Read this article with AI
Copy the article text into your chosen tool to inspect its sources and trade-offs.
Define the identity claim being assessed
The Federal Reserve’s synthetic identity fraud initiative provides a payments-focused definition and resources. Its scope helps distinguish fabricated identities from the theft of an existing person’s account.
Before buying a product, write down what you need to check. Does the person exist? Is the supplied evidence genuine? Does it belong to this applicant? Is a later transaction risky? These questions need different inputs, tools and decision owners.
A fake profile created to spam a marketplace may violate policy without presenting the same identity-proofing problem as an application for a financial product.
Separate proofing, authentication and risk
NIST’s identity-proofing guidance describes how to assess identity evidence at enrollment. Authentication asks whether an actor can prove control of an account’s authenticator. Reading a browser fingerprint does neither job by itself.
| Layer | Question | Evidence boundary |
|---|---|---|
| Identity proofing | What supports this claimed identity? | Requires an appropriate proofing process |
| Authentication | Who controls this account credential now? | A credential can still be compromised |
| Device context | Which environment produced this event? | Does not establish legal identity |
| Transaction review | Does this action fit the account and service? | Unusual behavior needs investigation |
Do not describe a fraud API as a KYC service unless its actual product and agreement support that scope. Likewise, following one technical guide does not establish regulatory compliance.
Investigate inconsistencies with their original context
A mismatch is a reason to look closer, not proof of a made-up person. Retain the source, event time and uncertainty. A typo, name change or incomplete record needs a correction route too.
In a hypothetical signup, the submitted details do not match a verification result. The reviewer should check the reason and request the evidence that the process allows. Calling every mismatch a synthetic identity would mix unresolved cases with confirmed fraud.
Device reuse across applications can help prioritize a review. Shared workplaces, assisted onboarding and common equipment are possible explanations, so the reviewer still needs the identity evidence relevant to the claim.
Choose a tool category before choosing a vendor
An identity-proofing provider, a document service, an account-risk API and a transaction monitoring platform are different purchases. Build a matrix of required outputs and decision ownership before comparing prices.
Read browser fingerprinting techniques for the limits of environment evidence. Our account fraud and bot mitigation guide separates account-policy questions from automated traffic; neither category implies that every product must demand a legal identity.
Ask suppliers for supported populations, exception handling, evidence retention, review access and correction procedures. Request current documentation for the product you would buy. A marketing reference to “identity intelligence” is not enough to establish proofing scope.
Keep case labels honest
Keep confirmed, suspected, unresolved and legitimate cases separate. Record who decided and which facts they used. A rejected application does not by itself confirm a made-up identity. A low risk score does not verify a person either.
Track overturned reviews and unresolved cases alongside losses. If a person corrects their data, give staff a way to revisit later decisions based on it. Otherwise one early error can keep affecting their account.
Build a narrow evaluation
Start with one enrollment flow and an approved sample with known outcomes. Test whether the tool supplies the promised evidence and whether reviewers can act on it. Include legitimate exceptions and unavailable-data cases, not only obvious fabricated examples.
Finish with a decision record explaining what the pilot established. If the service only added device context, describe that contribution precisely. For continued account defense after enrollment, define a separate authentication and account-monitoring process. VPN and proxy detection can add network context to that process, but it does not verify the identity claim.
FAQ
Is synthetic identity fraud the same as account takeover?
No. One concerns a fabricated identity claim; the other concerns unauthorized control of an account. They can require different evidence and responses.
Can device fingerprinting verify a real person?
No. It describes or associates an environment. Identity proofing requires evidence appropriate to the identity claim.
Does every fake account need KYC checks?
No. The service’s purpose, risk and obligations determine the appropriate process. Many signup-policy questions are different from legal identity proofing.
Sources
Editorial basis: primary-source documentation and a practical evaluation framework. Examples are hypothetical unless explicitly identified otherwise. This article does not report an independent vendor benchmark.
For evaluation standards and corrections, see our methodology and contact page.