Introduction
Digital lending makes borrowing fast and easy, but it also creates a new target for criminals: synthetic identity fraud (SIF). Unlike old-school fraud, which uses someone else’s name or credentials, SIF builds fake, but realistic, identities from bits and pieces of real and made-up data. These synthetic “people” can get loans, credit cards, and benefits, racking up huge losses before anyone spots the deception.
What is SIF?
Synthetic Identity Fraud occurs when criminals create entirely new, fake identities by combining real and fabricated personal information to deceive financial systems into believing these are genuine individuals.
For example, a fraudster may use a real Aadhaar number, often stolen from children, the elderly, or persons who do not actively monitor their credit profiles, and pair it with a fake name, phone number, address, or employment details. Because banks and fintech lenders rely heavily on Aadhaar for identity verification in digital onboarding, these synthetic profiles appear authentic.
Over time, fraudsters use these synthetic identities to open multiple accounts, apply for credit cards or loans, and build an artificially strong credit record by initially making small, timely repayments. Once trust is established, they take out large loans or credit lines and suddenly vanish, causing significant financial loss. The unique challenge is that there is no real victim to file a complaint, making detection difficult and delayed.
Types of Synthetic Identities
- Manipulated Identities
Manipulated synthetic identities involve a real user who intentionally alters key personal details, like changing the spelling of their name, adjusting their birth date, or using a different phone number, to mask a poor or problematic credit history. This “tweaked” identity can help evade credit bureau alerts or KYC rejections, enabling the fraudster to access fresh credit. Such manipulated identities maintain a connection to the real individual but disguise their financial past.
- Manufactured Identities
Manufactured synthetic identities are more complex and dangerous. Criminals blend real personal identifiers (e.g., a stolen Aadhaar number or Social Security Number) with entirely falsified demographic data (fake name, fabricated address, phony employer details). These identities do not correspond to any real person and are constructed solely to deceive financial institutions.
To support these fakes, fraudsters may submit counterfeit documents like fake PAN cards, forged utility bills, or AI-generated photos and biometric data. Manufactured synthetic identities build credit profiles from scratch, initially showing perfect repayment to gain lender trust before committing large-scale defaults or money laundering.
Other Key Features of Synthetic Identity Fraud:
- Credit Piggybacking: Sometimes fraudsters “piggyback” synthetic identities on genuine credit accounts by getting added as authorized users, improving the fake identity’s credit score artificially.
- Delayed Discovery: Because synthetic identities are partly real and partly fictitious, they often evade early detection, with fraud surfacing only after significant damage.
- Wide Scope: Synthetic identities are not just used to obtain loans but also to open multiple bank accounts, activate SIM cards for telecom fraud, and access welfare benefits or insurance frauds.
- Use of Emerging Technologies: Fraudsters increasingly exploit AI for document forgery, deepfake biometrics, and rapid synthetic persona creation, challenging even advanced verification tech.
Reasons for the growth of SIF
- Online onboarding: Banks and fintechs let users sign up instantly, with little human review. Synthetic IDs sneak through digital KYC checks.
- Big data leaks: Stolen Aadhaar/PAN/social security numbers and other details are cheap on the dark web, often from children or the deceased.
- Gen AI tools: Now, AI can generate fake photos, documents, and even deepfake videos or voices to back up a synthetic application.
- Poor information sharing: Banks and bureaus don’t always share red flags fast enough, letting fake identities last longer.
- Explosive rise: Studies estimate SIF now accounts for over 80% of new-account fraud in the US and is up 450% in India since 2022
Real-World Examples: India and Abroad
- Bengaluru Synthetic Identity Fraud Ring (2025)
In early 2025, a Bengaluru ring created 200+ synthetic IDs using fake Aadhaar and AI-generated PAN details, passing e-KYC with major fintechs and defaulting on microloans and BNPL services. Total losses exceeded ₹4 crore. Lenders only caught on after the borrowers vanished, with the fraud publicly reported in August 2025.
- Indo Marks & BTC Home Products Pvt Ltd Scam (Bengaluru, 2002–2005 offences, 2025 arrest)
This older but revealing case saw fraudsters manipulate corporate KYC and create fake identities to defraud SBI of ₹8 crore. The accused, using several fake personas, went on the run until the CBI finally arrested the ringleader in July 2025 using AI-powered search tools.
- Operation Synthetic Shuffle (US, 2024–2025)
In 2024, “Operation Synthetic Shuffle” in Atlanta, Georgia, exposed a network that used Social Security numbers from children and dead persons to create over 700 synthetic IDs, obtaining more than $2 million via fraudulent loans and credit cards. The fraud ran for years before sentencing in January 2025.
- First National Bank Bust-Out Ring (US, 2017–2019; prosecuted 2019)
The largest US synthetic identity ring to date stitched together 7,000+ fake IDs and 25,000 credit cards, draining about $200 million. They “busted out” by withdrawing all cash and credit at once before disappearing. Their elaborate scheme was only discovered after several years.
How banks and digital lenders can overcome SIF
- Don’t Rely on Single Point KYC
Banks and lenders must move beyond traditional KYC checks that verify only documents or demographic data. A layered approach is essential to raise the defense against synthetic identities:
- Device intelligence: Use device fingerprinting to track device attributes and recognize suspicious patterns or device switching.
- Behavioral signals: Monitor how customers interact with digital platforms (mouse movement, typing speed, session patterns) to detect robotic or unnatural behavior.
- Geolocation consistency: Verify whether the customer’s digital location aligns with their claimed address and transaction history.
- Ephemeral biometric liveness checks: Employ biometric tests (facial recognition, fingerprint scanning) that verify the customer is a live person during onboarding, not a deepfake or photo.
- Cross-check multiple independent signals: Combine data points like phone number, email, utility bill records, and previous device reputations to validate identity more robustly.
- Improved Industry-Wide Data Sharing and Consortium Analytics
- Establish early-warning information sharing across banks and NBFCs to flag suspicious applications, short-lived accounts, or signs of mule accounts.
- Build consortium models and shared fraud feeds to detect multi-bank fraud patterns that a single institution might miss. This enables timely blocking of synthetic profiles spreading across platforms.
- Credit bureaus should enhance integration by developing special flags or codes for suspected synthetic profiles, incorporating alternative data like utility bills, mobile services, and device reputation trails.
- Machine Learning and Pattern Recognition
- Train algorithms to detect synthetic build signatures: inconsistent or improbable PII (e.g., mismatched income and address, unrealistic job histories).
- Spot clusters of applications coming from related or repeat devices and IP addresses.
- Detect “too perfect” onboarding patterns such as immediate regular repayments followed by sudden large credit draws and abandonment designed to mask intent.
- Continuously update models with feedback and new fraud tactics, creating adaptive systems that learn and evolve.
- Strong AML and Transaction Monitoring Frameworks
- Synthetic identities are often used in money laundering cycles or mule account networks that move illicit funds.
- Implement risk scoring for newly created accounts, focusing on early behaviors like sudden credit increases or unusual cash movements.
- Manual follow-ups must be triggered for suspicious transactions tied to recently opened accounts.
- Financial regulators require institutions to maintain Early Warning Systems (EWS) that incorporate synthetic identity indicators.
- Step-Up Authentication for High-Risk Transactions
For sensitive operations like disbursal of large loans or change in payout accounts, impose additional verification hurdles beyond first onboarding:
- Document verification backed by AI-enabled forgery detection.
- Biometric liveness checks conducted in real-time.
- Cross-check consistency across multiple documents and databases.
- Human review of flagged cases, especially to
- combat evolving threats like deepfakes, as highlighted by authorities including FinCEN.
- Centralized Fraud Governance and Response Units
- Banks and lending institutions should create dedicated fraud response teams with legal and compliance partners involved from the outset.
- These units must be empowered to freeze suspicious accounts immediately and coordinate Suspicious Activity Reports (SARs) or Suspicious Transaction Reports (STRs) with regulators.
- Cross-department collaboration improves rapid identification and mitigation of active synthetic identity fraud cases, minimizing financial and reputational damage.
- Ongoing staff training and consumer awareness campaigns on synthetic fraud warning signs are essential components of a resilient governance framework.
Legal and Regulatory Frameworks Addressing Synthetic Identity Fraud
Financial institutions operating in India must navigate a robust legal and regulatory landscape designed to combat synthetic identity fraud (SIF) and associated money laundering risks. Below are key statutes and guidelines that impose stringent obligations on banks and NBFCs:
- Prevention of Money Laundering Act, 2002 (PMLA)
- The PMLA requires banks and NBFCs to perform customer due diligence, maintain transaction records, and report suspicious transactions to the Financial Intelligence Unit – India (FIU-IND).
- Synthetic identities used for laundering illicit funds are covered under this Act. Accounts linked to such synthetic personas can attract investigation, asset attachment, and criminal prosecution.
- Financial institutions must maintain robust monitoring systems and file Suspicious Transaction Reports (STRs) whenever they detect unusual financial activity related to synthetic identities or transactions that appear structured to evade detection.
- Non-compliance may lead to severe penalties, including fines and imprisonment for officials responsible.
- Reserve Bank of India (RBI) Guidelines and Circulars
- Master Directions on KYC: Banks and NBFCs are mandated to conduct rigorous verification and continuous monitoring of customer identities, especially for high-risk accounts which synthetic identities typically exploit.
- Fraud Risk Management Framework: Institutions must maintain Early Warning Systems (EWS) to detect suspicious accounts, particularly newly opened ones exhibiting abnormal transactions or credit inflows potentially linked to synthetic fraud.
- The RBI promotes data sharing among banks and credit bureaus and insists on stringent AML compliance and secure IT systems incorporating biometric and AI-driven fraud detection mechanisms.
- Bharatiya Nyaya Sanhita (BNS), 2023
- The Bharatiya Nyaya Sanhita (BNS), which modernizes and consolidates several criminal law provisions, replaces equivalent sections of the Indian Penal Code related to cheating and fraud.
- Section 318 of BNS is the key provision regarding cheating and fraud. It broadly covers acts of deception that dishonestly induce individuals to deliver property, consent to retain property, or omit actions to their detriment.
- Penalties under BNS 318 are comprehensive, ranging from imprisonment of up to seven years and fines depending on the severity of the offense, particularly if the cheating causes wrongful loss to those whose interests the offender is legally bound to protect.
- The section explicitly addresses financial fraud, including forgery, fabrication of identities, and inducement to part with property through dishonest misrepresentations, crimes typical of synthetic identity fraud schemes.
- BNS strengthens enforcement by providing clearer definitions and tougher penalties than the corresponding IPC sections, reflecting the evolving nature of financial and cyber fraud.
- Compliance and Enforcement Imperative
Institutions must integrate these legal mandates into their compliance frameworks by:
- Implementing enhanced KYC and AML controls focused on synthetic identity risk.
- Maintaining detailed record-keeping systems and monitoring tools to detect and escalate suspicious activity promptly.
- Training staff extensively on BNS provisions and PMLA compliance to understand the legal ramifications of synthetic identity fraud.
- Coordinating with regulators through timely submission of STRs and cooperation during investigations.
Failure to adhere to these requirements can lead to not only regulatory sanctions under the PMLA and RBI directives but also criminal prosecution under BNS provisions, highlighting the serious legal consequences for banks and their officers if synthetic identity fraud is mishandled.
AMLEGALS Remarks
Synthetic Identity Fraud reveals the darker side of digital lending. It is sophisticated and complex, often difficult to detect but certainly not invincible. A robust defense strategy combining cutting-edge technology, regulatory compliance, and industry collaboration can significantly reduce the risk of fraud.
For financial institutions, the way forward demands embracing innovation without overlooking the associated risks. As digital credit systems expand globally, lenders, regulators, and technology providers must work together to ensure that the promise of financial inclusion is not compromised by synthetic fraud.
Though synthetic identities are fictitious, their financial impact is very real. Globally, synthetic identity fraud has resulted in billions of dollars in losses, draining both budgets for innovation and investor confidence. Tackling this growing menace is imperative to preserve trust, security, and sustainable growth in digital lending.
leveraging AI and machine learning for advanced anomaly detection, reinforcing biometric and document verification, integrating alternative data sources for identity validation, and enhancing real-time fraud data sharing across financial institutions. Establishing early detection and rapid response units is also essential for containing risks quickly.
Ultimately, confronting synthetic identity fraud head-on will enable digital lending to evolve into a secure, reliable, and inclusive pillar of the modern financial ecosystem, fostering sustainable access to credit for all.
For any queries or feedback, feel free to connect with hiteashi.desai@amlegals.com.