Synthetic Identity Fraud at Checkout: How to Spot Customers Who Never Pay

Synthetic identity fraud is the use of a combination of personal information to fabricate a person who does not actually exist, in order to commit fraud, which is the definition the Federal Reserve established so the industry could measure it consistently. The defining feature is that it mixes real and fake information: typically a legitimate, unused Social Security number, often one belonging to a child or someone with no credit history, combined with a made-up name, date of birth, and address. Because part of the identity is genuine and the whole thing is internally consistent, it passes checks designed to confirm that data is real and matches. What makes it different from stolen-identity fraud is that there is no real victim to notice and dispute the activity, since the person is invented, so the fraud can operate quietly for a long time. That patience is deliberate: synthetic identities are usually built and aged with small, well-behaved accounts before they are used, which is what gives them the credit history that makes them look like real, creditworthy customers.

Because your checks confirm that the information is real and consistent, not that a real person stands behind it, and a synthetic identity is engineered to satisfy exactly that. The Social Security number is genuine, the name, address, and date of birth are coherent, and by the time it is used the identity usually has a real credit history from months or years of small accounts, so a verification that asks whether the data matches and checks out gets a yes. Adding more identity validation, document checks, and data matching raises the bar against sloppy fraud, but a well-built synthetic is not sloppy; the aging process exists precisely to give it the history that passes those checks. That is why leaning harder on data validation does not solve it, because you are confirming attributes the identity was designed to have. The detection has to move from the data to behavior and relationships: how old and coherent the identity’s footprint is, how many identities share a device or payment instrument, and whether the identity behaves like a real customer, which are the questions a fabricated person struggles to answer.

First-payment default is when an account or order passes every check and then misses its very first payment or charges back almost immediately, and it matters because it is the single most useful merchant-observable signal of synthetic identity and bust-out fraud. The logic is simple: a real customer typically pays for a while and only later runs into trouble, whereas a synthetic identity exists to obtain goods, credit, or a payout and then disappear, so the default comes right at the start because paying was never the plan. The signal is especially strong across a cohort. If a batch of new accounts or first orders all default on the first payment, share subtle device or network characteristics, and were opened in a similar window, that is very likely a group of synthetic identities cashing out together rather than unrelated bad luck. Tracking first-payment-default rate by cohort turns an otherwise invisible loss into a measurable signal, and feeding those defaults back into your risk scoring lets you catch the same operation on its next attempt even if the first order got through.

The core difference is whether a real victim exists. In stolen identity fraud, a criminal uses a real person’s actual identity, so that person eventually notices the unauthorized activity, reports it, and disputes it, which puts a natural time limit on how long the fraud can run and often triggers chargebacks and investigations. In synthetic identity fraud, the person is fabricated, a real Social Security number combined with a made-up name, date of birth, and address, so there is no real victim watching the account and no one to report it. That absence is what makes synthetic identity so durable and so hard to detect: the fraud can operate quietly for months or years while the identity is aged into looking creditworthy, and when it finally defaults there is no victim, just a person who never existed. For detection, the implication is that you cannot rely on a victim’s dispute to flag synthetic fraud the way you sometimes can with stolen identities; you have to catch it through behavioral and relationship signals and the first-payment-default pattern instead.

It can hit an ecommerce store, though the largest measured dollar figures are in lending. Synthetic identity fraud is concentrated in auto loans, credit cards, and personal loans, where TransUnion found record lender exposure, because that is where a fabricated identity with built-up credit can borrow large amounts and vanish. But the same fabricated identities reach merchants through the doors that depend on the identity being creditworthy or trustworthy: new-account signups, buy-now-pay-later, financing, and orders where the store effectively extends trust before being paid. At a store, the fraud shows up not as a scary macro number but as an order that clears every check and then defaults or charges back, and as clusters of new accounts that share devices and default on their first payment. So the honest framing is that lending carries the biggest exposure, but any merchant that grants credit, offers pay-later options, or ships before guaranteed payment can be a target, and the checkout signals, thin footprint, device-to-identity ratio, and first-payment default, are how a store sees it.

The key is to treat thin-file and unusual-footprint signals as reasons to verify rather than to decline, because real customers who are young, recently arrived, or simply new to credit look superficially like synthetic identities. Start by adding the signals a fabricated identity struggles with: device and network intelligence to see when many supposedly different customers share one device, identity-footprint age to flag thin or freshly-assembled identities, and velocity checks across identities and payment instruments. Then, crucially, route the ambiguous ones to a step-up verification, a confirmation to the account holder, an extra check, or a temporary hold, instead of an automatic block, so a real thin-file customer can prove themselves and complete the purchase. Pair all of this with first-payment-default monitoring so the synthetics that do slip through are caught quickly and fed back into your scoring. Done this way, you raise scrutiny on the risky middle without turning away good revenue, which is the balance that matters: false-declining real customers is a real and often larger cost than the fraud itself, so verification, not blanket rejection, is the right tool.