Synthetic Identity Has Entered Its AI Phase

Synthetic identity fraud has been a banking problem for decades. AI is now making it faster to create, easier to scale, and harder to challenge with familiar controls. Criminals can assemble fake identities, generate documents, create deepfake faces and voices, and push those identities through digital onboarding and authentication controls. 

For banks, the problem can reach well beyond a bad document or a thin credit file. A synthetic identity may pass familiar checks; sit quietly in the portfolio; and later surface across fraud, credit, anti-money laundering, consumer, commercial, or onboarding teams. 

Steve Lenderman, head of fraud prevention at isolved HCM, told a ProSight GCOR audience that synthetic identities that once took years to build and mature can now be created much faster with AI tools. Lenderman said during a recent test he created “a fully functioning synthetic identity” in seven minutes. 

“That scares me,” he said. 

Lenderman pointed banks toward a few practical shifts: 

Treat the loss as fraud. Synthetic identity can disappear into credit charge-offs, fraud buckets, or first-party fraud disputes. That makes the problem harder to measure and easier to underestimate. Lenderman warned that synthetic identity often sits quietly because it blends credit and fraud exposure. Either way, the institution owns the loss. 

Do not trust validation by itself. Standard identity checks and familiar authentication tools can create false comfort. Lenderman said synthetic identities he created for testing can pass through credit bureaus, Social Security validation checks, and other tools used to confirm identity information. His advice: Have confidence in data, but do not trust it blindly. 

Look for behavior, devices, and relationships. Synthetics may look plausible on paper, but they still need to act. Banks should examine login behavior, time on pages, device overlap, address clusters, phone and email patterns, and missing or unusual relationship data. Lenderman said criminals may manage hundreds or thousands of synthetic identities, creating connections that can show up in device and behavioral data. 

Recheck liveness and document controls. Deepfakes can now give synthetic identities a face and voice. AI-generated documents can look convincing. Lenderman said passing a liveness check “is relatively easy by the average fraudster today.” The control may still be useful, but it should not be treated as proof that the person is real. 

Connect the internal dots. Synthetic identity can touch fraud, AML, credit, consumer, commercial, and onboarding teams. Jason Bartolacci, director of the ProSight Fraud Alert Network, noted that internal teams may see different parts of the same activity without connecting them. Banks need a way to bring those signals together so related accounts, devices, transactions, investigations, and suspicious activity do not stay trapped in separate silos. 

The takeaway: Synthetic identity defense is becoming a data discipline. Banks need to look past individual documents, checks, and transactions and examine the relationships among devices, behaviors, accounts, addresses, entities, and internal investigations. The profile may look real; the pattern often tells a different story.