Breaches & Passwords
Synthetic Identity Fraud Explained
The short version
Synthetic identity fraud combines a real Social Security number - often a child's - with a fake name and birth date to create a person who does not exist. That invented person applies for credit, builds a genuine credit file over months or years, then borrows heavily and vanishes. Because there is no obvious victim to complain, banks often book the loss as bad debt rather than fraud, which is why the Federal Reserve calls it so hard to detect. Your best defenses are boring and free: freeze your credit, freeze your kids' credit, and watch what has already leaked.
What synthetic identity fraud actually is
Synthetic identity fraud is fraud committed by a fabricated person. The Federal Reserve's industry definition, published in 2021, calls it "the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain." In practice: a real SSN, a made-up name, a fake date of birth.
The key word is combination. Nothing about the identity is entirely stolen and nothing is entirely invented. The SSN belongs to a real person who has no idea it is being used. The name, address, and birth date belong to no one. Stitched together, they form what looks to a lender like a brand-new customer with a thin file.
How a fake person gets a real credit file
A synthetic identity is built in stages, and the Federal Reserve's white paper on the subject describes the playbook step by step: assemble the identity, apply for credit, get rejected, reapply, then grow the file until it can borrow real money. Each stage exploits a system designed around the assumption that applicants exist.
The process is patient. A fraudster may tend a synthetic file the way you would tend a real credit history - opening small accounts, paying on time, requesting limit increases. Some synthetic identities are farmed for years before they are used. The final move is what the industry calls a "bust-out": max out every credit line and vanish. There is no cardholder to pursue, because the cardholder never existed.
Why a rejected application still helps the fraudster
Here is the counterintuitive part: the first rejection is a win. As the Federal Reserve explains, when a lender receives an application it submits an inquiry to a credit bureau. The lender typically rejects an applicant with no history - but that inquiry itself creates a credit file for the synthetic identity, even though the application failed.
Once the file exists, the identity is real as far as the credit system is concerned. The Fed's paper notes another quirk that compounds the damage: bureaus generally assume the first applicant using a given SSN is legitimate. Anyone who later applies with the same number - including the actual person the number belongs to - can end up having to prove who they are.
SSN randomization made this easier, not harder. Since June 25, 2011, the Social Security Administration has assigned SSNs randomly, so the first three digits no longer reveal where a number was issued. Lenders lost a simple consistency check, and the Fed cites an ID Analytics estimate that nearly 40 percent of synthetic identities use a randomized SSN.
Piggybacking: renting a stranger's good credit
To speed the file's growth, fraudsters use a trick called piggybacking: paying to be added as an authorized user on a stranger's well-aged credit card account. The card's positive history flows into the synthetic file, and a fake person can jump from no score to a good score in months.
Piggybacking is not fringe behavior. The Federal Reserve cites an ID Analytics estimate that nearly half of synthetic identities use it to build credit. There are legitimate ways to be an authorized user - parents add children all the time - which is exactly why the technique is hard to police: the same mechanism serves both a family and a fraud ring.
Why it is the hardest fraud to detect
Traditional identity theft has a built-in alarm: the real victim sees strange charges and calls the bank. Synthetic fraud has no such alarm. As the Government Accountability Office put it in its 2017 forum report, "there may not be a victim to report a crime." The person whose SSN is borrowed usually never sees the fake file.
Detection tools also miss it. The Federal Reserve's paper cites an ID Analytics finding that 85 to 95 percent of applicants later identified as likely synthetics were not flagged by traditional fraud models - they simply looked like new customers with thin files.
Accounting hides the rest. When a synthetic account defaults, the Fed notes, some lenders book the loss as a credit loss rather than a fraud loss, and many never investigate which one it was - chasing a defaulted borrower who does not exist is expensive. The fraud disappears into ordinary bad-debt statistics, which keeps official numbers understated.
How big the problem is
The measurable edge of the problem is large and growing. TransUnion, one of the three national credit bureaus, tracks lender "exposure" - balances held by accounts its models flag as likely synthetic. Exposure passed a record $3.3 billion for the year ending 2024, and Deloitte projects at least $23 billion in annual US losses by 2030.
| Lending category | H1 2022 exposure | H1 2023 exposure |
|---|---|---|
| Auto loans | $1.3 billion | $1.8 billion |
| Bank credit cards | $917 million | $994 million |
| Retail credit cards | $144 million | $126 million |
| Unsecured personal loans | $57 million | $57 million |
US lender exposure to suspected synthetic identities, TransUnion analysis, August 2023. Auto lending alone was more than 60 percent of the total.
Two things stand out in that table. Auto loans dominate, because car lending is fast, high-value, and often finalized in a showroom. And the totals climb year over year - the Fed's paper cites a McKinsey estimate that synthetic identity fraud is the fastest-growing type of financial crime in the United States, a description Deloitte repeats in its own analysis.
Why children are the favorite raw material
The ideal SSN for a synthetic identity belongs to someone who will not look at their credit for years. That usually means a child. The Federal Reserve's paper is blunt: valid SSNs used in synthetic fraud typically belong to children, the elderly, or homeless people - anyone who does not actively use or check credit.
A child's number can host a synthetic file that borrows, defaults, and goes to collections repeatedly before anyone notices. The Fed notes the fraud "can lie dormant for years, only being uncovered once individuals turn 18 and apply for their first car or student loans," and cites Javelin research finding more than a million US children were victims of identity fraud in 2017 alone. We cover the warning signs in our guide to child identity theft.
Where the raw SSNs come from
Synthetic identities are assembled from leaked and traded data: breach dumps, phishing, and the steady resale of personal information. Every large breach that includes SSNs restocks the supply. You cannot un-leak a number, but you can know your exposure - our guide to checking whether your SSN was leaked explains what is honestly knowable and what no tool can promise.
It helps to check the surface you can see. RedactZero's free exposure scan shows whether your email appears in known breaches and which data brokers likely list you - the same public profiles that hand a fraudster your address history and relatives to build around a stolen number. Nothing you scan is stored.
The defense that actually works: freeze your credit
A credit freeze is the single strongest move against synthetic fraud, because it blocks the step the fraud depends on: opening new credit. Freezes are free at all three bureaus, freezing and unfreezing takes minutes online, and it does not affect your score. The CFPB confirms freezes cost nothing at Equifax, Experian, and TransUnion.
Freeze your children's files too. Federal law gives "protected consumers" under 16 the right to a freeze requested by a parent or guardian - and if the bureau has no file on the child, it must create one and freeze it. That empty, frozen file is exactly what blocks a synthetic identity from taking root. Our step-by-step guides for Equifax and Experian cover those bureaus' broader data practices, and our credit freeze walkthrough covers all three bureaus.
The system is slowly catching up on verification. The Social Security Administration now runs eCBSV, a service that lets banks - with your written consent - check whether a name, SSN, and birth date actually match SSA's records before opening an account. It closes the loophole where no one could ask the government "does this person exist?"
If a synthetic identity is using your number
Suspect a problem if you get collection calls for a name you do not recognize, mail addressed to a stranger at your home, or a lender asks you to prove you are the real holder of your own SSN. The response is the standard identity-theft playbook, with one extra step: check for files that are not yours.
Pull your credit reports from all three bureaus and dispute any account you do not recognize. File a report at IdentityTheft.gov, place a fraud alert, and freeze your file if you have not already. If the victim is your child, ask each bureau in writing whether a file exists for their SSN - and read our broader library of step-by-step privacy guides for shrinking what is publicly known about your family in the first place.
See what is already exposed
Run a free scan to see which breaches include your email and which data brokers likely publish your address and relatives - the raw material of identity fraud. No account, nothing stored.
Frequently asked questions
What is synthetic identity fraud in simple terms?
It is fraud committed with a person who does not exist. A criminal combines a real Social Security number with a fake name and birth date, then uses that invented person to open credit accounts, borrow money, and disappear without paying.
How is it different from regular identity theft?
Regular identity theft impersonates you, so you see the damage on your own accounts and credit report. Synthetic fraud builds a separate, new credit file that borrows your SSN. Because the fake person has a different name, the fraud does not show up where you would normally look.
Can synthetic identity fraud hurt me if my SSN is used?
Yes. Debts and collections tied to your SSN can surface when you apply for credit, and untangling them means proving to lenders and bureaus that you are the real holder of the number. The Federal Reserve notes the burden of proof falls on the genuine person.
How would I know if my SSN is being used by a synthetic identity?
Warning signs include mail or calls for a name you do not recognize at your address, collection notices for accounts you never opened, or being asked to prove your identity when applying for credit. Checking your credit reports at all three bureaus is the most direct check.
Does a credit freeze stop synthetic identity fraud?
A freeze on your file blocks new accounts opened as you, and freezing a child's file blocks the most damaging scenario: a synthetic file quietly maturing on a child's SSN. Freezes are free at Equifax, Experian, and TransUnion, and federal law lets parents freeze a child under 16.
Why are children the main target?
A child's SSN comes with no credit history and no one watching it, so a fraudster can build and use a synthetic file for years before anyone looks. The Federal Reserve notes the fraud often surfaces only when the victim turns 18 and applies for their first loan.
How much does synthetic identity fraud cost?
TransUnion measured more than $3.3 billion in US lender exposure to synthetic identities for the year ending 2024, and Deloitte projects at least $23 billion in annual losses by 2030. Lenders ultimately pass those losses on through rates and fees.
Can I check whether my SSN has already leaked?
Not comprehensively - no tool can scan every corner of the criminal market. You can check whether accounts tied to your email appeared in known breaches, review your credit reports for files you do not recognize, and treat any breach notice that mentions SSNs as a prompt to freeze your credit.
Sources: Federal Reserve, "Synthetic Identity Fraud in the U.S. Payment System" (July 2019) and FedPayments Improvement synthetic identity fraud definition (2021); US Government Accountability Office, GAO-17-708SP (July 2017); TransUnion newsroom analyses (August 2023 and September 2025); Deloitte Center for Financial Services (2023); Consumer Financial Protection Bureau on credit freezes; Federal Register, SSA eCBSV notice (April 2024).