What is the real identity fraud threat that firms are missing?

Synthetic identity fraud: criminals combine real and fake personal information (real SSN with fabricated name and address) to create 'Frankenstein' identities that pass standard KYC. Unlike deepfakes (detectable with technology), synthetic identities are validated by credit bureaus and government databases — making them far harder to catch.

How much financial loss does synthetic identity fraud cause versus deepfakes?

Synthetic identity fraud: $7.8B in annual losses (FTC estimate). Deepfake-enabled identity fraud: $2.1B. Synthetic identities cause 3.7x more damage — yet 68% of fraud prevention budgets increased for deepfake detection in 2025 versus only 23% increasing synthetic identity detection investment.

How do financial institutions catch synthetic identity fraud?

Synthetic identities are identified through: behavioral anomalies (SSN issued after stated age), velocity checks (identity associated with multiple simultaneous applications), network analysis (devices/emails shared across multiple 'different' identities), and bust-out pattern detection (building credit then maxing all accounts simultaneously).

Veriff Warns Deepfakes Are Distracting Firms From the Real Identity Problem

Veriff, the identity verification company processing 500 million verification attempts annually, has published research warning that industry attention on deepfake threats is creating a dangerous blind spot: while firms invest heavily in AI-generated image detection, synthetic identity fraud — which causes 3.7x more financial damage — receives proportionally less countermeasure investment. The mismatch between threat severity and defensive spending reflects a pattern Veriff calls "the shiny object problem" — firms respond to high-profile, newsworthy threats (AI deepfakes make compelling media stories) while more damaging, less publicized threats grow unchecked.

For compliance and fraud prevention teams, the research provides a prioritization framework grounded in actual loss data rather than media coverage — and the implications are counterintuitive: your deepfake problem is real but manageable; your synthetic identity problem may be far worse than you realize.

The Threat Landscape by Damage

2025 identity fraud losses (Veriff research, FTC data, Javelin Strategy):

Fraud Type	Annual Losses	% of Budget	Trend
Synthetic identity	$7.8B	23% of fraud budgets	+34% YoY
Account takeover	$6.1B	31% of fraud budgets	+28% YoY
First-party fraud	$4.2B	18% of fraud budgets	+12% YoY
Deepfake identity fraud	$2.1B	68% of budget increase	+180% YoY
Document forgery	$1.8B	14% of fraud budgets	+22% YoY

The budget-damage misalignment:

Deepfake detection receives the largest budget INCREASE (68% of firms increased spending)
Synthetic identity causes 3.7x more damage and receives proportionally less investment
Account takeover (the second-largest damage category) is underfunded relative to impact

Why deepfakes attract disproportionate attention: Deepfake attempts are dramatic and newsworthy — a person submitting a video selfie with an AI-generated face. They appear in headlines. They're easy to demonstrate to boards. Synthetic identity fraud is silent — the fraudulent identity built over 18 months using legitimate information fragments never generates a dramatic "AI-generated face" moment that compliance teams can point to.

Synthetic Identity: The Invisible Epidemic

How synthetic identities work:

Criminal obtains a real Social Security Number (often from a child, elderly person, or someone with no credit history — people who don't regularly check their credit reports)
Creates a fictitious identity: attaches the real SSN to a fabricated name, address, and date of birth
Builds credit history: opens a secured credit card with a small limit, pays every month for 12-18 months
Passes KYC: when the credit history is established, the synthetic identity's SSN validates against IRS/SSA records (it's a real SSN), the credit file is clean (built legitimately), and the fabricated name/address never triggers "fraud" because identity verification only checks that information is consistent, not that the combination actually represents a real person
Bust-out: After 18 months of good behavior, the synthetic identity applies for maximum credit across multiple lenders simultaneously. Maxes everything out in 48 hours. Disappears. The "person" never existed — there's no one to sue or arrest.

Detection challenge: Standard KYC verifies: "Is this SSN real?" (yes), "Is this name/address consistent with public records?" (yes, because the criminal built consistent records), "Is this credit file clean?" (yes, built specifically for this purpose). Every standard check passes.

Advanced detection (what works):

SSN date-of-issue versus stated birthdate (SSNs issued after 2011 include age-encoded data)
Velocity analysis (same SSN appearing on multiple applications simultaneously)
Device fingerprinting across applications (same device/email used for multiple "identities")
Network analysis (this identity's phone number is also associated with 12 other flagged identities)
Behavioral biometrics (how the applicant interacts with the form suggests scripted behavior)

The Risk Distribution by Institution Type

Banks and credit unions (highest risk): Synthetic identities primarily target credit products — where the "bust-out" destroys the most value. Banks with auto-approval systems below $2,500 credit limits are primary targets (the threshold where manual review often doesn't trigger).

Fintechs offering BNPL: BNPL's friction-free approval model (instant, minimal KYC, high approval rates) is exploited by synthetic identities. Industry estimate: 3-8% of BNPL approvals go to synthetic identities — representing $1.5-$4B in annual BNPL losses.

Crypto exchanges: Synthetic identities are used to: satisfy KYC requirements for accounts used in money laundering, open accounts for DPRK or sanctioned entities that wouldn't pass sanction screening under their real identities, and manipulate DeFi governance through fake identity-gated voting.

Why This Matters

For fraud teams: Audit your budget allocation against the actual loss distribution Veriff presents. If you're spending 68% of your fraud budget on deepfake detection and 23% on synthetic identity detection, you're misallocating by a factor of 3-4. Redirect investment toward: SSN age-velocity checks, network analysis (shared devices/emails), and bust-out pattern recognition.

For compliance and KYC professionals: Basic KYC is insufficient for synthetic identity detection. Level 2 verification (behavioral analysis, device fingerprinting, application velocity) catches what Level 1 misses. Budget for enhanced verification on new account applications in credit-granting products.

For accounting firms: Client internal controls for customer onboarding should include: synthetic identity detection controls, not just deepfake detection. If your client's KYC program only screens for document tampering and video manipulation, they're blind to the 3.7x larger threat.

For fintech investors and analysts: Evaluate fraud prevention investment not by the number of AI tools deployed but by the alignment between invested solutions and the actual loss distribution. A company spending heavily on deepfake detection while ignoring synthetic identity is not well-protected — regardless of how good their deepfake detection is.

For regulators: Supervisory guidance on KYC and fraud prevention should explicitly address synthetic identity — the fastest-growing fraud category that standard KYC procedures fail to catch. Current guidance focused on document verification is necessary but insufficient.

The key takeaway: Veriff's data showing synthetic identity fraud causing 3.7x more losses than deepfakes while receiving proportionally less defensive investment reveals that fraud prevention budget allocation is driven by media attention rather than damage data — firms that reallocate investment toward network analysis, velocity checks, and bust-out pattern detection will dramatically outperform peers still focused primarily on the less financially impactful deepfake threat.