Synthetic identity fraud is not always based on stealing and using one real person’s complete identity. Fraudsters may combine genuine personal information with fabricated names, addresses, contact details, portraits, or documents to create an artificial customer profile.
The Federal Reserve describes synthetic identities as combinations of real and fictional information. Because the resulting identity may not correspond clearly to one victim, suspicious activity can remain undetected for longer than conventional identity theft. federalreserve.gov
For digital businesses, the challenge extends beyond detecting a false document during onboarding. A synthetic identity may gradually establish credibility, operate normally, and become more valuable before being used for sustained account abuse.
1. How a Synthetic Identity Is Assembled
A synthetic profile may contain several identity components:
- A real identification number associated with another person
- A fabricated or modified name
- A false date of birth or address
- A newly created email address and phone number
- A manipulated or counterfeit identity document
- A synthetic, stolen, or reused facial image
- Devices or payment instruments shared with other accounts
Individually, some attributes may appear plausible. The risk becomes clearer when the platform evaluates whether the attributes belong together and whether they are connected to previously identified accounts.
Synthetic identity fraud is therefore an entity-consistency problem, not simply a false-field problem.
2. The Initial Application
During onboarding, fraudsters may submit an identity that contains enough valid-looking information to pass basic checks.
A platform that validates only whether fields are present may miss important contradictions. OCR might accurately extract the submitted name and document number without determining whether the document is authentic or whether the information belongs to the applicant.
A stronger onboarding process can combine:
- Document-type and authenticity analysis
- OCR and field normalization
- Printed and encoded-data comparison
- Face comparison with the document portrait
- Liveness and capture-integrity checks
- Device, contact, and application-risk analysis
- Cross-account identity and biometric searches
Face++ supports the biometric layers through 1:1 face comparison, liveness detection, and 1:N face search. Its FaceID solution combines document checks, face matching, liveness, and risk controls for onboarding and other identity events.
3. Building a Plausible Account History
Synthetic identities may not be exploited immediately. Some accounts are maintained over time to create the appearance of a genuine customer relationship.
During this period, an account may show:
- Regular logins
- Small or routine transactions
- Stable contact information
- Successful repayments
- Gradual increases in activity
- Applications for additional products
- Connections with apparently unrelated accounts
This history can make the identity appear increasingly trustworthy. Rules that rely heavily on account age or previous successful activity may therefore assign more confidence than the underlying identity deserves.
Time does not convert weak identity evidence into reliable identity evidence.
4. From Credibility to Account Abuse
Once the account gains access, limits, or trust, its behavior may change. Potential abuse can include:
- Drawing down available credit
- Rapidly moving funds through several accounts
- Receiving funds from coordinated participants
- Using shared beneficiaries or payment instruments
- Opening additional accounts with related attributes
- Abandoning the account after extracting value
- Re-entering with a modified version of the identity
The activity may involve a single synthetic profile or a coordinated network of identities. Multiple accounts can share selected faces, documents, devices, addresses, contact details, or beneficiaries while appearing unrelated when reviewed individually.
FINRA has highlighted common identifying information across seemingly unrelated accounts as a synthetic-identity risk indicator.
5. Why One-Time KYC May Miss the Risk
Initial verification provides a snapshot of the evidence available during onboarding. It cannot predict every relationship or behavioral pattern that becomes visible later.
For example:
- A face may first appear unique but later be reused across accounts.
- A device may initially appear normal but become connected to coordinated applications.
- A contact detail may later appear across several profiles.
- Transaction behavior may diverge from the stated customer purpose.
- Profile changes may replace weak attributes after approval.
- A previously unseen beneficiary may become a hub for related accounts.
Digital platforms should therefore treat identity confidence as something that can change. Ongoing monitoring can reassess the account when new evidence appears.
6. Detecting Synthetic Identities Through Relationships
Effective detection requires both identity verification and entity linking.
Relevant signals can include:
- Reuse of identity fields across accounts
- Conflicting names, dates, addresses, or document data
- One face associated with multiple identities
- Multiple faces associated with one identity
- Shared devices, contact details, or payment relationships
- Unusual application velocity
- Coordinated profile changes
- Common beneficiaries
- Synchronized transaction behavior
- Repeated onboarding attempts after rejection
Face++ 1:1 verification can assess whether the current user matches a trusted portrait. Face Search can support 1:N analysis by identifying similar faces within an enrolled collection. Liveness detection adds genuine-presence analysis but should be combined with document, device, behavioral, and network evidence. faceplusplus.com
A biometric match or shared device is an investigative signal—not automatic proof of fraud.
7. A Risk-Based Response
Not every inconsistency should produce immediate rejection. Legitimate households, reused devices, name changes, data-entry errors, and document renewals can create apparent relationships.
A proportionate workflow may:
- Continue low-risk activity
- Request corrected or additional evidence
- Perform Face++ face reverification and liveness detection
- Refresh expired document information
- Apply enhanced transaction monitoring
- Link the case to related accounts for investigation
- Route unresolved clusters to manual review
- Restrict activity when combined evidence indicates material risk
The platform should preserve the original evidence, relationship indicators, model outputs, policy version, and final decision for investigation and auditability.
8. Frequently Asked Questions
Q1. Is synthetic identity fraud the same as identity theft?
No. Traditional identity theft generally impersonates a specific person. A synthetic identity combines real and fabricated information to create an artificial profile.
Q2. Can a synthetic identity pass KYC?
Yes. It may pass weak or isolated checks when individual fields appear valid. Layered document, biometric, device, and relationship analysis provides stronger protection.
Q3. How can Face++ help detect synthetic identity fraud?
Face++ face comparison can bind a current user to a trusted portrait, liveness detection can evaluate genuine presence, and Face Search can identify possible facial reuse across enrolled identities.
Q4. Why is ongoing monitoring necessary?
Cross-account links and abusive behavior may become visible only after onboarding. Monitoring helps identify changes in identity, devices, relationships, and transactions over time.
9. Detect the Identity Behind the Account
Synthetic identity fraud succeeds when plausible attributes are evaluated separately and historical activity is mistaken for proof of identity.
By combining document analysis with Face++ face comparison, Face Search, liveness detection, device intelligence, behavioral monitoring, and entity linking, digital platforms can evaluate both the profile presented at onboarding and the relationships that emerge afterward.
The objective is not simply to verify fields. It is to determine whether the customer represents a coherent, persistent, and independently supported identity.
