Synthetic Identity Fraud

Synthetic identity fraud is a form of identity crime in which criminals construct a new identity by blending real identifying information — typically a legitimate Social Security or national insurance number — with fabricated details such as a false name, date of birth, and address. The resulting identity has no real person behind it, making it significantly harder to detect than traditional identity theft.

Generative AI has made this form of fraud easier to execute. AI tools can produce realistic-sounding names, consistent biographical details, and even synthesised documents such as utility bills and identification. When combined with a real identifier obtained from a data breach, the synthetic identity can open credit accounts, apply for loans, and accumulate debts — often without any living person being directly aware until they check their own credit file or apply for credit themselves.

While businesses and lenders are the primary victims of the credit losses, individuals are harmed when their real identifiers are used as the foundation for a synthetic profile. Untangling the damage can take significant time and effort.

The criminal obtains a legitimate Social Security or national insurance number — typically from a data breach, a phishing attack targeting a child or inactive adult whose credit history is thin, or by purchasing stolen data. They then construct a fictitious identity around it: a false name, a synthetic date of birth, and a fabricated address.

This synthetic identity is then 'aged' — credit applications are made, small lines of credit are opened and managed responsibly for months, and the credit profile builds. Because the name does not match any real person, there is no victim monitoring the credit file. Over time, the synthetic profile reaches a sufficient credit score to access larger credit facilities.

At the point of maximum creditworthiness, the criminal 'busts out' — applying for every available credit product simultaneously and drawing maximum limits before disappearing. The lenders hold debts associated with an identity that does not exist as a person, while the real number holder may find their identifier has contaminated records.

AI is used to generate convincing supporting documentation, create consistent biographical details across multiple application forms, and in some cases to generate synthetic voices or images for identity verification steps.

Synthetic identity fraud is particularly difficult to detect because there is no real victim in the traditional sense. When a real person's complete identity is stolen, they notice relatively quickly — bills arrive, accounts are accessed, credit cards are declined. With a synthetic identity, the real person whose number was used may never know until they check their credit file or encounter a contaminated record.

Lenders are the primary victims of the financial loss, but their fraud detection systems are calibrated to identify profiles that look like known fraud patterns. A carefully aged synthetic profile, managed responsibly over many months, looks like a genuine consumer until the bust-out occurs.

AI-generated supporting documents — utility bills, bank statements, photo IDs — have improved sufficiently that automated document verification systems are sometimes deceived, reducing the human review that might otherwise catch inconsistencies.

Your credit report shows a new account opened in your name that you do not recognise. Contact the relevant credit reference agency immediately.

You have received a debt collection notice for a balance on an account you have never opened.

A credit enquiry from [lender] appears on your file from a date when you were not applying for credit.

Check your credit report regularly through all three major agencies. In the UK, these are Experian, Equifax, and TransUnion — each maintains a separate file and all three should be checked. In the US, annual free reports are available at AnnualCreditReport.com.

If you see any entry you do not recognise — an address, an enquiry, a credit account — dispute it immediately. Promptly disputed entries are removed or marked while under investigation, which limits the damage.

Consider placing a credit freeze on your file. In the US, freezes are free and prevent new accounts from being opened without additional verification. In the UK, CIFAS protective registration achieves a similar result.

Sign up for a data breach notification service to be alerted when your email address or phone number appears in known breaches.