Synthetic Identity Fraud
Fraudsters combine real and fabricated personal data to create a new 'synthetic' identity, then build credit before vanishing with borrowed funds. Victims often do not realise until a debt collector calls years later.
Last reviewed: 1 June 2026
What this scam is
Synthetic identity fraud is the fastest-growing form of financial crime. Unlike classic identity theft, the attacker does not clone your entire identity — instead, they pair one genuine piece of your data (most commonly a Social Security Number or National Insurance number) with a completely invented name, date of birth, and address. The resulting 'person' is a chimera that passes automated checks because one real anchor makes the profile look plausible.
Lenders relying on traditional fraud detection look for mismatches between name, date of birth, and identifier. A synthetic profile passes those checks because only the identifier is real — everything else is consistent with itself, just invented. Children, elderly people, and individuals with dormant credit files are especially at risk because years can pass before anyone reviews the associated identifier.
The harm is diffuse but serious. Your credit score can be damaged by unpaid accounts you never knew existed. Debt collectors may pursue you. Government benefits tied to your identifier can be claimed by the fraudster. Untangling the damage requires contacting credit bureaux, filing a police report, and working through each affected account — a process that can take twelve to thirty-six months.
How it works
Criminals first acquire real identifiers through data breaches, dark-web marketplaces, or by targeting demographic groups with thin credit histories. They attach a plausible but fake name and address, then apply for a secured credit card or credit-builder loan — products designed for people with no credit history, where approval thresholds are low.
Over six to twenty-four months the fraudster responsibly pays small balances, building a credit score for the synthetic persona. They may add the identity as an authorised user on other fraudulent accounts to accelerate credit growth. Once the credit limit is high enough, they execute a 'bust-out': maxing every available line simultaneously and disappearing. The lender writes off the loss; the real identifier owner is left with contaminated records.
Because the victim's name does not appear on the fraudulent accounts — only their identifier — the usual credit-monitoring alerts may never fire. Discovery typically happens when the victim is denied credit, receives unexpected debt-collection communications, or a credit bureau merges the synthetic file with the victim's own file following a query.
Why this scam works
Synthetic identity fraud exploits the seam between automated fraud-detection systems and the reality that one genuine data point can anchor an otherwise invented profile. Lenders using only basic cross-referencing are fooled because the name and address are internally consistent — only the identifier is 'borrowed'. Credit-building tools meant to help underserved communities also inadvertently lower the barrier to entry for this fraud. Victims cannot be warned because, from their perspective, nothing unusual has happened to their own accounts; the damage accumulates silently in a parallel file they cannot see.
Common red flags
- Debt-collection letters or calls for accounts you never opened
- Credit report shows accounts or addresses you do not recognise
- Loan or credit application denied for 'existing derogatory accounts'
- Tax authority flags a duplicate filing using your identifier
- Government benefit denial citing 'already claimed' status
- Credit file contains a name variation you have never used
- New credit enquiries appear on your report from lenders you never contacted
- Social Security statement shows earnings from an employer you did not work for
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Dear [Your Name], your credit application has been declined due to a derogatory account balance of [Amount] with [Lender Name]. Please call [Number] to dispute.
This is [Collection Agency] regarding account [Number] in the name of [Fake Name] associated with your Social Security Number. You owe [Amount].
Notice: a new credit account has been opened using identifier [Last 4 Digits]. If this was not you, call [Fraud Line Number].
Your tax return cannot be processed — a return has already been filed for your Social Security Number this year.
[Government Agency]: your application for [Benefit] has been denied. Our records indicate [Benefit] is already being paid to your account number.
Common variations
- Child identity theft (identifier taken from a minor with no active credit file)
- Elderly bust-out (targeting pensioners whose dormant credit files are rarely checked)
- Authorised-user 'piggybacking' to accelerate synthetic-file credit growth
- Tax-refund synthetic fraud (filing returns under synthetic identity using real SSN)
- Government-benefit harvesting using synthetic profiles anchored to real identifiers
How to verify before you act
Check your credit report at least once a year — free in both the US (AnnualCreditReport.com) and UK (statutory report via each bureau). Look for accounts, addresses, and name variations you do not recognise. In the US, review your Social Security statement at ssa.gov for unrecognised earnings. If you have a child or an elderly relative, consider placing a preventive credit freeze on their file even before they need credit — this costs nothing and blocks new-account fraud entirely. If you suspect your identifier has been used, contact the fraud department of any lender on the suspicious account; they have a legal obligation to work with genuine victims.
Payment methods used
- Cryptocurrency
- Bank/wire transfer
- Gift cards
- Money transfer services
- Payment apps to 'friends & family'
Who is usually targeted
- Children with no active credit file
- Elderly individuals with dormant credit
- People with recent bankruptcy or thin credit
- Immigrants with newly issued identifiers
What to do immediately
- Place a credit freeze at all three major bureaux (Equifax, Experian, TransUnion in the US; Experian, Equifax, TransUnion in the UK)
- Request a full credit report and highlight every account or enquiry you do not recognise
- File a police report and obtain the case number — you will need it for disputes
- Submit an identity theft report at IdentityTheft.gov (US) or Action Fraud (UK)
- Contact each affected lender in writing to dispute accounts you did not open
- Alert your national tax authority if a duplicate filing was made on your identifier
- Set up credit monitoring alerts so you are notified of any future new-account enquiries
How to prevent it
- Place a proactive credit freeze on your file and those of your dependants
- Review your credit report from all three bureaux annually
- Monitor your Social Security earnings record for unknown employers
- Shred documents containing your national identifier before disposal
- Use a mail-locking letterbox or PO Box to prevent mail interception
- Enable alerts on any existing credit accounts for new-enquiry notifications
- Avoid sharing your national identifier unless legally required
Evidence to preserve
- Full credit reports from all bureaux showing fraudulent accounts
- Debt-collection letters or recorded calls referencing accounts you did not open
- Police report number and a copy of the filed report
- Screenshots or printouts of credit-monitoring alerts
- Any government correspondence referencing your identifier in connection with unknown claims
- Written dispute letters and lender responses
- Identity theft affidavit (IRS Form 14039 in the US, or equivalent)
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
Will I be held liable for debts run up on a synthetic identity using my SSN?
No. Once you file an identity theft report and dispute the accounts in writing, lenders are required to investigate. You are not legally responsible for debts you did not incur. The process can be slow, but the law protects you.
How do I know if a synthetic profile already exists using my identifier?
Request your full credit report from each major bureau and look for accounts, addresses, or name variants you do not recognise. In the US, also check your Social Security statement for unknown earnings. A credit freeze adds an extra layer of protection even if you find nothing suspicious.