Synthetic Identity Fraud

Synthetic identity fraud is fraud committed using an identity that doesn't fully correspond to any real person, built by combining one genuine piece of someone else's data (most often a real Social Security Number, frequently belonging to a child, a deceased person, or someone who has never used credit) with fabricated details around it: a made-up name, a false date of birth, a fabricated address. The result is a new, entirely fictitious "person" who then applies for credit, gets denied a few times, gets approved once, and slowly builds a real credit history over months or years, before eventually "busting out": maxing out every credit line the synthetic identity has accumulated, all at once, and disappearing.

The reason this is genuinely harder to catch than ordinary identity theft is structural, not a matter of insufficient effort. In ordinary identity theft, a fraudster impersonates a specific, real, living person, and that person, eventually, notices something's wrong and reports it, giving the system a victim who complains. In synthetic identity fraud, there is no real person to notice or complain, because the identity being defrauded doesn't exist as a whole person anywhere, only a fragment of it (the stolen SSN) is real, buried inside a fabricated whole.

Who actually built this

No single regulator or standards body defined synthetic identity fraud the way FATF defined AML's core recommendations, it's a category name that emerged from shared vocabulary across U.S. consumer-lending and credit-risk practice. The Federal Reserve and the Federal Trade Commission have both published research studying and attempting to size it since roughly the mid-2010s, and the major credit bureaus track it as a named loss category. None of this research or vocabulary originated with Solidus.

Solidus today

Solidus runs no synthetic-identity fraud detection and has no fraud-scoring model of any kind: this is genuinely out of scope, not a deferred capability. The one connection worth stating plainly, because it's modest and easy to overstate: Solidus Verify's identity pipeline requires a real document scan plus an active liveness/face-match at the moment a credential is issued, rather than accepting a submitted data field checked against a lookup database. That structurally raises the bar for fabricating a wholly synthetic identity, because whoever's behind it still has to put a real document and a real, live face in front of the check. That is an observation about the pipeline's design, not a fraud-detection feature: the pipeline itself is unaudited, testnet-only, has no paying customer, and has never been tested against real synthetic-identity attack patterns. Nothing beyond that narrow structural point should be inferred.

See also

KYC is the identity-verification pipeline the structural observation above refers to. First-Party Fraud is a related but distinct category, a real person misusing their own real identity, rather than a fabricated one. Account Takeover targets an existing account rather than the creation of a new, fictitious one. Liveness Detection and Presentation Attack are the specific techniques underneath the "a real, live face" claim above.