This is Arthur Vance, the head of fraud research at Proof. However, Arthur is not a real person—he is a synthetic identity created by artificial intelligence, illustrating the growing threat of synthetic identity fraud.

Proving identity often relies on documents and data, which fraud actors exploit by creating entirely new identities, or "phantoms," rather than stealing existing ones. These synthetic identities are carefully constructed to appear legitimate and are used to commit fraud.

What is a Synthetic Identity?

A synthetic identity is a fraudulent persona created for financial crimes or to conceal one's true identity. These identities are made from completely or partially fictitious Personally Identifiable Information (PII), forming a new identity. They are used to bypass Know Your Customer (KYC) checks and create accounts for:

• ​Directly committing fraud
• ​Reinforcing identity for future fraud
• ​Monetizing access or services

Anatomy of a Synthetic Identity

To understand what is needed to create a synthetic identity, consider the requirements for proving your own identity. The US Federal Government's "REAL ID" requirements, enforced from 2025, provide a useful framework:

• ​Proof of Identity: Requires one authoritative document (e.g., passport, birth certificate, Permanent Resident Card). Fraud actors need only one high-value document to serve as the backbone of a synthetic persona.
• ​Proof of Residency: Organizations accept a wide variety of documents, making them easier targets for forgery. These include:
  • ​Financial Records: Bank statements, credit card bills, mortgage statements
  • ​Utility & Service Bills: Electricity, water, gas, or cell phone bills
  • ​Government Correspondence: Tax returns, voter registration cards, government letters
  • ​Housing Agreements: Rental/lease agreements, property deeds, tax bills
  • ​Institutional Records: School documents, insurance policies, employment records

For broader classification:

• ​Anchor Document: The cornerstone of an identity (e.g., passport)
• ​Supporting Document: Adds legitimacy to the identity (e.g., utility bill)

Fraud actors only need a combination of documents that pass checks at their target organization. Each accepted fraudulent document reinforces the synthetic identity, making future fraud easier.

As verification technologies advance, biometric validation is more common. Fraud actors now use generative AI (GenAI) to create digital specters—realistic, non-existent entities that can bypass liveness detection and appear present when required.

Tools of the Trade

Fraud actors use a range of tools to create and legitimize synthetic identities, often shared within the Fraud-as-a-Service (FaaS) ecosystem.

PII Generation and Acquisition

• ​PII Generators: Online tools generate plausible personal details, including names, dates of birth, and addresses. Advanced generators can create addresses that validate against postal databases.
• ​Illicit Marketplaces: Dark web forums and Telegram channels sell "fullz"—packages of stolen PII.
• ​Credit Privacy Numbers (CPNs): Nine-digit numbers resembling Social Security Numbers (SSNs), either fabricated or stolen from vulnerable individuals, marketed as a way to protect identity or fix credit.
• ​Social Media Scraping: Automated tools harvest details from public profiles to add credibility to synthetic personas.

Document Fabrication and Modification

• ​Document Templates: Editable templates (often Photoshop files) for utility bills, bank statements, pay stubs, and tax records are widely traded.
• ​On-Demand Forgery Services: Vendors on illicit markets create custom documents tailored to specific requirements.

Generative AI

• ​Synthetic Media Generation: AI models generate realistic images, videos, and voices for synthetic identities. Tools like "This Person Does Not Exist" are widely available.
• ​Text Generation: Large Language Models (LLMs) create plausible background stories, fake social media histories, and scripts for phishing or customer support, further legitimizing the identity.

Impact of Synthetic Identity Fraud

Synthetic identity fraud is one of the fastest-growing financial crimes in the U.S., with projected losses of at least $23 billion by 2030. When a synthetic identity executes a "bust-out" (maxing out credit lines before disappearing), the average loss to financial institutions can be $15,000 per incident.

For individuals, the impact can go unnoticed. Legitimate SSNs used in synthetic profiles can result in fragmented credit files and damaged credit scores, sometimes only discovered when applying for credit for the first time.

How to Protect Yourself and Your Organization

For individuals, protections are similar to those against identity theft:

• ​Use your SSN sparingly to reduce risk of exposure.
• ​Monitor your credit regularly for suspicious activity.
• ​Freeze your credit at all major bureaus to prevent unauthorized credit attempts. Also freeze the credit of children under your care.

For organizations, combating synthetic identity fraud requires a multi-faceted approach:

Fabrication or Modification of Documents

Defenses include detecting:

• ​Digital alterations of document scans
• ​Inconsistent details
• ​Physical fakes
• ​Use of digital templates

Proof uses a multi-layered approach, including:

• ​Credential Analysis: Over 25 verification checks on IDs in under five seconds, analyzing for alterations and inconsistencies.
• ​AAMVA Check: For U.S. IDs, compares information and barcodes with DMV records to flag discrepancies.

Deepfakes

Deepfakes can bypass traditional checks by presenting a synthetic persona. Defenses include:

• ​Employing liveness detection to verify a real, live individual
• ​Cross-referencing fraud signals (IP addresses, browser telemetry, etc.)
• ​Human-in-the-loop verification for subtle discrepancies

Proof's solutions include:

• ​AI-powered Identity Verification and Deepfake Detection: Combining AI and human verification with deepfake detection.
• ​Real-time Fraud Detection and Risk Signals: Monitoring over 100 risk signals in real-time, with alerts for high/medium risk customers.
• ​Critical Human Oversight: Routing to fraud agents or notaries if automated verification fails.
• ​Staff Training and Digital Forensics: Training teams to spot suspicious content and recommending digital forensics tools.

By leveraging these solutions, organizations can stay ahead of malicious actors, building trust and transparency in a digital world. A comprehensive, layered approach is critical for mitigating the impact of deepfakes and sophisticated fraud attempts, ensuring a secure and trustworthy digital future.