A synthetic identity isn't a stolen identity. It's a constructed one: a real Social Security Number (often belonging to a child or someone with minimal credit history) combined with a fabricated name, address, and phone number. The resulting persona has no prior fraud record because it's never existed before. KYC passes. The account opens. And then the identity goes quiet for weeks, sometimes months, building a thin but technically clean credit profile.
The bust-out happens later: a rapid succession of high-value transactions against every credit line the synthetic persona has accumulated, followed by complete account abandonment. By that point, detection after the fact is relatively easy. The problem is that everything before the bust-out looks completely legitimate. The interesting question is whether there's a detectable anomaly at the moment the synthetic identity attempts its first high-value transaction.
There is. But it requires looking at the right signals.
How Synthetic Identities Get Through KYC
Standard KYC performs three checks: identity document verification, SSN-to-name match via credit bureau, and sanctions/watchlist screening. Synthetic identities are specifically designed to pass all three. The SSN is real, so the bureau match returns a positive. The document is often a convincing forgery or a legitimately issued document in a fabricated name. Sanctions screening returns nothing because the name and identity have no prior history of any kind.
Where KYC falls short is that it's a point-in-time check, not a longitudinal behavioral check. It answers "does this identity exist and is it clean" rather than "does this identity behave like a real person with this profile." Those are different questions, and synthetic fraud exploits the gap between them.
Some lenders have started layering behavioral KYC on top of document KYC: checking whether the supplied address has utility records, whether the phone number has carrier history consistent with the stated identity age, whether the email address was created this week or three years ago. These additional signals are useful, but they're static. They still describe the identity at one moment in time. They don't tell you whether the identity is about to behave like a synthetic fraud persona.
The Behavioral Pattern at First High-Value Attempt
What we've found through examining confirmed synthetic identity fraud cases is that the bust-out attempt has a distinctive behavioral fingerprint that doesn't match how real users execute high-value transactions.
Real users executing their first high-value transaction with a financial institution typically do it with some hesitation markers: they may check their balance first, revisit the product page, or contact support. They often arrive at the transaction through a session that includes prior browsing. The transaction itself takes some time to complete. The cursor moves the way a person deciding actually moves a cursor.
Synthetic identity fraud at bust-out moves differently. The session starts and proceeds directly to the high-value transaction with minimal navigation. Form fill timing is fast and consistent across fields, consistent with automated or rehearsed input rather than someone reading and typing. There's no back-navigation, no hesitation, no comparison shopping behavior in the session. The account might have had two or three low-value transactions over the preceding weeks, all normal-looking. Then the behavioral profile shifts sharply.
That session-level behavioral discontinuity is the signal. It's not present in the static identity attributes; it emerges at the moment of the bust-out attempt. A model that only looks at identity-level features will miss it entirely.
The Profile Building Phase: Thin but Patterned
Before the bust-out, synthetic identities tend to run a predictable credit-building or account-seasoning pattern. A synthetic account that shows up at a digital bank or fintech platform will often have a short history of small, successful transactions. Direct deposit setup. A low-balance savings account. A small personal loan that gets repaid on schedule. The goal is to build enough history to unlock higher credit limits.
What's telling is the spacing and timing of these profile-building transactions. Real users make financial decisions in response to life events: a paycheck arrives, a bill is due, an opportunity presents itself. The transaction cadence is irregular in a human way. Synthetic fraud accounts running parallel profile-building across multiple institutions tend to show extremely regular spacing: consistent transaction days of the month, consistent amounts, and consistent product types. The regularity isn't a red flag on its own. But when it's combined with other signals, it matters.
We built a simple feature for this: "regularity score" based on the coefficient of variation of inter-transaction intervals. Real accounts have high variation. Synthetic profile-building accounts tend to have low variation, sometimes strikingly so. A regularity score below a certain threshold, paired with a new account and a sudden high-value transaction, is a meaningful risk signal.
Graph Structure and Synthetic Identity Rings
Synthetic identities rarely operate alone. A single fraudster typically runs dozens of synthetic personas simultaneously, and they share infrastructure: the same device or device pool, IP addresses from the same network, email addresses from the same provider with similar creation dates, and billing addresses that are variants of a small set of real addresses (a real address with a non-existent apartment number appended, for example).
The individual accounts in a synthetic fraud ring look clean in isolation. The graph structure gives them away. If a device has touched five accounts at onboarding across a 30-day window, and three of those accounts are now in a profile-building phase with similar transaction regularity, that device should be treated as compromised even before any of those accounts attempts a bust-out.
This is a case where real-time graph traversal at transaction time is worth the engineering complexity. Scoring a transaction not just against the account's own history but against the device's cross-account history catches rings that account-level scoring misses entirely.
Why Velocity Rules Alone Fail Here
Velocity rules are designed to catch high-frequency behavior: many transactions, many attempts, many cards. Synthetic identity bust-outs are often a single high-value transaction per account. The velocity, from the account's perspective, is low. From the device's perspective across all synthetic accounts, the velocity is high, but that requires cross-account linkage that a simple velocity counter won't perform.
The other failure mode is the timeline. Velocity rules operate on windows measured in minutes or hours. Synthetic identity fraud operates on windows measured in weeks. There's no meaningful velocity signal at the account level within a standard monitoring window. The pattern only becomes visible when you look at the full account lifecycle, not just the recent window.
We're not saying velocity rules have no place in synthetic fraud detection. A sudden velocity spike within a synthetic account session is still a real-time signal worth catching. But as a primary defense against synthetic identity fraud, velocity rules miss the category by design.
What Actually Catches Synthetic Identity Before Bust-Out
The detection approach that works is layered across three dimensions.
First, static identity graph checks at onboarding. Not just "does this SSN exist" but "how many accounts share components of this identity graph within the last 90 days." A real person creating their second fintech account isn't sharing device fingerprints, email domains, and address variants with eight other new accounts from the past month.
Second, behavioral regularity scoring during the profile-building phase. Transactions that are suspiciously regular over a 4-to-8 week window, combined with a new account and thin identity, are worth flagging for review before the bust-out attempt.
Third, session-level behavioral analysis at the first high-value transaction. The behavioral discontinuity between the profile-building phase and the bust-out session is detectable if you're capturing session telemetry. The form-fill speed, navigation path, and cursor behavior at the moment of the high-value attempt are often the clearest signal you'll see before the loss is locked in.
No single one of these is enough. Combined, they create enough surface area to catch synthetic fraud at a point when intervention is still possible. The identity's first high-value transaction is the last reliable catch point. After the product ships or the transfer clears, the window is closed.
