For years, financial fraud was largely about stolen identities. Today, criminals are increasingly creating identities from scratch—and AI is making the process faster, cheaper, and dramatically more convincing.
The result is a new class of fraud that doesn’t just exploit existing customers; it manufactures entirely new ones. These synthetic identities can blend into legitimate customer populations, making them difficult to detect and even harder to measure.
In a PaymentsJournal webinar, Diarmuid Thoma, Head of Fraud and Data at AtData, a part of Experian, Jose Pallares, Senior Director of Product at Experian, and Jennifer Pitt, Senior Analyst of Fraud Management at Javelin Strategy & Research, discussed how financial institutions are adapting their detection strategies—and why the rise of agentic AI could once again shift the balance in fraudsters’ favor.
A Perfect Customer
Once a niche concern in the identity fraud landscape, synthetic identity has evolved into a major challenge with the rise of AI. Synthetic identities—fake customer profiles created by combining real and fabricated personal information or entirely AI-generated data—pose a fundamentally different challenge than traditional identity theft because they often aren’t tied to a real person at all.
Traditionally, criminals created synthetic identities by combining a real Social Security number with fabricated personal information to secure fraudulent loans. While the SSN belonged to a real person, the identity itself did not.
Today, AI-generated identities are far more sophisticated. They can be equipped with realistic behavioral patterns, convincing digital footprints, and deepfake biometrics that create the appearance of an actual consumer.
It’s also no longer a matter of a single fraudster creating fake identities one by one. Generative AI can operate at an industrial scale, producing tens of thousands of synthetic profiles in a fraction of the time.
“The two coming together is really why we’re talking about it today,” said Thoma. “It’s becoming one of the main types of fraud instead of from the fringes.”
These accounts are hard to detect because they don’t just look authentic—they behave like legitimate customers. Many remain dormant for months, making small purchases, paying balances, or conducting low-risk transactions to establish a history of normal activity before being used to commit fraud.
“They look like a perfect customer,” said Pallares. “They behave so cleanly that existing models that are looking for out of the norm behavior can’t really catch them because they’ve been trained on human behavior.”
Even when a synthetic identity is eventually uncovered, financial institutions often struggle to accurately classify the resulting losses. Because the account isn’t linked to a real individual, there is no obvious person to hold accountable. Losses are frequently written off as bad debt or categorized as first-party fraud, obscuring the true scale of the synthetic identity problem. As AI enables criminals to generate these accounts en masse, that visibility challenge is only expected to grow.
The Synthetic Economy
Some experts now describe the new landscape as a “synthetic economy”—an ecosystem in which identities are created, tested, and monetized at unprecedented scale. While synthetic identities were once used primarily to obtain fraudulent loans, they are now deployed across nearly every stage of the payments ecosystem.
Criminals create different synthetic personas for different points in the customer journey: one identity for onboarding, another for the application process, and yet another to make payments or obtain credit. With AI generating an almost limitless supply of identities, criminals can quickly abandon one profile and replace it with another if a financial institution detects suspicious activity.
“When I was in law enforcement, I investigated a sophisticated mail theft scheme,” said Pitt. “One suspect had stolen bags full of mail. Through looking at his devices, I was able to see that he was connected to other identity theft suspects that I was already investigating. They were creating synthetic identities using this compilation of victim information that they got from the first mail theft suspect. They were making IDs, they were making checks with different victims’ name, dates of birth, Social Security number, addresses, and presenting those. And it was very hard to detect.”
Advances in Verification
Once a synthetic identity successfully passes verification, it effectively becomes legitimized. Future organizations relying on network intelligence or consortium data may assume the identity has already been vetted, allowing it to move more easily through subsequent verification processes.
That makes continuous monitoring essential. Financial institutions can no longer focus solely on onboarding and application screening; they must evaluate identity risk throughout the customer lifecycle.
“It’s hard to detect because you’re looking at things in a siloed manner,” said Pallares. “You’re only looking at what you have availability to, and you’re looking for bad behavior where there might not be any yet.”
Visual tools can reveal clusters of suspicious activity, highlighting repeated use of the same personally identifiable information elements, devices, addresses, or other identifiers across multiple accounts. Document analysis has also become increasingly valuable, allowing organizations to detect not only physical document tampering but also subtle alternations to digital documents.
“You’re looking at 10 profiles and they all look fine,” said Thoma. “But if you’re able to look back see that these 10 profiles were created on the same day or they were all with the same date of birth or whatever, that changes your perspective.”
Real-time network intelligence extends those capabilities across institutions, enabling organizations to identify patterns and behaviors that others have already encountered. At the same time, some traditional approaches to identity verification—particularly those that rely heavily on historical identity records—are becoming less effective in a world where synthetic identities can accumulate seemingly legitimate histories.
“We used to say, they’ve got a social profile, they’re on LinkedIn, they’re on Facebook,” said Thoma. “I would caution companies using social for verification right now because you have two things happening. One, AI is getting more advanced that it can create these accounts. And then the social platforms don’t really care too much anymore about verification.”
The Threat of Agentic AI
Looking ahead, agentic AI introduces yet another layer of complexity. Rather than simply generating synthetic identities, AI agents may soon act autonomously on behalf of fraudsters, carrying out transactions, managing accounts, and adapting behavior in real time.
Today’s fraud systems are largely designed to identify and block bots. But that model breaks down when autonomous agents become authorized participants in digital interactions. As AI agents become more capable, financial institutions will need to rethink digital trust as something that is continuous, contextual, and constantly re-evaluated—not something established once at onboarding and assumed thereafter.
“The AI powerhouses that are creating these agentic platforms, in my view, are responsible for the verification,” said Thoma. “So the verification is shifting, whereas at the moment it sits with the company you’re buying from to protect themselves. What’s going to change is the bad bot principle on websites will disappear and it’ll become credentialed. And then it’s just going to be a whole different web.”