What Is a Synthetic Account?

A synthetic account is an account built on a fabricated identity that blends real and invented attributes — a genuine national ID number or address paired with an invented name, birthdate, and contact details, for example. Unlike an account stolen from a real person, a synthetic account has no victim who will notice and report it, and unlike a crude fake, it is constructed specifically to pass identity and credit checks. Synthetic identity fraud is consistently ranked among the fastest-growing financial crimes, with losses in the billions annually.

How Synthetic Identities Are Built and Used

The identity starts from a seed of real data — often breached or purchased records, with identifiers belonging to people unlikely to monitor their credit, such as minors. Around this seed the fraudster layers consistent fabricated details, then registers accounts and small credit lines. The defining phase is patience: the identity is cultivated over months or years, making punctual repayments and building history, until its trust score supports the payoff — a "bust-out" that maxes every credit line at once, high-value payment fraud, or money-mule laundering through accounts that trace back to nobody.

Synthetic Accounts vs. Fake Accounts

The two overlap but differ in investment and target. Mass fake account creation produces disposable accounts by the thousand for spam and promo abuse; a synthetic account is a curated asset aimed at banks, fintechs, payment services, and marketplaces where identity checks guard real money. The automation dependency is shared: building synthetic portfolios at scale requires bots — and increasingly AI agents — to register, maintain, and operate hundreds of identities in parallel, each needing plausible ongoing activity.

Detecting and Preventing Synthetic Accounts

Identity-side defenses look for the seams in the fabrication: identifiers with no history before a sudden recent origin, data elements shared across unrelated applicants, and verification against authoritative registries. Platform-side defenses target the operational layer, because a portfolio of synthetic identities is almost impossible to run by hand. Verifying at registration and login that a real person in a real browser is acting — the per-request check bot detection such as CaptchaFox performs — caps how many identities one operator can maintain, and device and environment signals reveal when dozens of "unrelated" accounts are operated from the same automation setup.