Synthetic identity fraud is the creation of a fake person by combining a real Social Security number with fabricated details like an invented name, date of birth, and address. The resulting persona looks legitimate enough to pass automated screening at banks and lenders, but it corresponds to no actual human being. U.S. losses are estimated at $30 to $35 billion a year, and because the “borrower” never existed, there is often no single victim to raise an alarm until accounts default.
How a Synthetic Identity Is Built
The core ingredient is a valid Social Security number. Paired with a made-up name, a different date of birth, and a new mailing address, that real number gives an application just enough legitimacy to clear basic verification while the fabricated details keep the persona from tracing back to the actual number holder.
Fraudsters frequently run several of these personas at once. A single phone number or address may quietly appear across a dozen applications, a practice known as identity clustering. Each application looks unique in isolation, so banks rarely spot the connection, and if one identity is flagged the rest of the cluster can keep operating for months.
Once a persona exists on paper, the fraudster needs it to exist in the credit system. The usual first step is to apply for a credit card, expecting a denial. The rejection itself does the work: it prompts the credit bureaus to open a thin file for the new “person.” From there, the fraudster adds the synthetic identity as an authorized user on a real credit card with a long, clean payment history. The fake persona inherits that history, its score climbs over several months, and what started as a rejected applicant now looks like a creditworthy borrower.
Whose Social Security Numbers Get Used
The ideal number, from a fraudster’s perspective, belongs to someone unlikely to apply for credit anytime soon. The less active a number is, the longer a persona built on it can go unnoticed.
- Children. A minor’s Social Security number has no credit history attached and parents rarely check for one. A stolen number can be exploited for a decade or more. Warning signs include collection calls about accounts you never opened for your child, denial of government benefits because the number is already in use, IRS notices about unpaid taxes tied to your child’s number, or a student loan denial for bad credit your child never created.
- Foster youth. Children in foster care face elevated risk because they move frequently and more adults have access to their personal records.
- The elderly. Seniors who have moved into assisted living or stopped opening new accounts are less likely to notice unfamiliar activity.
- The deceased. There is a gap between a death and the Social Security Administration updating its records. The SSA receives more than three million death reports a year, and fraudsters exploit even short delays to grab numbers no living person will contest.
How the Losses Happen: The Bust-Out
Once the synthetic identity has a solid credit score, the fraudster cashes out. Over a short window, they apply for multiple high-limit credit cards and unsecured personal loans. Auto loans are sometimes added for vehicles that get resold quickly for cash. The goal is to maximize total borrowing before anyone notices.
In the final phase, every line of credit is pushed to its limit through large purchases and cash advances. The fraudster may submit a fraudulent payment to briefly restore a balance for one last round of spending before the payment bounces. Because the borrower never existed, there is no real person for the bank to pursue. Debt collectors chase a ghost and the institution writes off the loss.
Federal Penalties for Synthetic Identity Fraud
There is no single federal statute labeled “synthetic identity fraud.” Prosecutors instead stack charges under several laws, each with its own prison exposure, and a single scheme can trigger multiple counts.
Identity Document Fraud (18 U.S.C. § 1028)
Covers using another person’s identifying information to carry out unlawful activity. A conviction generally carries up to 15 years in prison. Enhanced penalties apply in certain circumstances: up to 20 years when the fraud is connected to certain other crimes, and up to 30 years if it facilitates an act of terrorism.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
Aggravated Identity Theft (18 U.S.C. § 1028A)
When someone uses another person’s identifying information during the commission of certain felonies, including bank fraud and wire fraud, this statute adds a mandatory two-year prison term on top of the sentence for the underlying felony. The two years must run consecutively, cannot be shortened by reducing the underlying sentence, and cannot be served on probation.2Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
Access Device Fraud (18 U.S.C. § 1029)
Targets fraud involving credit cards and other access devices. A first offense for producing or using counterfeit access devices carries up to 10 years. Offenses involving device-making equipment or unauthorized transactions carry up to 15 years. A second conviction raises the maximum to 20 years, and courts can order forfeiture of any property used to commit the offense.3Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
Bank Fraud (18 U.S.C. § 1344)
Using false information to obtain money or property from a financial institution carries a maximum of 30 years in prison and fines up to $1,000,000.4Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud
Wire Fraud (18 U.S.C. § 1343)
Because synthetic identity schemes almost always run through electronic applications, wire fraud is a routine charge. The baseline maximum is 20 years, but when the fraud affects a financial institution the penalty rises to 30 years and fines up to $1,000,000.5Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
A fraudster who uses a stolen Social Security number to open credit accounts online and then defaults could face charges under all five statutes at once. The aggravated identity theft count alone guarantees two added years that cannot be reduced or run concurrently; combined with bank or wire fraud, total exposure can exceed 30 years.
How to Protect Yourself and Your Family
The most effective defense against having your Social Security number pulled into a synthetic persona is a credit freeze. Under federal law, every consumer has the right to freeze their credit file at no charge. A freeze prevents new creditors from accessing your report, which stops anyone from opening accounts in your name. You can lift the freeze temporarily when you apply for legitimate credit.
Parents can also freeze credit files for children under 16. If the bureaus do not already have a file on the child, they will create one for the sole purpose of freezing it, and that file cannot be used for credit purposes. You will typically need to provide proof of your relationship to the child, such as a birth certificate.6Federal Trade Commission. New Protections Available for Minors Under 16 For foster youth, who face elevated risk, advocates recommend taking this step as early as possible.7Federal Trade Commission. How to Help Protect Foster Youth From Identity Theft
What to Do If Your Social Security Number Was Used
If you discover your Social Security number, or your child’s, has been used in a synthetic identity scheme, the SSA directs you to report the theft through the Federal Trade Commission rather than through Social Security itself.8Social Security Administration. Report Stolen Social Security Number IdentityTheft.gov walks you through a three-step process: describe what happened, receive a personalized recovery plan, and then follow guided steps that include pre-filled dispute letters. Creating an account lets you track progress and update the plan as the situation develops.9Federal Trade Commission. IdentityTheft.gov – Steps
Your FTC report feeds into Consumer Sentinel, a secure database used by law enforcement agencies in the United States and internationally. Filing a false identity theft report with the FTC is itself a crime that can result in fines or imprisonment. Beyond the FTC report, dispute any fraudulent accounts directly with the credit bureaus and place a fraud alert or credit freeze on your file to block further misuse.