Fraud teams are increasingly realizing their onboarding controls aren't catching synthetic identity fraud. This type of fraud doesn't trigger the usual alarms, there's no victim disputing charges or credit bureau alerts. By the time it's noticed, the fraudster has already moved on.
One in ten fraud attempts now involves synthetic data, and AI is worsening the problem by helping attackers build convincing profiles faster. Your team is asking the right questions. Here's what we're hearing and how to address them.
Do We Need to Verify Identity More Than Once?
Yes. The one-and-done model fails because legitimate customers change devices, move, alter spending patterns, and add beneficiaries. Fraudsters mimic these changes. If you verified an identity six months ago and haven't checked since, you're assuming nothing has changed, not the device, behavior, or risk profile.
Continuous verification doesn't mean re-uploading a driver's license weekly. It means evaluating signals at decision points: when a device changes, a transaction deviates from norms, or a high-risk action occurs. You're not asking "Is this the right person?" once. You're asking "Does this action fit what we know about this account?" whenever something significant shifts.
The gap isn't in your initial KYC process. It's in assuming verification is a one-time gate rather than an ongoing posture.
What Signals Matter in a Layered Approach?
Focus on signals you can cross-reference independently. A synthetic identity might pass document verification if the fraudster has a real Social Security Number and fabricated supporting docs. But inconsistencies emerge when you layer in:
- Device fingerprinting and IP geolocation: Does the device match prior sessions? Is the IP consistent with the stated address?
- Behavioral biometrics: Typing cadence, navigation patterns, session duration, these are harder to fake at scale.
- Authoritative data sources: Government records, utility connections, employment verification. These don't rely on documents the applicant controls.
- Velocity checks: How many accounts has this email, phone number, or device opened in the past 30 days across your network and shared intelligence feeds?
- Transaction context: Does a $10,000 wire transfer align with account history, stated income, and typical use patterns?
No single signal is definitive. A synthetic might have a real SSN. A legitimate customer might use a VPN. The fraud signal comes from the pattern, when multiple factors don't align, you investigate before approving, not after payout.
How Do We Balance Fraud Prevention with Customer Experience?
The goal isn't to add friction everywhere. It's to add friction selectively, high for anomalies, low for expected behavior. If a customer logs in from their usual device, in their usual location, and initiates a transaction consistent with their history, the experience should be frictionless. If that same customer suddenly logs in from a new device in a different state and attempts a wire transfer to a new beneficiary, step-up authentication is justified.
This requires risk scoring that updates in real time, not batch processes that flag accounts after the fact. Your system should route low-risk actions through automated approval and escalate high-risk actions to manual review or additional verification. Customers who behave predictably won't notice the controls. Fraudsters, who by definition deviate from established patterns, will hit resistance at every turn.
Friction should correlate with risk, not be uniformly distributed.
Can AI Tools Help Us, or Are They Just Making Fraud Worse?
AI is making fraud worse by speeding up synthetic identity creation, fraudsters can generate documents, fake biometrics, and mimic behaviors faster than manual review can catch them. But the same technology that accelerates fraud can accelerate defense if you deploy it correctly.
Machine learning models can identify subtle inconsistencies across data points that rule-based systems miss. They can detect behavioral anomalies in real time, flag velocity patterns across accounts, and adapt as fraud tactics evolve. The key is feeding these models the right signals, authoritative data, device telemetry, transaction context, network intelligence, not just the documents the applicant provides.
If your AI stack only analyzes what the fraudster controls (uploaded docs, stated information), you're automating approval of sophisticated fakes. Effective AI-driven fraud prevention pulls in independent verification signals that the fraudster can't manipulate.
What Does "Authoritative Data" Mean in Practice?
Authoritative data is information you pull from independent sources rather than relying on what the applicant provides. Examples:
- Government records: SSN validation through the Social Security Administration's Consent Based SSN Verification service, not just format checks.
- Utility and telecom records: Does the stated address match active utility connections or phone service in that name?
- Employment verification: Does the stated employer confirm this person works there, or can you verify income through payroll data providers?
- Credit bureau tradelines: Does the credit history show depth and consistency, or is it thin-file with recent rapid expansion?
Synthetic identities often pass document checks because fraudsters have access to real SSNs (from minors, deceased individuals, or data breaches) and can fabricate supporting docs. Authoritative data forces validation against records the fraudster doesn't control. When the SSN is real but no utility, employment, or credit history aligns with the stated profile, you've found the seam.
Where Should We Start if Our Verification is Mostly Onboarding-Focused?
Start by identifying where synthetic identities have gotten through. Pull accounts flagged for fraud in the past 12 months and reverse-engineer what signals were present at onboarding that you didn't act on. Common patterns:
- Thin or no credit file despite stated employment history
- Device or IP inconsistent with stated address
- Email domain or phone number recently created
- Velocity: same device or contact info used across multiple applications
Then instrument continuous checks at key decision points: device changes, beneficiary additions, large transactions, address updates. You don't need to rebuild your entire stack overnight. Add one layer, device fingerprinting, authoritative data validation, behavioral biometrics, and measure impact before adding the next.
The shift isn't technical as much as conceptual: stop treating identity verification as a gate and start treating it as an ongoing posture. Fraudsters are patient. Your controls need to be persistent.
Where to Go for More
Review NIST SP 800-63B for identity assurance levels and how they map to risk-based verification requirements. If you're in a regulated environment, your examiner will expect you to articulate why your verification approach matches the risk profile of your customer base. "We check ID at onboarding" won't hold up when synthetic identities are a known, measurable threat in your portfolio.
Collaborate with your peers. Synthetic identity fraud thrives in isolation, when each institution only sees its own accounts, patterns stay hidden. Shared intelligence networks and consortium data make velocity checks and cross-institution behavioral analysis possible. If you're defending alone, you're already behind.
