Synthetic identities explained by Ilia Nikolaevich Zavialov: assembled people who pass every check

People who were never born

English version for the United Kingdom.

A stolen identity belongs to somebody who will eventually notice. A synthetic identity belongs to nobody, which is why it survives so much longer. It is assembled: a real identification number that was never used, a name that appears nowhere else, an address that exists, a face generated to order, a document rendered to match. Nothing about it triggers a victim complaint, because there is no victim to complain. Sumsub recorded a 180 percent rise in sophisticated attempts to get past identity checks compared with 2024, and deepfakes now account for around 11 percent of fraudulent activity worldwide.

Reference / Blog

Published: 18 September 2026 · 8 min read · Ilia Nikolaevich Zavialov

01What is actually being assembled

The core of a synthetic identity is usually one real fragment that nobody is watching. An identification number issued to a person who never used it, or a number that belongs to a child, a recent immigrant or somebody who died without an estate to monitor it.

Around that fragment the rest is invented. A name with no history, a date of birth adjusted to suit the product being applied for, an address taken from a real building, a phone number bought for the purpose. None of it contradicts the others, which is all most checks require.

The result behaves like a new adult with a thin file. That is a very ordinary thing to be, and no system can refuse everyone who has one. The gap between a thin file and a fabricated one is the whole game.

The choice of fragment is the part that takes judgement. A number belonging to someone who is unlikely to look at a credit report for years buys the operation exactly that much runway. Everything after that is assembly work and patience, and neither requires much skill.

02How it differs from identity theft

Identity theft has a clock on it. The real person sees a statement, a letter or a credit report and disputes it, usually within months. The fraud ends, the losses are booked and the case closes.

A synthetic identity has no clock. It can be built patiently, given a small credit line, fed with regular repayments for a year or two, and then drained in a single week. Nobody files a complaint because nobody was impersonated.

That difference changes where the losses land. Theft shows up in fraud statistics. Synthetic identities frequently show up as ordinary credit losses, which means the true scale is understated by construction rather than by accident.

It also changes the defence. Watching for a victim to raise a hand is useless against a person who was never born, so the only workable signals are structural ones about how the file itself behaves over time.

03What generative tools changed

Three years ago the weak link was the document. A convincing forgery took skill, and the flaws were visible to a trained reviewer. Now a plausible document image can be generated in minutes, complete with the wear, glare and skew that used to look like evidence of authenticity.

The selfie was the next barrier and it fell in the same way. A generated face can be rendered from any angle, lit consistently and made to blink, nod and turn on command, which is exactly what a liveness check asks for.

The third change is volume. What used to be a craft is now a pipeline, and the same operation can submit hundreds of applications built from the same template with varied details. Cost per attempt collapsed, so the economics no longer require a high success rate.

This is where the 180 percent rise in sophisticated attempts comes from. It is not that fraudsters got cleverer as individuals. The tools got cheap enough that ordinary operators can run what used to need a specialist.

04Why routine checks miss it

A document check answers whether the document looks right. A generated document does look right, because it was generated from the same template the checker was trained on.

A database check answers whether the details exist and agree with each other. A synthetic identity is built specifically so they agree, since the builder chose them.

A liveness check answers whether a live human is present. That was a good question when it was hard to answer falsely and is now a weak one, because presenting a rendered face to a camera is a solved problem.

Each of these checks is sound in isolation. The failure is that all three ask about the same moment, and a fabricated identity is designed to survive exactly one moment. Nothing in the routine set asks about history.

05What actually catches them

Time is the strongest signal available. A real file accumulates friction: a changed address, a missed payment, an overdraft, a job change, a device replaced after three years. A fabricated file is unnaturally smooth, because nobody is living inside it.

Shared attributes across unrelated applications come second. The same device fingerprint, the same address with a different flat number, the same phone carrier and issue date, the same rounded income figure. Individually meaningless, together decisive.

Behaviour at the edges is the third. Synthetic files often show perfect repayment followed by a sudden jump in exposure, because that is the plan rather than a coincidence. Watching the shape of the relationship catches what any single check cannot.

None of this works on a single application in isolation, which is the uncomfortable conclusion. Catching assembled people requires looking across applications and across time, and most verification is bought and deployed as a one moment decision.

06If your details were used as raw material

Being the source of a fragment is more common than being impersonated outright, and far quieter. A number of yours appears inside somebody else's assembled identity, attached to a name that is not yours, and nothing lands in your post.

The signals are small. A credit file that mentions an address you never lived at, a name variant you never used, or an enquiry from a lender you never approached. People dismiss these as clerical noise, and sometimes they are.

Check the file itself rather than waiting for a letter. Most jurisdictions give free access to the record held about you, and reading it once a year is the only reliable way to notice a fragment of your data living a second life.

This matters most for people whose details have not been used yet. Children, anyone who has recently moved countries, and anyone who has deliberately avoided credit all share the same property: a clean unused record that nobody is looking at. That is precisely the raw material this fraud wants.

07What this means for verifying a person

Treat a clean, consistent, frictionless file as a question rather than an answer. Real lives are messy, and a record with no contradictions in it deserves more scrutiny than one with a few.

Ask for something that has to have existed over time. A relationship with a long history somewhere verifiable is much harder to fabricate than any single document, because it requires the fabrication to have started years earlier.

When the decision is expensive and the file is thin, a short conversation about details that were never written down anywhere remains one of the cheapest and least fashionable controls available.

One warning about buying a solution for this. Most products on the market improve the single moment check, which is the part that was already strong. The weakness is the absence of anything watching across applications and across months, and that gap is closed by how the decision is organised rather than by which vendor supplies the camera.

08Questions and answers

How is a synthetic identity different from a fake passport?

A fake document is one artefact. A synthetic identity is a whole file built around a real fragment, with a history that accumulates over months. The document is only the part you see first.

Can a liveness check still be trusted?

As one signal among several, yes. On its own it now answers a question that is cheap to answer falsely, since a rendered face can blink, turn and follow instructions on camera.

Why do these cases not appear in fraud figures?

Because nobody disputes them. With no victim to complain, the loss is usually booked as an ordinary default, so the category is understated by the way it is counted.

What is the single best signal?

History that had to exist. Anything requiring years of accumulated friction is far harder to fabricate than any document, which is why thin and unnaturally tidy files deserve attention.

Could my own details be inside one right now?

It is possible and you would not be notified. Reading your own credit record once a year is the practical way to spot a name variant or address that does not belong to you.

Does this only affect banks?

No. Anywhere an account carries value or reputation is exposed, including marketplaces, subscription services and professional platforms, wherever the check happens once at sign-up and never again.

Reference updated: 4 September 2026