. It fell from 95.2% down to 37.1% in that same comparison.

The technology behind this performance leap is the Graph Neural Network (GNN). Rather than evaluating one application in isolation, a GNN maps accounts, devices, and identities as a connected web and hunts for the relational patterns synthetic identities produce — shared devices across “different” applicants, address clusters that don’t match how real households actually look.

In testing, GNN-based fraud models have achieved F1 scores of 0.947 and AUC-ROC values above 0.985 — well ahead of older, single-transaction systems.

GNN-based AI is better suited for institutions managing large, interconnected account volumes, where relational fraud patterns emerge across data. Legacy rule-based systems work adequately for detecting straightforward mismatches but fail systematically against engineered identities designed to pass every individual check.

What Happens When Deepfakes Get Involved in Account Opening?

Deepfake technology can now attack the liveness verification checks specifically designed to stop synthetic identity fraud at the point of account opening. Most account-opening processes pair a document scan with a liveness check: blink for the camera, turn your head. A face-swap tool can render a different person’s face onto a live video feed in real time, matching head movement well enough to defeat that check.

One physical signal resists this, however: remote photoplethysmography (rPPG). Human skin carries a faint, rhythmic color shift tied to blood flow — the visual trace of a real pulse. Deepfake video can replicate a face and its movements convincingly. It cannot reliably reproduce rPPG variance at a normal human range. Detection tools built to verify rPPG signals can flag a video feed as non-human even when the face itself appears completely real.

This is not an edge-case concern. According to industry survey data:

• 84% of financial executives now classify synthetic identity fraud as a moderate or high risk to their application process specifically.
  
• Roughly 40% of financial institutions report a measurable increase in AI-linked fraud attempts.

How Much Does Synthetic Identity Fraud Cost, and Who Is Most at Risk?

The financial and personal costs of synthetic identity fraud are significant and growing — but the personal risk falls most heavily on children and thin-file consumers.

Fraudsters prefer SSNs that are unlikely to be monitored. A child’s SSN can sit quietly attached to a fake adult identity for years, surfacing only when that child applies for their first credit card or student loan and finds an unfamiliar, already-active file waiting.

At the institutional level, the losses are already large:

• According to Gartner research cited by SAS, synthetic identities account for 20% of all credit charge-offs and 80% of credit fraud losses overall.
  
• Total global transaction volume reached approximately $11.6 trillion in 2025. Industry fraud-loss estimates commonly place annual fraud losses at around 5% of revenue across the financial sector.

That scale explains why synthetic identity fraud has moved from back-office fraud teams onto bank boardroom agendas.

What Can You Do to Protect Your Own SSN From Synthetic Identity Fraud?

The most effective consumer protection steps are: check your own credit file across all three bureaus, check your children’s files, and place a credit freeze if you find anything unusual.

Under the Fair and Accurate Credit Transactions Act (FACTA), every consumer is entitled to a free credit report every twelve months from each of the three nationwide bureaus — Equifax, Experian, and TransUnion. Check all three. A synthetic identity built around your SSN might only appear clearly on one of them.

Warning signs to watch for:

• A thin, unfamiliar file with no credit history before a specific date
• An account you never opened
• A credit inquiry from a lender you have never used

Recommended protective steps:

Report anomalies immediately to the relevant bureau and consider contacting a consumer protection attorney or nonprofit credit counselor if you suspect SSN misuse.

Pull all three bureau reports at AnnualCreditReport.com (the only federally authorized source for free reports).

Check your children’s credit files. A minor can have a credit file opened without any family member knowing.

Place a credit freeze at all three bureaus. A freeze blocks new accounts from opening in your name without your direct approval.

This article gives general information. It isn’t financial, legal, or credit-counseling advice. If you think your Social Security number has been used to build a synthetic identity, contact each of the three credit bureaus, and consider talking to a consumer protection attorney or a nonprofit credit counselor.

How Does Synthetic Identity Fraud Differ From Traditional Identity Theft?

Synthetic identity fraud and traditional identity theft share the same raw material — a Social Security number — but operate very differently.

Traditional identity theft involves stealing a real person’s complete identity: their name, SSN, address, and other details. The victim typically discovers the fraud quickly through unfamiliar charges or collection calls, and can file a police report.

Synthetic identity fraud constructs a new, fictitious person around a real SSN. The true SSN owner is rarely aware of the misuse. No one files a report. No fraud alert is triggered. Detection relies entirely on institutional pattern-recognition, not on a victim complaint.

This is precisely why synthetic identity fraud is harder to catch and why it accounts for a disproportionately large share of total credit fraud losses.

People Also Ask

Q: How do banks detect synthetic identity theft if no real victim reports it?
A: Banks look for absence rather than mismatch. A synthetic identity typically shows no credit footprint before a specific date, followed by a sudden, careful build-up of small accounts. Real credit histories rarely exhibit that pattern. Cross-bureau verification tools and GNN-based AI systems are designed to surface these relational anomalies without relying on a victim complaint.

Q: What is CBSV, and does every bank use it?
A: CBSV stands for Consent-Based SSN Verification, a service operated by the Social Security Administration. It allows participating banks and lenders to confirm in real time whether a submitted name, birthdate, and SSN match the SSA’s records. Not every bank currently uses CBSV, but it is one of the few tools that directly targets the one real element in a synthetic identity — the Social Security number itself.

Q: Can a credit freeze fully protect my SSN from being used in synthetic identity fraud?
A: A credit freeze prevents new accounts from being opened in your name without your direct approval, which significantly limits the damage a fraudster can do with your SSN going forward. It does not remove any existing fraudulent file that may already have been created. Checking all three bureau reports first — Equifax, Experian, and TransUnion — remains the necessary first step before relying on a freeze for protection.

Q: How does a GNN differ from a standard machine learning fraud model?
A: Standard machine learning fraud models evaluate individual transactions or applications independently. A Graph Neural Network (GNN) maps relationships between accounts, devices, and identities across a connected data web. This allows GNN-based systems to detect the relational patterns that synthetic identities create — such as shared devices across supposedly unrelated applicants — which single-transaction models routinely miss.

Q: What is rPPG and why does it matter for deepfake detection?
A: Remote photoplethysmography (rPPG) is the faint, rhythmic color variation in human skin caused by blood flow — the visual trace of a real pulse. Standard deepfake video can convincingly replicate facial features and movement but typically fails to reproduce this physiological signal accurately. Financial institutions using rPPG-based liveness detection can flag a fake video submission even when the synthetic face itself appears entirely realistic.

Q: How is synthetic identity fraud detected differently from money mule account fraud?
A: Both fraud types produce fragmented, patchy data trails — shared addresses, mismatched bureau data, device reuse across accounts. Banks often detect them using the same cross-bureau verification tools. The distinction is that synthetic identity fraud involves building a fictitious credit identity over time, while mule accounts are typically real identities used to move fraudulent funds. A single investigation can surface both when the same device or address cluster links them.

Source Methodology

Statistics and claims in this article are drawn from the following sources: Mitek and Datos Insights research on synthetic identity fraud characterization; the Deloitte Center for Financial Services on US financial crime trends; Gartner research as cited by SAS on credit charge-off attribution; Plaid fraud data on bankcard inquiry trends; published benchmark comparisons of rule-based versus AI governance detection frameworks; and industry survey data on deepfake-related fraud attempts in financial services. All figures reflect data available as of publication in June 2026. Readers are encouraged to verify statistics against primary sources before citing them in commercial or regulatory contexts.

About the Author

Marcus Delray

Synthetic Identity Fraud & Bank Detection Writer

Synthetic Identity Theft SSN & CBSV Verification Graph-Based Fraud AI

Marcus Delray covers synthetic identity theft and the exact methods banks use to catch it. He explains why fraud rings anchor fake profiles to a real Social Security number, how thin and fragmented credit files give the scheme away, and where graph-based AI models beat legacy rule-based checks — no hype, just how the detection actually works.

View full author bio, credentials, and links ⌄

Marcus Delray writes about synthetic identity theft and the bank detection systems built to stop it before losses land. His work traces how a fake profile is assembled from one real SSN — often stolen from a child, an elderly person, or someone who has died — paired with a made-up name, birthdate, and address, and why that single genuine piece lets the identity pass checks that trip up ordinary identity theft.

He digs into the signals banks actually watch: thin, unnaturally clean credit files with no footprint before a certain date, cross-bureau mismatches that only surface side by side, and identity stitching that reveals whether fragments belong to one continuous life. He explains where the Social Security Administration’s Consent-Based SSN Verification (CBSV) fits, and why cross-bureau data sharing matters when no single institution sees the whole picture.

His coverage also tracks the newer arms race: graph neural network (GNN) models that map accounts, devices, and identities as a connected web, deepfake face-swaps aimed at liveness selfies during account opening, and rPPG pulse-signal checks that flag a synthetic video even when the face looks real. The goal stays simple — give readers precise, honest explanations of how the fraud works, how banks respond, and how people can protect their own SSNs and credit files.

• Explains how banks spot synthetic identity theft by detecting thin, fragmented, and unnaturally clean credit histories with no footprint before a start date
• Covers SSN misuse, “Credit Profile Number” scams, and the SSA’s Consent-Based SSN Verification (CBSV) as a direct check on the identity’s one real piece
• Breaks down cross-bureau verification, identity stitching, and how graph-based AI and GNN models outperform legacy rule-based fraud systems
• Tracks deepfake account-opening attacks, rPPG liveness detection, mule-account overlap, and practical steps consumers can take to protect their SSNs and credit files

💼 Connect on LinkedIn 𝕏 Follow on X 🔗 Author Bio Page ✉️ Contact Editor