Somewhere on the internet right now, Elena Brooks is applying for an auto loan. Her LinkedIn profile shows five years at a Fortune 500 company. Her credit score sits at 742. Her social media presence looks lived-in—birthday posts from friends, photos from a 2022 wedding, restaurant check-ins across three cities. Her face is photogenic but not suspiciously perfect. Every verification system she encounters clears her. Elena Brooks doesn't exist. She never has. The $23 Billion Person Who Never Was The $23 Billion Person Who Never Was By the end of 2024, synthetic identities accounted for 85-95% of all fraud losses in financial services. U.S. lender exposure reached $3.3 billion in the first half of 2024 alone—the highest recorded level to date. Deloitte projects synthetic identity fraud will generate at least $23 billion in losses by 2030, up from $6 billion in 2016. But here's what makes this different from every fraud wave before it: synthetic identity fraud is now the fastest-rising type of fraud in 2024, according to TransUnion, and it's not being committed by teenagers in basements. It's being industrialized by criminal syndicates using the same AI tools your marketing team deploys daily. I've covered cybersecurity since 2010. I've documented ransomware epidemics, state-sponsored espionage, and billion-dollar breaches. But synthetic identity fraud represents something more insidious—it's fraud that doesn't produce victims who can report crimes, because the identity being stolen is a Frankenstein assembly that never belonged to anyone. How to Build a Human From Scratch How to Build a Human From Scratch In the UK, false identity cases increased 60% in 2024 compared to 2023, making up nearly a third (29%) of all identity fraud cases. The mechanics have been democratized to an alarming degree. In 2024, there were over 3,200 data breaches reported in the United States. Between 1.6 and 1.7 billion breach notices were sent to individuals. That's the raw material. Fraudsters harvest Social Security numbers from children (whose credit is pristine), addresses from stable homeowners, employment details from public LinkedIn profiles, and dates of birth from obituaries or public records. Then generative AI takes over. Virtual influencer Lil Miquela—a CGI character created in 2016—has 2.6 million Instagram followers and charges $9,000-$10,000 per sponsored post. She's partnered with Prada, Calvin Klein, Samsung, and BMW. Her creators use Generative Adversarial Networks (GANs) and machine learning to generate realistic visual content and social media interactions. Now imagine that same technology, but optimized for fraud instead of marketing. ThisPersonDoesNotExist.com demonstrates the basic capability: AI-generated faces that look photographically real. But modern synthetic identity operations go further. They generate entire digital footprints—years of social media activity, employment histories, consumer behavior patterns that match regional demographics. ThisPersonDoesNotExist.com According to Experian UK&I's Tristan Prince: "Criminals are using AI to create images, generate identities, set up email addresses, and write social engineering scripts. This has all made creating a synthetic identity easier for criminals." The cost? Three seconds of audio can produce an 85% voice match. The deepfake robocall impersonating President Biden in January 2024 cost $1 to create and took less than 20 minutes. The Long Game: Why Synthetic Identities Don't Get Caught The Long Game: Why Synthetic Identities Don't Get Caught Traditional identity theft produces immediate signals—a real person reports unauthorized charges, their credit monitoring triggers alerts. Synthetic identities operate differently. Fraudsters build credit profiles over time. They open accounts, make minimal payments, gradually establish legitimacy. A skilled operator cultivates a positive credit profile, sometimes for years. As the credit strengthens, they secure additional loans and credit cards. Then comes the "bust-out": they max every credit line simultaneously and vanish. The average charge-off balance per synthetic identity fraud case is $15,000, according to Federal Reserve research. But here's the systemic problem: Much of synthetic identity fraud is written off as bad debt. Organizations often never uncover the synthetic identities behind these losses. A CISO at a major regional bank showed me their fraud analytics dashboard last month. They'd identified 47 confirmed synthetic identities in their customer base—after those accounts had been open for an average of 2.3 years and had generated cumulative losses of $680,000. "We only caught them because we started using machine learning to analyze behavioral patterns across accounts," he said. "Traditional fraud detection never flagged them because they looked like slightly risky but legitimate customers." How many more are still active in their system? He didn't have an answer. The Business of Manufactured Existence The Business of Manufactured Existence Synthetic identity fraud is expected to generate at least $23 billion in losses by 2030. In the first half of 2024, lender exposure in the U.S. reached $3.2 billion, the highest recorded level to date—a 7% year-over-year increase. Auto lending sees the highest exposure, with fraud balances nearly double those of bankcard sectors. But the threat extends far beyond financial services. TransUnion's analysis found synthetic identities in 0.1% of all risky transactions in 2024, representing millions of transactions. In telecommunications, 3.0% of all transactions were suspected digital fraud, with identity theft as the most cited form. Industries like online communities and video gaming face digital fraud risk rates exceeding 10% in 2024. Translation: if you run a digital business with account creation, you almost certainly have synthetic identities in your customer base right now. You just haven't found them yet. When AI Influencers Meet AI Fraudsters When AI Influencers Meet AI Fraudsters The line between legitimate and fraudulent synthetic identities is blurring in unexpected ways. Aitana López, a 26-year-old AI-generated influencer created by Barcelona agency The Clueless, generates over $550,000 annually through brand partnerships and adult content platform Fanvue. A human influencer with a million followers might charge $250,000+ per post. Lil Miquela, with millions of followers, charges around $9,000. According to an Influencer Marketing Factory study, 47% of Gen Z consumers don't care if influencers they follow are human or AI-generated. Engagement is about "aesthetic alignment" and "vibe," not biological authenticity. The average engagement rate of virtual influencers is 2.84%, compared to 1.72% for human influencers. So legitimate businesses are deploying synthetic personas that generate real revenue and authentic emotional connections with audiences. Meanwhile, criminal enterprises deploy structurally identical synthetic personas to extract billions in fraud losses. The technology is morally neutral. The implementation determines legality. The February 2024 Wake-Up Call: Arup's $25 Million Video Conference The February 2024 Wake-Up Call: Arup's $25 Million Video Conference In January 2024, a finance worker at engineering firm Arup joined a video conference with the company's UK-based CFO and several familiar colleagues to discuss a confidential acquisition. After thorough discussion, the employee authorized 15 transfers totaling $25.5 million. Weeks later, the truth emerged: every person on that call except the victim was an AI-generated deepfake. Arup's global CIO Rob Greig told The Guardian: "What we have seen is that the number and sophistication of these attacks has been rising sharply in recent months." Deepfake fraud cases surged 1,740% in North America between 2022 and 2023, with financial losses exceeding $200 million in Q1 2025 alone. A deepfake attempt occurred every five minutes in 2024. Globally, 49% of businesses reported audio or video deepfake incidents by 2024. On average, businesses across industries lost nearly $450,000 to deepfakes, with some large enterprises experiencing losses up to $680,000 per incident. The sophistication curve has gone vertical. Voice cloning now requires just 20-30 seconds of audio, while convincing video deepfakes can be created in 45 minutes using freely available software. The Authentication Collapse The Authentication Collapse I spoke with a fraud prevention director at a fintech company in October. They've implemented multi-factor authentication, biometric verification, document validation, and behavioral analytics. Their false positive rate sits around 8%—meaning they incorrectly flag legitimate customers as fraudulent roughly one in twelve times. "The problem," she said, "is that synthetic identities don't trigger the behavioral anomalies we're trained to detect. They don't look like fraud. They look like new customers with thin credit files trying to build history. Which is exactly what they're designed to look like." Digital document forgeries increased 244% year-over-year in 2024. For the first time, digital forgeries (57%) surpassed physical counterfeits as the leading fraud method—a 1,600% surge since 2021 when almost all fraudulent documents were physical. The report identifies AI-assisted deepfakes as an area of particular concern, as basic fraud tactics give way to sophisticated, hyper-realistic attacks. Face-swap apps and GenAI tools allow fraudsters to perform and scale increasingly believable biometric fraud attacks. Traditional authentication assumes the person being verified exists and is attempting to impersonate themselves (or someone else). Synthetic identities break that assumption—they're authenticating as someone who was designed from the ground up to pass authentication. The Children Nobody's Protecting The Children Nobody's Protecting According to Javelin's 2024 research, every 19th child fell victim to identity fraud over the past six years in the U.S. Children's Social Security numbers are particularly valuable because they're "clean slates"—no credit history, no monitoring, and the fraud often goes undetected for years until the child applies for their first credit card or student loan. Criminals create synthetic identities using a child's SSN and let it sit dormant for years, only activating it when the child reaches adulthood. I interviewed a 22-year-old college graduate in September who discovered her identity had been used to open seven credit cards, two auto loans, and a mortgage between ages 14 and 21. Total fraudulent debt: $127,000. The synthetic identity had been active for eight years before she applied for student housing and was denied due to a 480 credit score. "The bank kept asking me to verify charges I'd made," she told me. "I had to keep explaining: I didn't make those charges. That person doesn't exist. I was 14. I didn't even have a driver's license when someone using my Social Security number bought a $35,000 truck." It took her eighteen months and a lawyer to unwind the fraud. The perpetrators were never identified. What Detection Actually Looks Like (And Why It's Failing) What Detection Actually Looks Like (And Why It's Failing) Synthetic Identity Theft makes up 85% of all identity fraud cases found by Authentic. In 2023, 47% of businesses reported increases in Synthetic Identity Theft cases. 91% of organizations in the USA consider synthetic identities a growing threat, while 46% of organizations worldwide experienced synthetic identity fraud in the past year. Yet only 25% of financial service companies feel confident addressing synthetic identity fraud, and just 23% feel prepared to deal with AI and deepfake fraud. The detection challenge is structural. Traditional fraud systems look for deviations from normal behavior. Synthetic identities establish normal behavior, then deviate—making them look like legitimate customers experiencing financial hardship, not fraud operations. One security architect walked me through their machine learning detection system. It analyzes: Account creation patterns (time of day, device fingerprinting, IP geolocation consistency)
Initial activity levels (synthetic accounts often show suspiciously perfect payment behavior early on)
Social graph analysis (do other accounts reference this identity? Do they share device IDs or IP addresses?)
Behavioral entropy (humans are inconsistent; synthetic identities often show algorithmic patterns) Account creation patterns (time of day, device fingerprinting, IP geolocation consistency) Initial activity levels (synthetic accounts often show suspiciously perfect payment behavior early on) Social graph analysis (do other accounts reference this identity? Do they share device IDs or IP addresses?) Behavioral entropy (humans are inconsistent; synthetic identities often show algorithmic patterns) Detection rate for confirmed synthetic identities: 31%. "We're essentially trying to spot AI-generated behavior by looking for patterns that are too perfect," he explained. "But as the AI gets better at mimicking human inconsistency, our detection rates are declining. Six months ago we were at 38%. We're losing ground." The Coming Identity Crisis The Coming Identity Crisis TransUnion noted that by the end of 2024, synthetic identities in bankcard credit inquiries surpassed 1%—a first since they began tracking the metric. Think about that: more than one in every hundred credit card applications is now a fabricated person. Three major factors created the perfect storm: tens of billions of records breached over the past decade; 52% of consumers targeted by phishing, smishing, and vishing scams in Q4 2024; and Social Security Administration randomization of SSNs in 2011, which eliminated geographical validation. The infrastructure we built to verify identity—credit bureaus, government databases, financial institutions—was designed for a world where identities were assumed to be real and the challenge was confirming "are you who you claim to be?" We've entered a world where the question has changed: "Do you exist at all?" When Trust Becomes A Programming Language When Trust Becomes A Programming Language TransUnion's Jeffrey Huth told StateScoop: "I think it will become much easier and faster to create completely realistic-looking, fabricated identities, whether it's building a financial profile, [or] a digital footprint." The philosophical implications are uncomfortable. When algorithms can generate personas indistinguishable from humans, authentication stops being a technical problem and becomes an epistemological one. How do you verify someone exists when existence itself can be manufactured? Huth emphasized the importance of "omnichannel verification"—vetting whether an individual is real or fake through multiple methods, including verbal, digital, and geographical checks. But even multi-layered verification fails when synthetic identities are designed from the beginning to pass those specific tests. One identity verification company I spoke with is experimenting with "temporal consistency analysis"—tracking whether a user's digital footprint shows the kind of long-term, low-level inconsistencies that characterize real humans versus the suspiciously coherent narratives that synthetic identities often exhibit. Early results: mixed. False positive rate is high enough to damage legitimate user experience. The Regulatory Vacuum The Regulatory Vacuum The EU's AI Act, which entered force in August 2024, mandates transparency obligations and technical marking for AI-generated content. But enforcement mechanisms remain theoretical, and synthetic identity operations rarely respect jurisdictional boundaries. The federal government is trying to support industry solutions but with mixed results. There's no federal mandate for synthetic identity detection in financial services. No standardized reporting requirements. No centralized database tracking known synthetic identities across institutions. The result: each organization fights its own private war against an enemy that learns from every successful attack and shares intelligence through dark web forums and criminal networks. What Comes After Trust What Comes After Trust We're approaching an inflection point where traditional identity verification—the backbone of financial services, healthcare, government benefits, employment—may no longer be reliable. The next generation of authentication won't ask "Is this person who they claim to be?" It will ask: "Can we establish, through cryptographic proof and behavioral validation, that this entity has existed consistently over time in ways that artificial construction cannot replicate?" Decentralized identity systems, blockchain-based credentials, and zero-knowledge proofs offer theoretical solutions. But adoption requires rebuilding identity infrastructure from scratch—a multi-trillion-dollar undertaking that assumes global coordination and trust in new systems. Meanwhile, Elena Brooks just got approved for that auto loan. Her first payment is due in 30 days. She'll make it on time. She'll make the next eleven payments too, building her credit score to 780. Then, on payment thirteen, Elena Brooks will vanish. And somewhere, a fraud analyst will write it off as bad debt, never knowing they'd just been defrauded by someone who was never born.

dashboard

Digital Doppelgängers: When Your Best Customer Never Existed

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

AI in the Classroom Promises Efficiency—But at What Cost to Learning?

The Noonification: How Often Do NFTs Pass The Howey Test? (1/13/2023)

Darwin's Hybrid Intelligence to Align AI & Human Goals for Startups & VCs

The Noonification: White Man (11/26/2022)

The Noonification: The Metaverse is a Sh*tshow (11/2/2022)

AI in the Classroom Promises Efficiency—But at What Cost to Learning?

The Noonification: How Often Do NFTs Pass The Howey Test? (1/13/2023)

Darwin's Hybrid Intelligence to Align AI & Human Goals for Startups & VCs

The Noonification: White Man (11/26/2022)

The Noonification: The Metaverse is a Sh*tshow (11/2/2022)

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps