Hidden somewhere in your customer database, there may be a person who doesn't exist.

They have what they need: a name, a Social Security number, an address, a phone number, and a credit history. They've passed your onboarding checks. They're behaving like a model customer. And at some point, probably when you least expect it, they're going to max out every line of credit you've extended to them, vanish completely, and leave you holding the loss.

This is synthetic identity fraud. It's not a new concept, but it's become the fastest-growing type of financial crime on the planet, and most organizations still aren't built to catch it.

Traditional identity theft is relatively straightforward: A criminal steals a real person's credentials and impersonates them. The victim eventually notices. The fraud gets reported. The trail exists.

Synthetic identity fraud is different. It doesn't steal a person. It builds one, mad scientist style.

Here's how it typically works. A fraudster acquires a legitimate Social Security number (SSN), usually from a data breach, a dark web purchase, or by targeting people who are unlikely to notice: children, the elderly, the homeless, recent immigrants. They pair that real SSN with a fabricated name, a fake date of birth, a made-up address, and a manufactured phone number. The result is what researchers often call a "Frankenstein identity." Some parts real, some parts invented, but one hundred percent fictional.

What’s next? A long-con level of patience. 

The fraudster applies for credit using the new identity, fully expecting to be rejected. But ... that rejection creates a credit file. The bureaus log the inquiry. The identity has now achieved what Federal Reserve Bank of Boston payments fraud expert Mike Timoney calls "proof of life." It exists in the financial system. It can be built on.

Over the next 12 to 24 months, the synthetic identity becomes a model borrower. It opens small accounts, pays on time, stays well within credit limits. It might get added as an authorized user on a legitimate account, a tactic called "piggybacking," to inherit positive credit history faster. Fraud detection systems see nothing wrong, because nothing is wrong yet. The synthetic identity is behaving perfectly.

Then comes the big move. Every account gets maxed out simultaneously, all funds withdrawn and gone. The fake person disappears. And there’s no one to pursue, because there was never actually anyone there.

Synthetic identity fraud now accounts for 80 to 85% of all identity fraud, according to the FTC. U.S. lenders faced $3.3 billion in direct exposure to synthetic identities tied to newly opened accounts in 2024, an all-time high, according to TransUnion. The Federal Reserve's payments security team reported that synthetic identity fraud was the fastest-growing fraud type globally in 2025, rising eight-fold from the year before.

That’s eight-fold. In a single year.

If the current trends hold, projected U.S. losses from synthetic fraud could hit $23 billion by 2030. Global estimates already run $20 billion to $40 billion annually. And roughly 62% of banks say digital onboarding is the highest-risk exposure point for synthetic identity fraud, which makes sense. That's the moment a fraudster introduces the fake identity into your system. If it gets through onboarding, it may sit in your portfolio for months or years before anyone catches on.

Here's an uncomfortable truth: Most fraud detection systems are tuned to catch anomalies, off-kilter things like sudden behavioral changes, application data that doesn't match existing records, or patterns that look out of place.

A carefully crafted synthetic identity doesn’t have those tells. In fact, it was engineered not to.

The Federal Reserve's 2026 Risk Officer Report found that 51% of financial institutions identified mule accounts, many involving synthetic identities, only after losses had already occurred. By then, the fraudster is long gone.

Making the problem worse, AI has fundamentally changed the economics of building these identities. Fraudsters used to build synthetic personas one at a time. Now, automated "identity mills" can generate hundreds or thousands of fake identities, with AI-generated profile photos, fabricated supporting documents, and deepfake videos capable of defeating facial recognition and liveness detection. Sumsub documented a 311% increase in synthetic identity document fraud between Q1 2024 and Q1 2025. By 2025, approximately 60% of estimated fraud losses were attributed to serial and synthetic fraud, a complete reversal from four years prior, when traditional document fraud dominated.

For the criminal, the cost of entry has dropped to almost nothing. For the business, the cost of failure remains significant.

There’s no single check that stops a sophisticated synthetic identity. Anyone selling you a silver bullet to solve the problem is probably trying to take your money, too.

What works is layers. Specifically, layering verification signals across multiple dimensions, early in the process, before the fake identity has had a chance to embed itself in your system. A few approaches that can make a measurable difference:

Phone number intelligence at onboarding. A synthetic identity needs a phone number to complete applications, receive verification codes, and look legitimate. But not all phone numbers are created equal. Disposable numbers, freshly issued numbers with no history, numbers that don't match the expected geography, numbers tied to known high-risk carriers: These are signals worth catching before you open an account. If the phone number attached to an application looks suspicious, the identity probably does, too.

Behavioral signal cross-referencing. Synthetic identities, especially AI-automated ones, leave fingerprints. Things like robotic interaction patterns, multiple accounts sharing the same device fingerprint, applications submitted at inhuman speeds, and addresses appearing across dozens of unrelated accounts. None of these signals alone should close the case, but together they build a picture worth investigating. 

Monitoring the account lifecycle, not just the opening. Most fraud detection is front-loaded: onboarding checks, then trust. But approximately 95% of synthetic identities go undetected at onboarding, according to Thomson Reuters. The window to catch them extends beyond onboarding into the credit-building phase. Behavioral anomaly detection, ongoing account monitoring, and real-time transaction signals all matter here.

Here's where effective detection gets genuinely different from what most businesses are doing.

Synthetic identity fraud, at its core, relies on the communications layer: phone numbers, authentication codes, account verification. The fake identity needs a phone number. It needs to receive verification messages. It needs to pass the same one-time passcode (OTP) flows your real customers pass.

That communications layer is not just how the fraud works. It's also where you have the best signal.

Vonage Network APIs put carrier-level intelligence directly into your risk models, at the exact moments that matter.  

Identity Insights API validates phone numbers in real time at account creation, detecting disposable numbers, high-risk carriers, and numbers that don't match expected geography before a fraudulent account ever gets established.  

SIM Swap Detection, within the Identity Insights API, checks whether a phone number has recently been transferred to a new SIM, a classic signal of account takeover in progress.

Subscriber Match, also part of Identity Insights API, goes further: It validates a user's identity directly against mobile network data, cross-referencing name, phone number, and other attributes against what the carrier actually has on file. If the person applying for your account claims to be one person but their phone number tells a different story, that's a flag you want before the account is open.

And then there's Silent Authentication, part of Vonage Verify API. Rather than sending a one-time passcode that a fraudster can intercept, request, or social-engineer around, Silent Authentication verifies the user passively through their mobile network connection. No codes. No friction. No OTP attack surface. It's verification that a synthetic identity, by definition, cannot pass: a real mobile network connection requires a real, verified SIM tied to a real carrier relationship.

These are signals only a network-native provider can access. They can't be faked with an AI-generated document or a deepfake face. They're grounded in the physical infrastructure of mobile communications. That's a fundamentally different class of defense than anything built on top of the application layer. 

The approach also aligns with Zero Trust security principles: Never trust by default, always verify, and treat every interaction as a contextual risk event rather than a one-time gate. The key difference is that zero trust, applied to synthetic fraud, has to extend beyond user accounts to the communication channels those accounts rely on.

You need to trust that your customers are who they say they are. Your customers need to trust that you take their protection seriously.

Synthetic identity fraud threatens both sides of that equation. It costs your business real money through direct losses and downstream fraud exposure. And it erodes the trust your real customers place in you every time they hand over their Social Security number, phone number, or financial information.

The fake person in your database was never going to trust you. But the real customers who onboarded the same week are watching how you handle this. They want to know the systems they're relying on are actually doing their job.

The businesses winning this fight are treating identity verification not as a gate to pass through once, but as a continuous signal to monitor. The phone number is the thread. Pull the number early and at every significant interaction, and with the right data behind it. 

A person who doesn't exist has no real history, no real carrier record, or no real network footprint. And that's exactly where their story falls apart.