Synthetic Identity Fraud Statistics 2026: Losses and Trends

Synthetic identity fraud statistics are hard to pin down because the crime has no obvious victim. A fraudster pairs a real Social Security number with a fake name and birth date, builds credit, then disappears with the money. The Federal Reserve cites an industry estimate of USD 35 billion in synthetic identity fraud losses for 2023. TransUnion measured USD 2.4 billion of US credit available to suspected synthetic identities in June 2026. Yet banks filed only about 3,000 suspicious activity reports naming it in 2021. Below are the definition, the verified numbers and what each one measures.

Synthetic identity fraud statistics at a glance

Primary sources for each row are linked in the sections below and listed under Sources and References.

What is synthetic identity fraud?

Synthetic identity fraud is the use of real and fake personal information to create a person who does not exist, then using that identity to obtain credit, open accounts or move money. The Federal Reserve, after convening a focus group of 12 fraud experts, recommends this definition: "the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain" (Federal Reserve, Synthetic Identity Fraud). The definition is voluntary and creates no reporting requirement, which is one reason the numbers below are so uneven.

The Fed's 2019 white paper describes three ways a synthetic identity is built (Federal Reserve white paper, July 2019):

• Identity fabrication: a completely fictitious identity with no real PII.
• Identity manipulation: real PII slightly altered to create a new identity.
• Identity compilation: real and fake PII combined, for example a real Social Security number with an invented name, date of birth and a fake driver's license. This is the most common pattern in the Fed's examples.

Synthetic identity fraud vs. identity theft

That last row matters for statistics. When a synthetic identity defaults, the lender usually sees an ordinary bad debt with no one to collect from. The Fed's white paper notes that experts believe the number of synthetic identities in portfolios is underestimated for this reason. For identity theft against real people, see our identity theft statistics.

How a synthetic identity becomes a loss

Most schemes follow four stages: fabricate the identity, apply for credit, build a credit history, and "bust out" by maxing out every line at once. A September 2025 Fed post notes that once an account is open, a criminal may wait months or even years before monetizing it, seasoning it with small deposits, withdrawals and credit applications in the meantime (FedPayments Improvement, September 2025).

1. Fabricate. A real SSN is paired with invented details. The Fed's white paper notes victims are typically children, the elderly or the homeless, people unlikely to check their credit.
2. Apply. The first credit application is usually denied, but the inquiry creates a credit file for the new identity.
3. Build. The identity opens a starter card, pays on time, may be added as an authorized user on established accounts ("piggybacking") and gradually gains limits.
4. Bust out. Credit lines are maxed out, loans are drawn, and the identity goes silent.

Why synthetic identity fraud numbers disagree

Published figures range from USD 182 million to USD 35 billion because they measure different things. None of them is an official count of US synthetic identity fraud losses, because no such count exists.

Our calculation shows the size of the gap: the USD 182 million that institutions reported to FinCEN for 2021 is about 0.5% of the USD 35 billion estimate the Fed cites for 2023 (different years, so treat it as an order of magnitude). Either most synthetic identity losses are never recognized as synthetic, or the industry estimates are high. Fraud experts quoted by the Fed lean toward the first explanation: losses get booked as credit losses.

How much does synthetic identity fraud cost?

Loss estimates cited by the Federal Reserve

The Federal Reserve does not produce its own loss count, but it has published three industry estimates over time. Each is labeled here with its origin.

• USD 6 billion in 2016. The Fed's July 2019 white paper cites Auriemma Group for USD 6 billion in synthetic identity fraud costs to US lenders in 2016, an average charge-off balance of USD 15,000 per instance, and 20% of credit losses attributed to synthetic identity fraud that year.
• USD 20 billion in 2020. When the Fed released its Synthetic Identity Fraud Mitigation Toolkit on 8 February 2022, a Federal Reserve Bank of Boston executive said synthetic identity fraud "resulted in an estimated $20 billion in losses" for US financial institutions in 2020 (Federal Reserve press release). The estimate traces to an October 2021 report by the fraud software company FiVerity.
• USD 35 billion in 2023. A Fed post on generative AI, published 18 November 2024, says synthetic identity fraud "is estimated to have caused losses of $35 billion in 2023" without naming the source (FedPayments Improvement).

These numbers come from different methods, so the rise from USD 6 billion to USD 35 billion should not be read as a measured trend line.

Lender exposure: TransUnion's measurement

TransUnion publishes the most consistent recurring US figure: the total credit that suspected synthetic identities can access in four products (auto loans, bank credit cards, retail credit cards and unsecured personal loans). It is a measure of potential loss, not money already lost, and TransUnion notes that the true exposure may be larger because it covers only the credit types it measures.

The October 2026 TransUnion release gives the June 2026 total; Help Net Security reports the auto lending share. The H1 2025 report also found that 0.32% of attempted account openings at the end of 2024 used synthetic identities and that bank card inquiries from synthetic identities passed 1% for the first time (TransUnion H1 2025 report).

Exposure fell between 2024 and mid-2026. That does not mean the problem shrank: exposure falls when synthetics bust out and accounts are charged off, and when lenders cut credit to suspected identities. The survey data in the prevalence section points the other way.

Losses per synthetic identity

• Equifax data shows the average charged-off loss per known synthetic identity is about USD 13,000, based on tradelines opened since 1 January 2022 and reported through December 2025 (Equifax, January 2026).
• The Fed's 2019 white paper cites an average charge-off of USD 15,000 per instance in 2016 (Auriemma Group).

What banks report to FinCEN

The Financial Crimes Enforcement Network analyzed every Bank Secrecy Act report filed in 2021 (FinCEN Financial Trend Analysis, January 2024):

• About 1.6 million reports, 42% of roughly 3.8 million filed, were identity-related, covering USD 212 billion in suspicious activity.
• Synthetic identity was the primary typology in about 3,000 reports, citing USD 182 million in suspicious activity.
• Depository institutions filed 54% of identity-related reports.

The GAO repeated the USD 182 million figure when it reviewed the federal SSN verification service in 2024. The small number reflects detection and labeling, not the real scale. A synthetic identity that busts out often looks like a customer who simply stopped paying.

How common is synthetic identity fraud?

• 1% to 3% of accounts. Some payments experts estimate synthetic identities make up 1% to 3% of US bank and fintech accounts, according to a September 2025 Fed post that also cites USD 6.2 billion in reported new account fraud losses for 2024, more than double a decade earlier.
• Fastest-growing fraud type globally. LexisNexis Risk Solutions found that 11% of the frauds in its Digital Identity Network involved a synthetic identity in 2025, an eightfold increase from 2024, making it the fastest-growing fraud type it tracks. The data covers more than 116 billion transactions worldwide, and synthetic fraud reached 48.3% of fraud in Latin America (LexisNexis Risk Solutions, March 2026). The Fed cited this growth in a June 2026 post.
• Half or more of credit fraud losses. An internal Equifax study estimates that 50% to 70% of credit losses attributed to fraud come from synthetic identities (Equifax, September 2025). Equifax has not published the method.
• Hard to catch with older models. The Fed's 2019 white paper cites ID Analytics: 85% to 95% of applicants identified as likely synthetic identities were not flagged by traditional fraud models.

What fraud teams say, from TransUnion's June 2026 survey of fraud and risk decision makers:

• 67% of US business leaders expect synthetic identity fraud to increase over the next two years.
• 53% say it is the fraud type their organization is least prepared to manage.
• 18% of US leaders name synthetic identity fraud as their largest source of fraud losses, the same share as first-party fraud and behind scams and authorized fraud (35%).

Synthetic identity fraud in auto lending

Auto lending carries the largest exposure in TransUnion's data, about USD 1.5 billion of the USD 2.4 billion measured in June 2026. Equifax's auto data shows why it hurts:

• Among Super Prime auto accounts (scores above 720), those Equifax scores as high synthetic risk were 90 or more days past due at a rate of 7.9%, compared with 0.3% for low synthetic risk accounts (Equifax, March 2026).
• In that segment, delinquent high-risk loans carried an average remaining balance USD 4,400 higher than low-risk ones.

The pattern fits the bust-out model: a synthetic identity that has built a prime score can qualify for a large car loan, then default on it.

AI, deepfakes and synthetic identities

The Federal Reserve's June 2026 post explains that generative AI combined with automation now lets criminals run four steps of a synthetic identity scheme at scale (FedPayments Improvement, June 2026):

• creating synthetic identities and convincing identification and supporting documents, such as utility or phone bills;
• submitting applications for new bank accounts and credit cards;
• satisfying facial recognition and liveness checks during account opening;
• running transactions across institutions to mature accounts and raise available credit.

Regulators see the same shift. On 13 November 2024, FinCEN issued an alert (FIN-2024-Alert004) after observing an increase in suspicious activity reports describing deepfake media, particularly fraudulent identity documents used to get around identity verification (FinCEN). TransUnion's H1 2026 report found that 8.3% of global digital new account creation transactions in 2025 were suspected digital fraud, the riskiest stage of the customer lifecycle it measured.

For deepfake volumes, liveness bypass data and detection research, see our deepfake statistics.

Social Security numbers: the raw material

Synthetic identities are a mostly American problem because US credit relies on a static identifier, the Social Security number. The Fed's 2019 paper names three causes: the near-universal use of SSNs as identifiers, data breaches that expose more personal data, and gaps in the credit process.

• Breaches keep supplying SSNs. The nonprofit Identity Theft Resource Center counted 2,236 US data compromises involving SSNs in 2025, up from 1,146 in 2021 (ITRC 2025 Annual Data Breach Report). TransUnion found that 78% of US data breaches in 2025 exposed full Social Security numbers, the highest share since its research began in 2020.
• Randomized SSNs are harder to validate. Since 25 June 2011, the Social Security Administration has issued SSNs randomly rather than by state and sequence (SSA). That protects SSNs, but it also means the digits alone no longer tell a lender whether a number plausibly belongs to an applicant's age or place of birth.
• Thin files look like synthetics. TransUnion found that having no known relatives and no vehicle registration appears in 30% to 50% of synthetic identities and makes an identity up to seven times more likely to be synthetic. Legitimate young adults and new arrivals share some of these traits, which is why lenders struggle to separate them.

For the full breach picture, see our data breach statistics and fintech breach statistics.

The SSA eCBSV program in numbers

Congress responded directly. Section 215 of the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 directed the Social Security Administration to build a service that lets financial institutions check, with the consumer's consent, whether a name, SSN and date of birth match SSA records. The result is the Electronic Consent Based SSN Verification service (SSA eCBSV), which returns a yes or no match and a death indicator.

Our calculation from the April 2025 fee table: the top-tier fee works out to about 51 cents per check at 10,000 verifications a year and under 3 cents per check at 200 million. The GAO found low participation was the main obstacle: users had not grown much since enrollment opened in fiscal 2022, and industry participants found mismatch results hard to interpret. GAO records that SSA lowered fees in 2025 and, in January 2026, provided a plan to open eCBSV to entities beyond the original permitted financial institutions by June 2026. The April 2025 Federal Register notice has the full fee table.

eCBSV confirms that a name, SSN and date of birth belong together. It cannot tell whether the person applying is that person, which is why it works best alongside device, document and behavioral checks.

What the statistics mean for fintech and lending security teams

The numbers point to account opening as the main battleground, with the attack automated and increasingly AI-assisted. Fraud models are one control; the application logic around them is another, and it is where security testing helps. This checklist is DeepStrike's method guidance, not a regulatory requirement.

1. Map every path that creates an identity. List web, mobile and partner API routes that open accounts, add authorized users or raise credit limits. Output: an inventory with the identity checks each path enforces.
2. Confirm identity checks are enforced server-side. Verify that SSN verification, document review and liveness results cannot be skipped by calling a later onboarding step directly or by replaying an earlier approval. Output: validated bypass findings, if any. Our API penetration testing guide covers this kind of workflow testing.
3. Test velocity and duplicate controls. Check rate limits and duplicate detection on SSN, device, phone, email and address across applications, since synthetic schemes rely on volume. Output: thresholds that hold or fail under automated submission.
4. Test document and selfie capture integrity. In a test environment, confirm uploads must come from the live capture flow and that stored or altered media are rejected. Output: pass or fail per channel, without production data.
5. Review credit-building features. Authorized-user additions, instant limit increases and fast payment rails help a fake profile mature; test their authorization and abuse limits. Output: abuse paths ranked by exposure.
6. Protect the data that feeds synthetics. Test the APIs and storage that hold SSNs and dates of birth for broken object-level authorization and excessive data exposure. Output: findings mapped to records at risk. See our API security statistics for how often these flaws appear.
7. Retest after fixes. Confirm each fix closes the path rather than moving it. Output: closed findings with evidence.

Synthetic identities are a new-account problem; stolen credentials used against existing accounts are a different one, covered in our account takeover statistics.

How we compiled these synthetic identity fraud statistics

Selection. We used US federal sources (Federal Reserve, FinCEN, GAO, Social Security Administration) for definitions, filings and program data; credit bureau and fraud-analytics publishers (TransUnion, Equifax, LexisNexis Risk Solutions) for exposure, loss and network data, named as vendor data in each sentence; and one nonprofit (ITRC) for breach counts. Every figure was read on the publisher's page or report and checked on 5 November 2026. We did not use vendor figures that appear only in marketing material without a date or method.

Labels. "Estimate" means a modeled figure, usually relayed by the Federal Reserve. "Exposure" means credit available to suspected synthetic identities. "Survey" means respondents' answers. "Our calculation" marks our arithmetic: the 0.5% comparison of FinCEN reports with the Fed-cited estimate (USD 182 million divided by USD 35 billion) and the eCBSV cost per check (USD 5,100 divided by 10,000; USD 5,878,125 divided by 200 million).

Limits. No US agency counts synthetic identity fraud losses. Loss estimates use unpublished methods, exposure is not loss, and suspicious activity reports capture only what institutions recognized. Vendor network shares are global. Treat every figure as an indicator of scale, not a precise total.

Frequently asked questions

What is synthetic identity fraud?

Synthetic identity fraud is creating a fictitious person from a mix of real and fake personal information, typically a real Social Security number with an invented name and date of birth, and using that identity to open accounts or borrow money. The Federal Reserve defines it as using a combination of PII to fabricate a person or entity for a dishonest act or financial gain.

How much does synthetic identity fraud cost?

No official count exists. The Federal Reserve cites industry estimates of USD 20 billion in losses for US financial institutions in 2020 and USD 35 billion in 2023. TransUnion measured USD 2.4 billion in US lender exposure to suspected synthetic identities in June 2026, and Equifax puts the average loss per known synthetic identity at about USD 13,000.

How common is synthetic identity fraud?

Payments experts quoted by the Federal Reserve estimate synthetic identities make up 1% to 3% of US bank and fintech accounts. LexisNexis Risk Solutions found synthetic identities in 11% of the fraud it recorded globally in 2025, an eightfold rise from 2024. TransUnion found 0.32% of attempted account openings used synthetic identities at the end of 2024.

How is synthetic identity fraud different from identity theft?

Identity theft uses a real person's identity, so the victim usually notices and reports it. Synthetic identity fraud creates a new identity from real and fake data, so there is often no one to notice. The loss tends to land on lenders and is frequently recorded as a bad debt rather than fraud.

Who are the victims of synthetic identity fraud?

Lenders and card issuers absorb most of the losses. People whose Social Security numbers are used can also be harmed when their records get mixed with a synthetic identity. The Federal Reserve notes the SSNs often belong to children, older adults or homeless people, who are less likely to check their credit.

What is eCBSV and does it stop synthetic identity fraud?

eCBSV is the Social Security Administration's Electronic Consent Based SSN Verification service, launched in June 2020. With the consumer's consent, it tells a financial institution whether a name, SSN and date of birth match SSA records. It helps catch identities that do not match, but it cannot confirm that the applicant is the real number holder, so it works best with other checks.

Is AI making synthetic identity fraud worse?

Yes, according to the Federal Reserve and FinCEN. The Fed says generative AI can now create identities and documents, submit applications, attempt to pass facial recognition and liveness checks, and mature accounts at scale. FinCEN reported an increase in suspicious activity reports describing deepfake identity documents in November 2024.

How can fintechs and lenders reduce synthetic identity fraud?

Combine identity data checks (including SSN verification), device and behavioral signals and consortium data with sound application security. Test that every onboarding step is enforced server-side, that velocity and duplicate checks hold under automation, that document and selfie capture cannot be bypassed, and that credit-building features have abuse limits.

Next steps

Synthetic identity fraud is measured in very different ways, but the sources agree on the direction: more stolen SSNs, more automated applications and more AI-made documents aimed at account opening. Fraud models catch part of it. The rest depends on whether your onboarding APIs, verification steps and credit features enforce the controls they are supposed to.

If you want to know whether your account-opening and lending flows would hold up against automated synthetic identity attacks, DeepStrike's penetration testing services provide manual testing of web applications, APIs and mobile apps, with fix recommendations for every finding. For the wider sector picture, see our financial services cybersecurity statistics.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• Federal Reserve, FedPayments Improvement, Synthetic Identity Fraud: https://fedpaymentsimprovement.org/strategic-initiatives/payments-security/synthetic-identity-payments-fraud/
• Federal Reserve, "Synthetic Identity Fraud in the U.S. Payment System: A Review of Causes and Contributing Factors" (July 2019): https://fedpaymentsimprovement.org/wp-content/uploads/frs-synthetic-identity-payments-fraud-white-paper-july-2019.pdf
• Federal Reserve, "Federal Reserve Releases Synthetic Identity Fraud Mitigation Toolkit to Educate, Fight Fraud" (8 February 2022): https://fedpaymentsimprovement.org/news/press-releases/federal-reserve-releases-synthetic-identity-fraud-mitigation-toolkit-to-educate-fight-fraud/
• Federal Reserve, FedPayments Improvement, "When Synthetic Identities and Artificial Intelligence Collide" (18 November 2024): https://fedpaymentsimprovement.org/news/blog/artificial-intelligence-insights-added-to-synthetic-identity-fraud-mitigation-toolkit/
• Federal Reserve, FedPayments Improvement, "What's New With New Account Fraud?" (3 September 2025): https://fedpaymentsimprovement.org/news/blog/whats-new-with-new-account-fraud/
• Federal Reserve, FedPayments Improvement, "What Is Real? How AI Is Transforming Synthetic Identity Fraud" (17 June 2026): https://fedpaymentsimprovement.org/news/blog/what-is-real-how-ai-is-transforming-synthetic-identity-fraud/
• FinCEN, Financial Trend Analysis, "Identity-Related Suspicious Activity: 2021 Threats and Trends" (January 2024): https://www.fincen.gov/sites/default/files/shared/FTA_Identity_Final508.pdf
• FinCEN, "FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions" (13 November 2024): https://www.fincen.gov/news/news-releases/fincen-issues-alert-fraud-schemes-involving-deepfake-media-targeting-financial
• U.S. Government Accountability Office, GAO-24-106770, "Social Security Administration: Actions Needed to Help Ensure Success of Electronic Verification Service" (September 2024): https://www.gao.gov/products/gao-24-106770
• Social Security Administration, eCBSV: https://www.ssa.gov/dataexchange/eCBSV/
• Social Security Administration, "Notice of Tier Fee Decrease for Our Electronic Consent Based Social Security Number Verification Service," Federal Register (7 April 2025): https://www.federalregister.gov/documents/2025/04/07/2025-05905/electronic-consent-based-social-security-number-verification-ecbsv-fee-tiers
• Social Security Administration, Social Security Number Randomization: https://www.ssa.gov/employer/randomization.html
• TransUnion, "81% of Suspected Digital Fraud Attacks Target Existing Customer Relationships, TransUnion Finds" (22 October 2026): https://newsroom.transunion.com/81-of-suspected-digital-fraud-attacks-target-existing-customer-relationships-transunion-finds/
• TransUnion, H1 2025 Update: State of Omnichannel Fraud: https://www.transunion.com/report/h1-2025-omnichannel-fraud-report
• TransUnion, H1 2026 Update: Top Fraud Trends: https://media.transunion.com/content/dam/transunion/us/business/collateral/report/3971681-h1-2026-fraud-trends-update-rpt.pdf
• TransUnion, "TransUnion Research Highlights Power of Public Data in Uncovering $3.3B Synthetic Identity Threat" (17 September 2025): https://newsroom.transunion.com/transunion-research-highlights-power-of-public-data-in-uncovering-33b-synthetic-identity-threat/
• Help Net Security, "Synthetic identities leave US lenders with $2.4 billion in fraud exposure" (26 October 2026): https://www.helpnetsecurity.com/2026/10/26/transunion-synthetic-identity-fraud-risks-report/
• Equifax, "Equifax Introduces Enhanced Synthetic Identity Fraud Detection" (23 January 2026): https://investor.equifax.com/news-events/press-releases/detail/1387/equifax-introduces-enhanced-synthetic-identity-fraud
• Equifax, "What to Know About the Growing Threat of Synthetic Identity Fraud" (30 September 2025): https://www.equifax.com/newsroom/all-news/-/story/what-to-know-about-the-growing-threat-of-synthetic-identity-fraud/
• Equifax, "Synthetic Identity Fraud Trends in the Automotive Industry" (4 March 2026): https://www.equifax.com/newsroom/all-news/-/story/synthetic-identity-fraud-trends-in-the-automotive-industry-what-the-latest-auto-insights-report-reveals/
• LexisNexis Risk Solutions, 2026 Cybercrime Report press release (26 March 2026): https://risk.lexisnexis.com/global/en/about-us/press-room/press-release/20260326-ccr-global-fraud
• Identity Theft Resource Center (nonprofit), 2025 Annual Data Breach Report (29 January 2026): https://www.idtheftcenter.org/wp-content/uploads/2026/01/2025-ITRC-Annual-Data-Breach-Report.pdf