This is Arthur Vance, he is the head of fraud research here at Proof.  Arthur started his career in forensic accounting after getting his undergraduate from the University of Michigan.  A couple of interesting things to note about Arthur is that he is an amateur astronomer, listens to jazz (loves John Coltrane), and has a secret.

Arthur's secret? He doesn't exist. He is not a real person with a past, a set of memories, or a physical presence. He is a fabrication, a phantom conjured from the digital aether by artificial intelligence, and a perfect illustration of the growing threat of synthetic identity fraud.

Proving who you are relies heavily on documents and data. Fraud actors exploit this reliance by not stealing existing identities, but by creating entirely new ones from scratch. These "phantoms" are meticulously built, piece by piece, designed to appear legitimate to your organization with the goal of committing fraud.

So, what exactly is a synthetic identity, and how do these digital phantoms operate?

What is a Synthetic Identity?

Synthetic identity is a fraudulent persona created for the purpose of committing financial crimes and or concealing one's identity. These identities are composed of completely or partially fictitious Personally Identifiable Information (PII), creating an entirely new identity. They are used for bypassing Know Your Customer (KYC) checks to create accounts for:

• Directly committing fraud
• Reinforcement of identity to commit future fraud
• Monetizing access or services

Anatomy of a Synthetic Identity

In order to determine the pieces of an identity a fraud actor would require to create a synthetic identity, let's think about what you would need in order to prove you are you. Starting in 2025 the US Federal Government began enforcing requirements on "REAL ID" (or other compliant forms of identification) to fly domestically. Let’s use the  REAL ID verification requirements as a framework for identifying the types of documents a fraud actor may want to acquire or have digitally forged.

These requirements are split into two categories:

• Proof of Identity: This requires an authoritative document to establish a basis for the identity. Fraud actors are only required to obtain or forge one high-value document, such as a passport, birth certificate, or Permanent Resident Card. The goal is to have a single, credible document that can serve as the backbone of a synthetic persona.
• Proof of Residency: This category offers a much broader attack surface. Organizations often accept a wide variety of documents to prove residency, making them easier targets for forgery or manipulation. Threat actors can leverage numerous options, which can be broadly categorized:
  
  • Financial Records: Bank statements, credit card bills, mortgage statements.
  • Utility & Service Bills: Electricity, water, gas, or cell phone bills.
  • Government Correspondence: Tax returns, voter registration cards, or letters from government agencies.
  • Housing Agreements: Rental/lease agreements, property deeds, or tax bills.
  • Institutional Records: School documents, insurance policies, or employment record

While the terms "Proof of Identity" and "Proof of Residency" fit the REAL ID framework, we'll use a broader classification to encompass all documents used for identity verification. Going forward, we'll refer to them as:

• Anchor Document: An authoritative document serving as the cornerstone of an identity, mapped to "Proof of Identity" in the REAL ID framework.
• Supporting Document: A document used to add legitimacy to the validity of the identity, mapped to "Proof of Residency" in the REAL ID framework.
  

The wide range of supporting documents presents a significant vulnerability. Fraud actors don't need to forge every type of document; they only need to find a combination that successfully passes the checks at their target organization. Each time a fraudulent document is accepted, it reinforces the synthetic identity's legitimacy, creating a compounding paper trail. This makes it progressively easier for the synthetic identity to pass future checks, establish credit, and ultimately, commit financial fraud.

As identity verification technologies advance, biometric validation is becoming more common.  Fraud actors are increasingly turning to generative artificial intelligence (GenAI) to produce digital specters, non-existent and highly realistic entities that give the identity form and voice. Utilization of these images and videos to bypass liveness detection and giving the synthetic identity the ability to appear present when required.

Tools of the Trade

Fraud actors leverage a diverse and evolving toolkit to create and legitimize synthetic identities. These tools range from simple online PII generators to the use of GenAI, often acquired and shared amongst the broader Fraud-as-a-Service (FaaS) ecosystem.

PII Generation and Acquisition

This category includes tools and sources for obtaining the raw data needed to form the identity's foundation.

• PII Generators: There are a number of sites that can be used to generate plausible personal details, including names, dates of birth, and physical addresses. Advanced address generators can create addresses that validate against postal service databases.
• Illicit Marketplaces: Dark web forums and illicit Telegram channels are primary sources for purchasing "fullz"—packages containing stolen PII.
• Credit Privacy Numbers (CPNs): This is a 9 digit number which is made to look like a Social Security Number (SSN), which are either completely fabricated or stolen SSNs from minors or other vulnerable individuals. They are marketed to individuals as a way to protect your identity and fix your credit.
• Social Media Scraping: Automated tools are used to scrape public profiles to harvest realistic details such as employment history, educational background, and social connections to add depth and credibility to the synthetic persona.

Document Fabrication and Modification

These are the tools used to create the fraudulent documents required to pass verification checks.

• Document Templates: High-resolution, editable templates, most commonly in Adobe Photoshop format, are widely traded. These templates for utility bills, bank statements, pay stubs, and tax records allow for easy modification of names, addresses, and dates.
• On-Demand Forgery Services: Specialized vendors on illicit markets offer custom document creation as a service. An actor can provide the PII for their synthetic identity and receive professionally forged documents tailored to specific institutional requirements.

Generative AI

The use of GenAI helps fraud actors scale their operations at a pace not previously possible.

• Synthetic Media Generation: Image, video, and voice generation models can be used to produce realistic entities, which can be used as a part of a synthetic identity. The generation of high quality non-human entities is highly available and in many cases free. One well known example of this is "This Person Does Not Exist"
• Text Generation: Large Language Models (LLMs) can be used to create plausible background narratives, generate fake social media post histories, write scripts to be used in phishing campaigns or customer support interactions, all to further legitimize the synthetic identity.

Impact of Synthetic Identity Fraud

Our fellow fictitious fraud researcher, Arthur highlights the threat that organizations are facing.  Synthetic identity fraud is one of the fastest-growing financial crimes in the U.S. with projections of at least $23 billion in losses by 2030.  When a synthetic identity executes a "bust-out"—maxing out credit lines before vanishing—the average loss to financial institutions can be a staggering $15,000 per incident.

Impact to the individual can go unnoticed, as it is less apparent than traditional identity theft.  Individuals whose legitimate Social Security numbers are unknowingly co-opted into these synthetic profiles can face fragmented credit files and significantly damaged credit scores.  Imagine turning 18 years old, and trying to apply for your first credit card, only to find out that your SSN has been used to open a multitude of accounts over the years.

So, how do we begin to fight phantoms that don't exist, and protect ourselves and our organizations from a threat that is constantly evolving in the shadows?

How to Protect Yourself and Organization

For the individual, the protections are not any different from protecting against identity theft.  Here is a list of things you can do to protect yourself and your loved ones:

• Utilize your SSN sparingly -  This reduces the risk that your SSN will be leaked.
• Monitor your credit - Regularly review your credit reports and accounts for any suspicious activity.
• Freeze Credit - The single most important thing you can do is freeze your credit at all the major credit bureaus.  This will stop any unauthorized attempts of obtaining credit utilizing your SSN.  You should also freeze the credit of any children that may be under your care.

For organizations combating synthetic identity fraud requires a multi-faceted approach that addresses the sophisticated methods employed by fraud actors at every stage of their operations.  The following is a list of techniques that are employed by these actors and the associated defenses.

Fabrication or Modification Documents

Defending against these threats require subtle detections in both anchor and supporting documents for:

• Digital alterations of document scans
• Inconsistency of details
• Physical fakes
• Use of digital templates

At Proof, we use a multi-layered approach to detect fabricated or modified documents, combining advanced technology and expert analysis. This includes:

• Credential Analysis: Our platform performs over 25 verification checks on captured IDs in under five seconds, meticulously analyzing for digital alterations, inconsistencies, and physical manipulation.
• AAMVA Check: For U.S. driver's licenses and state IDs, we directly compare information and unique barcodes with official DMV records, immediately flagging discrepancies.

Deepfakes

Deepfakes can be used to bypass traditional identity checks by presenting a synthetic persona that appears to be the legitimate individual.  Defending against more sophisticated actors is becoming more difficult every day.  The following are ways that you can defend your organization against these threats:

• Employ liveness detection: A technique used to verify that a person present during an identity check is a real, live individual and not a spoofing attempt.
• Cross-referencing other fraud signals: This can be looking at IP addresses, browser telemetry, or other factors that may indicate signs of fraudulent activity.
• Human-in-the-loop: Having a live person confirm the identity of the subject of the transactions.
• Check out our blog on more ways to spot Deepfakes

The way that we can protect your organization at Proof is by directly addressing these emerging threats.  Our capabilities are designed to help businesses combat deepfake scams and other forms of fraud in an era of AI-manipulated media.

Proof protects operations through:

• AI-powered Identity Verification and Deepfake Detection: Our Verify solution combines AI and human-assisted verification with deepfake detection. Identify validates credentials and selfies.
• Real-time Fraud Detection and Risk Signals: Defend detects traditional and emerging fraud (synthetic identities, deepfakes) by monitoring over 100 risk signals in real-time. Alerts are sent via email or webhook for high/medium risk customers. The Enhanced Signer Identity tab provides fraud teams with key details for flagged transactions.
• Critical Human Oversight: If automated verification fails, users are routed to on-demand fraud agents or notaries for human verification, catching subtle discrepancies automation might miss.
• Staff Training and Digital Forensics: We train your team to spot suspicious content and recommend integrating digital forensics tools.

By leveraging Proof’s solutions, your business can remain one step ahead of malicious actors, building trust and transparency in a digital world. Proof's platform incorporates AI-powered fraud detection capabilities to combat the significant annual losses businesses face due to false records and identity theft. This comprehensive, layered approach is critical for mitigating the impact of deepfakes and other sophisticated fraud attempts, ensuring a more secure and trustworthy digital future for your organization.

‍