The customer you just approved does not exist. How synthetic identities pass KYC, and how to catch them.

Picture a new customer. The ID number is real: it exists in the national database and it has the right number of digits. The name on the application is close to the name on the record, but not the same. The date of birth is a year out. The selfie is a real, live person.

Each check, read alone, says yes. The number is valid. The liveness check found a person. The phone number receives a code. Nobody asks whether the number, the name, the birthday and the face all belong to one human being.

They do not. The number belongs to someone who has never heard of you. The rest was made up, or borrowed from somebody else. The customer on your books is a person who does not exist, and you have just given that person an account, a limit and a verified badge.

That is synthetic identity fraud.

What a synthetic identity is

The US Federal Reserve convened industry experts to agree a definition, and published it in 2021: synthetic identity fraud is the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain (opens in a new tab). The definition is voluntary guidance for industry and creates no legal duty.

The same page separates two kinds of detail. Primary elements, such as a name, a date of birth and a government-issued identifier, are in combination typically unique to one person. Supplemental elements, such as an address, a phone number or an email address, can support an identity but cannot establish one by themselves.

That distinction is the whole problem in one line. A fraudster needs one genuine primary element, usually the ID number, and can invent or swap the rest.

What it costs you

The Federal Reserve describes synthetic identity fraud as the fastest-growing type of financial crime in the United States (opens in a new tab). We have not found an equivalent published measure for African markets, so we will not quote one. The way the loss lands is the same.

• There is nobody to chase. When a loan to a stolen identity goes bad, a real victim complains and the fraud is found. When a loan to an invented person goes bad, it looks like an ordinary default. It is written off as credit loss, and the method is used again.

• Your file looks clean. The record shows a valid ID number and a live face. A reviewer has no reason to open it until the losses point back at it.

• It scales. One person with a list of real ID numbers can open many accounts. The Federal Reserve's toolkit notes that the same synthetic can be used to defraud multiple industries at the same time (opens in a new tab).

Why single checks pass it

The Federal Reserve's guidance on detection is blunt: synthetic identities often pass initial identity verification, and typically no single indicator signifies a synthetic identity (opens in a new tab). Each common check answers a narrower question than it appears to.

• "Is this ID number valid?" Yes. It is a real number. The question never asked whose.

• "Is this document genuine?" It may be, or it may be a good edit. A document read without a record behind it can only be compared with itself.

• "Is a live person present?" Yes. Liveness proves a person is there. It does not prove they are the person the number belongs to.

• "Does this phone or email work?" Yes. These are supplemental elements, and they are the cheapest part of an identity to create.

Identity standards describe the gap precisely. The US NIST digital identity guideline splits proofing into resolution, validation and verification (opens in a new tab): collecting the details, confirming they are accurate against a credible source, and confirming that the applicant is the genuine owner of them. A synthetic identity survives when the second and third steps are skipped, or done against different sources that are never compared.

The combinations that expose it

The useful checks force every detail to agree with one authoritative record.

• The number against the record. Look the number up at the source. This confirms the number exists and returns the details the government holds for it.

• The name and date of birth against the same record. Compare what the applicant told you with what the record says. A real number with the wrong name is the classic synthetic.

• The live face against the record photo. This is the check a fabricated identity finds hardest. The fraudster can type any name. They cannot change the photo the government holds.

• The same face or device across accounts. The Federal Reserve calls similar customer information across accounts (opens in a new tab) the biggest indicator. One face behind five names, or five ID numbers from one phone, is a pattern no single application shows.

Our guide to document checks versus government database checks covers the first three in more depth, and finding duplicate accounts covers the fourth.

What Toden does

• Checks the number at the source. In Nigeria, Ghana, Kenya, South Africa and Côte d'Ivoire, Toden validates the ID against the government database. That includes number-only IDs such as the BVN and NIN.

• Compares the details you hold. Pass the name and date of birth you collected and Toden compares them with the record. By default a mismatch fails the verification. You can choose to record it and send it to review instead, using verification.nameMatch and verification.dateOfBirthMatch in a decision rule.

• Matches the live selfie to the strongest photo. That is the government record photo, or the verified photo on a passport chip. The result tells you which was used in facialMatchSource, so a match against a printed photo is never mistaken for a match against the record.

• Tells you how strongly it passed. Every passing verification carries an assurance level: chip, gov_db or document. You can approve the first two and review the third.

• Verifies more than one ID in a run. A workflow can ask for two or three IDs, for example a NIN and a BVN, with one selfie covering all of them. An invented person now has to agree with two records.

• Looks across your accounts. Face search finds a person who already has an account with you. Device Intelligence, on by default, reports other ID numbers and other people seen on the same device, and your rules decide whether that means review or decline.

What it does not do

• Outside those five markets no government database check runs. A verification there rests on the document, and on the chip when a passport is read by NFC, which needs the React Native or Flutter SDK. A real number with invented details is harder to catch without a record to compare against.

• The name and date of birth comparison needs details to compare. If your integration passes none, there is nothing to contradict.

• Face search and device findings cover your own customers and your own traffic. They will not tell you about an account at another institution.

• A complete, genuine identity lent by its real owner is not synthetic, and these checks will pass it. That is a mule problem, and it needs monitoring after onboarding.

• No set of checks removes this fraud. They raise the cost of fabricating a person.

Questions to ask a provider

• In which countries do you check the ID number against the government record, and in which do you only read the document?

• Do you compare the name and date of birth with that record, and can I see which field disagreed?

• Which photo was the selfie matched against: the record, the chip or the printed document? Does the result say?

• Can you show me the same face or the same device across my existing customers?

• When a check could not run, do you say so, or return a pass?

This article is general guidance, not legal advice. What your regulator expects of customer identification depends on your licence and your country, and the sources cited here are US guidance, used to explain the pattern.

Want to see the checks agree, or disagree, on your own flow? Open a Toden workspace (opens in a new tab) or see KYC coverage by country.