Synthetic Identity Detection for Banks: How to Investigate a Suspect Application

How banks detect synthetic identities at application

Synthetic identity detection asks a different question from ordinary identity fraud checks. A stolen identity belongs to a real person who may notice and complain. A synthetic identity is assembled from pieces: a real national ID number, perhaps belonging to a child or someone with little credit activity, combined with an invented name, a new address and, increasingly, an AI-generated face. No single piece is obviously false, so the bank has to test whether the pieces fit together.

The Federal Reserve's definition, developed with a focus group of fraud experts, describes synthetic identity fraud as the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain. FinCEN's alert FIN-2024-Alert004 adds the generative AI dimension: criminals have combined generated images with stolen or entirely fake personal data to create synthetic identities, then used the accounts to receive and launder proceeds of other fraud.

Detection therefore draws on three kinds of signal, and the strongest cases combine all three.

How generative AI changes synthetic identity applications

Before generative AI, a synthetic identity needed a face from somewhere: a stolen photo, a willing accomplice or a crude edit. Each of those left traces, such as a photo already on social media or an accomplice who appeared in several applications. Image generators remove that constraint. A fraudster can now create a new, consistent face for every identity, plus matching ID images. 404 Media reported in February 2024 that one site sold AI-generated ID images for $15 each.

FinCEN's alert describes the results it saw in Bank Secrecy Act data: accounts opened with suspected generative AI identities used to receive proceeds of online scams, check fraud, credit card fraud, authorised push payment fraud, loan fraud and unemployment fraud, and some used as funnel accounts. The same alert notes that reverse image searches have matched identity photos to online galleries of AI-generated faces, a cheap check investigators should run on every suspect case. Mixed identities are not limited to consumer fraud: the US Justice Department's June 2025 actions against North Korean remote IT worker schemes describe identity documents that combined stolen and fraudulent information, and one case involved compromising the identities of more than 80 US persons.

Step-by-step: investigating a suspect application

Use this sequence when an application is referred for synthetic identity review, whether by a rule, a model score or an analyst. Work on copies of submitted media and log each step in the case record.

Step 4 is where most cases are decided. A face that appears under two different names is hard to explain innocently, and generation traces on that face make the explanation harder still.

• Assemble the full application record: entered data, data source responses, documents, selfie and video, device, IP and session details, and any prior applications from the same device or contact details.
• Test data consistency: does the stated age fit the photo and the national ID issuance, and does the address history make sense?
• Analyse the selfie, liveness video and ID portrait for face swaps, generative artifacts and pixel-level edits, and run a reverse image search on the face.
• Search for linkage: the same or a very similar face, device, phone, email or address across other applications and existing customers.
• Contact the applicant through a channel you verify independently, if policy allows, and record the outcome.
• Decide: decline, request in-person verification, or approve with monitoring. If suspicious, file a SAR; FinCEN asks for the key term FIN-2024-DEEPFAKEFRAUD where deepfake media is involved.

Signs that a synthetic account got through

Some synthetic identities pass application checks and are found later. Synthetic accounts are often nurtured: small balances and on-time payments for months to build a credit profile, followed by a bust-out where every available line is drawn down at once. Others are used straight away as mule or funnel accounts.

FinCEN's post-opening indicators help catch both patterns: access from IP addresses inconsistent with the profile, coordinated activity among multiple similar accounts, high payments to gambling sites or digital asset exchanges, high chargebacks, rapid transactions on a new account, and immediate withdrawals after deposit. When those appear, re-screen the onboarding media with current detection models and look for linked accounts sharing the same face or device. The page on mule account enrolment with synthetic media covers the downstream laundering pattern.

What media analysis can and cannot prove in a synthetic identity case

Media analysis is decisive when the face was generated or swapped: it gives the investigator concrete evidence that the applicant is not who the photo claims. It also powers linkage, since a synthetic face reused across applications is a strong cluster signal.

It cannot prove that the data is fabricated. A synthetic identity built on a real accomplice's face will pass manipulation checks, and a genuine face says nothing about whether the national ID number belongs to that person. Data checks, issuance checks and linkage analysis carry those parts of the case. The threat explainer on synthetic identity fraud covers the broader typology.

How NeuroVerify and NeuroDetect support synthetic identity investigations

At application, NeuroVerify analyses the selfie, video or audio in one request across six signals, including Face Manipulation Detection, AI Generative Model Analysis and AI Pixel-Level Manipulation, and returns a unified risk score with signal-level evidence in under 200 ms p95 for eligible images under defined test conditions. That score feeds the referral rules that send suspect applications to investigation.

In the investigation, NeuroDetect lets the analyst upload the selfie, video and document images into one case, inspect heatmaps down to specific regions and frames, and export a forensic report with observations, uncertainty and model version for the case file or a SAR narrative. An LLM-assisted summary links each statement to evidence, and the analyst makes the call.

Both build on ARCAS 1B, Neural Defend's own detection model. On the public VendorBench-100 benchmark of 100 adversarial still images, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor; one benchmark author also co-authored the ARCAS paper, and the corpus is public.