Synthetic Identity Fraud: How Email Is Used to Build It
How phishing emails collect fragments of real consumer data that are combined with fabricated details to create synthetic identities used for large-scale financial fraud.
Part of: Synthetic Identity Fraud
Last reviewed: 8 June 2026
Synthetic identity fraud differs from classic identity theft in a way that makes it particularly hard for individuals to detect: a synthetic identity combines a real person's identifying detail — most commonly a Social Security number — with fabricated names, dates of birth, and addresses to create a blended persona. The real person may have no visible credit activity associated with the fraud, yet their Social Security number is at the core of a fraudulent credit profile.
Email is a primary collection mechanism for the real data fragments that go into a synthetic identity. Phishing campaigns, data-capture forms, and email account compromises harvest Social Security numbers, Medicare numbers, and birth dates that are then combined with invented personal details. Victims of synthetic identity fraud often discover it only when they apply for credit or government benefits and find their Social Security number is already in use.
This guide explains how email-based data collection feeds synthetic identity fraud and what to monitor to detect early involvement.
How this scam works on email
The email-based collection phase may be a straightforward phishing attempt — a message impersonating a government agency, bank, or healthcare provider that requests a Social Security number for account verification. A single, accurate SSN is the core ingredient for a synthetic identity.
Alternatively, the collection is more gradual: an email captures a name and date of birth through one form, an insurer name and member ID through another, and a partial address from a third. These fragments, assembled from multiple sources including data breaches, are pieced together or supplemented with invented details to create a workable credit profile.
The fraudster then applies for credit using the synthetic identity, carefully builds a credit history over months, and eventually carries out a bust-out fraud — maxing out all available credit lines before abandoning the identity. The real person whose SSN anchors the synthetic profile may receive collection notices or see their SSN appear in contexts they do not recognise.
Common red flags
- You receive unexpected collection notices for accounts you never opened
- Your Social Security number shows up in an employment or credit check for records that are not yours
- Email asks for your SSN or full date of birth for an unexpected account verification
- You are denied credit because a duplicate SSN is already associated with different personal details
- Emails requesting confirmation of personal data across several systems in a short period
How to protect yourself
- Place a credit freeze with all three major credit bureaus so your SSN cannot be used to open new accounts without your authorisation
- Review your Social Security earnings record annually at ssa.gov to check for unexplained employment entries
- Monitor your credit report for accounts you do not recognise — access free reports at annualcreditreport.com
- Never provide your SSN in response to an unsolicited email, regardless of how official the sender appears
- Consider signing up for an identity monitoring service that alerts you to new accounts opened with your SSN
How to report it
- Report to the FTC at reportfraud.ftc.gov and follow the personalised recovery plan provided at identitytheft.gov
- Contact the Social Security Administration's OIG at 1-800-269-0271 if your SSN appears to be misused
- File a report with the IC3 at ic3.gov if the fraud has financial components
- Place a fraud alert with the major credit bureaus and request a review of any accounts associated with your SSN
Frequently asked questions
Will I know if my SSN is being used in a synthetic identity?
Possibly not immediately — synthetic identities are often built slowly and the real person may see no obvious credit activity. Monitoring your Social Security earnings record and freezing your credit are the most reliable early warning measures.
Can a credit freeze prevent synthetic identity fraud?
A credit freeze prevents new accounts from being opened under your SSN at the three major bureaus, making synthetic fraud significantly harder. It is one of the most effective protective steps available and does not cost you anything.