How Synthetic Identity Fraud Works and How Deepfakes Enable It

What is synthetic identity fraud and how do deepfakes enable it?

Synthetic identity fraud is the creation of a fictitious person from a mix of genuine and invented details, used to obtain accounts, credit or services. The Federal Reserve, which launched an awareness initiative on the problem in 2018, defines it as the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain.

The usual recipe pairs a real identifier, often a national ID number belonging to someone unlikely to monitor it, with a made-up name, date of birth and address. For years the hard part was the face. Remote onboarding increasingly asks for an ID photo and a selfie, and a person who does not exist has neither.

Deepfakes fill that gap. Image generators produce a new, consistent face on demand; face swap tools put it into a selfie video; and the same face can be printed into a generated ID image. FinCEN's alert FIN-2024-Alert004 says criminals have combined generative AI images with stolen personal data or entirely fake personal data to create synthetic identities.

How synthetic identity fraud works, stage by stage

Synthetic identity fraud is patient. Unlike stolen-card fraud, which is used quickly before the victim notices, a synthetic identity can be built up for months because nobody is watching it. The table follows a typical lifecycle.

The cash-out stage explains why losses can be large per identity. Fraudsters invest time making the identity look like a good customer, then draw down every line of credit it has earned at once. FinCEN also describes faster uses: accounts opened with generative AI identities used straight away to receive and launder proceeds of scams, check fraud, loan fraud and unemployment fraud, and some used as funnel accounts.

How are deepfakes used in synthetic identity fraud?

Deepfakes are used at every point where a synthetic identity must show a face. At onboarding, a generated ID portrait and a matching selfie or liveness video defeat face matching because both images come from the same fabricated face. 404 Media reported in February 2024 that one site sold AI-generated ID images for $15 each and that one passed a cryptocurrency exchange's verification.

During live checks, fraudsters stream a face swap or play back a previously generated video. FinCEN notes that some identity verification tools flag third-party webcam plugins that let a customer display previously generated video instead of live video, and that fraudsters may claim technical glitches or ask to switch channels during live verification.

Later, if the bank asks for re-verification or a video call, the same synthetic face can be animated again. The FBI's December 2024 announcement describes criminals using AI-generated images for fake identification documents and real-time video to impersonate people, which are the same tools a synthetic identity needs.

Why synthetic identity fraud is hard to spot

The defining problem is the missing victim. When a real person's identity is stolen, they eventually see unfamiliar accounts or collection letters and complain. When the person never existed, nobody complains. The owner of the real identifier may not notice for years, especially if it belongs to a child or someone with little financial activity.

Each piece also looks plausible on its own. The identifier is valid, the address receives mail, the face is unique and the account behaves well. Generative AI removes one of the old tells, a face reused from a stolen photo or shared by an accomplice across many applications, because every synthetic identity can now have its own. The investigation workflow for synthetic identity applications explains how banks combine data, media and linkage signals to break that pattern.

Defending against synthetic identities with layered checks

Because each piece passes alone, defences have to test how the pieces fit and whether they recur:

• Run manipulation and generation analysis on the selfie, liveness video and ID portrait at onboarding, before face matching.
• Check data consistency, such as whether the photo's apparent age fits the date of birth, which FinCEN lists as a red flag.
• Search for the same face, device, phone or address across applications under different names.
• Validate identifiers against authoritative sources where the law allows, including issuance consistency.
• Monitor new accounts for FinCEN's post-opening indicators: coordinated activity among similar accounts, rapid transactions, high chargebacks and immediate withdrawals.
• Re-screen stored onboarding media with current models when accounts show those indicators.

Where Neural Defend fits against synthetic identity fraud

NeuroVerify covers the face. One API call analyses a selfie, liveness video or audio clip across six signals, including Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and Live Presence Verification, and returns a unified risk score with signal-level evidence. Eligible image requests complete in under 200 ms p95 under defined test conditions, so every application can be screened. When an account is referred for investigation, NeuroDetect gives analysts region and frame-level evidence and a forensic report for the case file.

The models build on ARCAS 1B, Neural Defend's own detection model, which the ARCAS paper evaluated across several benchmark families without benchmark-specific tuning, reporting pooled accuracy of 99.99% on GenImage and 97.65% on OpenFake. On the public VendorBench-100 still-image benchmark, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor; one benchmark author also co-authored the ARCAS paper.

NeuroVerify does not analyse ID documents or validate personal data. In a synthetic identity defence it is the media signal, combined with document verification, data checks and linkage in your own policy.