Creating Phantoms: How Fraud Actors Build Synthetic Identities
The article explains how fraud actors create synthetic identities—fraudulent personas built from fictitious or partially fabricated personal information—by exploiting document and data verification processes, using a single authoritative identity document as a backbone and various easily forged residency proofs to bypass KYC checks and commit financial crimes, exemplified by the AI-generated persona Arthur Vance.
This is Arthur Vance, the head of fraud research at Proof. However, Arthur is not a real person—he is a synthetic identity created by artificial intelligence, illustrating the growing threat of synthetic identity fraud.
Proving identity often relies on documents and data, which fraud actors exploit by creating entirely new identities, or "phantoms," rather than stealing existing ones. These synthetic identities are carefully constructed to appear legitimate and are used to commit fraud.
What is a Synthetic Identity?
A synthetic identity is a fraudulent persona created for financial crimes or to conceal one's true identity. These identities are made from completely or partially fictitious Personally Identifiable Information (PII), forming a new identity. They are used to bypass Know Your Customer (KYC) checks and create accounts for:
- Directly committing fraud
- Reinforcing identity for future fraud
- Monetizing access or services
Anatomy of a Synthetic Identity
To understand what is needed to create a synthetic identity, consider the requirements for proving your own identity. The US Federal Government's "REAL ID" requirements, enforced from 2025, provide a useful framework:
- Proof of Identity: Requires one authoritative document (e.g., passport, birth certificate, Permanent Resident Card). Fraud actors need only one high-value document to serve as the backbone of a synthetic persona.
- Proof of Residency: Organizations accept a wide variety of documents, making them easier targets for forgery. These include:
- Financial Records: Bank statements, credit card bills, mortgage statements
- Utility & Service Bills: Electricity, water, gas, or cell phone bills
- Government Correspondence: Tax returns, voter registration cards, government letters
- Housing Agreements: Rental/lease agreements, property deeds, tax bills
- Institutional Records: School documents, insurance policies, employment records
For broader classification:
- Anchor Document: The cornerstone of an identity (e.g., passport)
- Supporting Document: Adds legitimacy to the identity (e.g., utility bill)
Fraud actors only need a combination of documents that pass checks at their target organization. Each accepted fraudulent document reinforces the synthetic identity, making future fraud easier.
As verification technologies advance, biometric validation is more common. Fraud actors now use generative AI (GenAI) to create digital specters—realistic, non-existent entities that can bypass liveness detection and appear present when required.
Tools of the Trade
Fraud actors use a range of tools to create and legitimize synthetic identities, often shared within the Fraud-as-a-Service (FaaS) ecosystem.
PII Generation and Acquisition
- PII Generators: Online tools generate plausible personal details, including names, dates of birth, and addresses. Advanced generators can create addresses that validate against postal databases.
- Illicit Marketplaces: Dark web forums and Telegram channels sell "fullz"—packages of stolen PII.
- Credit Privacy Numbers (CPNs): Nine-digit numbers resembling Social Security Numbers (SSNs), either fabricated or stolen from vulnerable individuals, marketed as a way to protect identity or fix credit.
- Social Media Scraping: Automated tools harvest details from public profiles to add credibility to synthetic personas.
Document Fabrication and Modification
- Document Templates: Editable templates (often Photoshop files) for utility bills, bank statements, pay stubs, and tax records are widely traded.
- On-Demand Forgery Services: Vendors on illicit markets create custom documents tailored to specific requirements.
Generative AI
- Synthetic Media Generation: AI models generate realistic images, videos, and voices for synthetic identities. Tools like "This Person Does Not Exist" are widely available.
- Text Generation: Large Language Models (LLMs) create plausible background stories, fake social media histories, and scripts for phishing or customer support, further legitimizing the identity.
Impact of Synthetic Identity Fraud
Synthetic identity fraud is one of the fastest-growing financial crimes in the U.S., with projected losses of at least $23 billion by 2030. When a synthetic identity executes a "bust-out" (maxing out credit lines before disappearing), the average loss to financial institutions can be $15,000 per incident.
For individuals, the impact can go unnoticed. Legitimate SSNs used in synthetic profiles can result in fragmented credit files and damaged credit scores, sometimes only discovered when applying for credit for the first time.
How to Protect Yourself and Your Organization
For individuals, protections are similar to those against identity theft:
- Use your SSN sparingly to reduce risk of exposure.
- Monitor your credit regularly for suspicious activity.
- Freeze your credit at all major bureaus to prevent unauthorized credit attempts. Also freeze the credit of children under your care.
For organizations, combating synthetic identity fraud requires a multi-faceted approach:
Fabrication or Modification of Documents
Defenses include detecting:
- Digital alterations of document scans
- Inconsistent details
- Physical fakes
- Use of digital templates
Proof uses a multi-layered approach, including:
- Credential Analysis: Over 25 verification checks on IDs in under five seconds, analyzing for alterations and inconsistencies.
- AAMVA Check: For U.S. IDs, compares information and barcodes with DMV records to flag discrepancies.
Deepfakes
Deepfakes can bypass traditional checks by presenting a synthetic persona. Defenses include:
- Employing liveness detection to verify a real, live individual
- Cross-referencing fraud signals (IP addresses, browser telemetry, etc.)
- Human-in-the-loop verification for subtle discrepancies
Proof's solutions include:
- AI-powered Identity Verification and Deepfake Detection: Combining AI and human verification with deepfake detection.
- Real-time Fraud Detection and Risk Signals: Monitoring over 100 risk signals in real-time, with alerts for high/medium risk customers.
- Critical Human Oversight: Routing to fraud agents or notaries if automated verification fails.
- Staff Training and Digital Forensics: Training teams to spot suspicious content and recommending digital forensics tools.
By leveraging these solutions, organizations can stay ahead of malicious actors, building trust and transparency in a digital world. A comprehensive, layered approach is critical for mitigating the impact of deepfakes and sophisticated fraud attempts, ensuring a secure and trustworthy digital future.
Related
Top 10 Identity Verification Solutions to Consider in 2026
The 2026 guide on top identity verification solutions highlights the need for advanced IDV platforms like Proof that combat AI-driven fraud such as deepfakes and synthetic identities by offering high-assurance, legally defensible verification with biometric and document checks, human review, and transaction-level evidence tailored for regulated, high-value, and legally binding digital interactions.
Deepfake Scams: How to Spot and Protect Your Business
Deepfakes, AI-generated realistic but fabricated audio and visual content, pose significant risks to businesses by enabling sophisticated fraud, misinformation, and identity theft, making it crucial for companies to learn how to detect these manipulations and employ fraud protection services like Proof to safeguard their operations.
Multi-Signal Fraud Detection Benchmarks
Proof has developed a layered fraud detection model that combines passive signals, active checks, and collective telemetry from its Identity Authorization Network to outperform traditional passive-only methods by 600-1,300% in detecting sophisticated fraud without increasing user friction, addressing the shortcomings of standard approaches like MFA and KBA that are increasingly ineffective against targeted attacks.
Deepfakes and Real Estate Fraud
The article discusses how AI-generated deepfakes, created using technologies like Generative Adversarial Networks, have become a significant threat to the real estate industry by enabling fraudsters to impersonate property owners and authorize fraudulent transactions, highlighting the industry's vulnerability due to high-value deals and outdated verification methods, and emphasizing the need for advanced, layered security solutions like biometric analysis and live supervised verification to effectively detect and prevent such sophisticated scams.
The Fraud Files: Stolen Credentials, Fake Biometrics, and the Synthetic Identity Wave (June 2026)
A June 2026 report reveals that financial institutions' traditional identity verification methods—relying on secret information, trusted documents, and biometric authenticity—are under massive commercial-scale attack, with infostealer malware in 2025 exfiltrating over 1.8 billion credentials from 5.8 million devices (an 800% increase), leading to widespread circulation of valid stolen banking and payment card data on dark web marketplaces, fueling account takeovers, synthetic identity fraud, and ransomware attacks, thereby exposing the critical vulnerabilities in current security assumptions.
Deepfakes in the Financial Services Industry | Proof
The article discusses how AI-generated deepfakes pose significant fraud risks to financial services by exploiting the fraud triangle—motivation, opportunity, and rationalization—enabling sophisticated attacks like account takeover and payment fraud, while highlighting Proof's AI-driven platform that detects deepfake anomalies in real time to protect institutions from these emerging threats.