Mobile Synthetic Identity Scams Outscore Real Borrowers Using Deepfakes and AI
Fraudsters are leveraging inexpensive 'liveness kits' and AI to create synthetic identities that can bypass mobile verification and achieve better credit scores than legitimate borrowers.
Financial institutions are increasingly facing a sophisticated threat from synthetic identity fraud, where cybercriminals construct fake identities using a combination of stolen and fabricated data. A new tactic involves the use of "liveness kits," available for as little as $30, which allow fraudsters to circumvent mobile device verification processes. These kits enable the injection of deepfake video streams or the hijacking of a device's camera feed, effectively tricking verification systems into believing a real person is present.
Once a synthetic identity successfully passes the initial onboarding checks, the fraud doesn't stop. Attackers employ agentic artificial intelligence to automate the building of a credit profile over a period of six to 18 months. This involves making timely payments on secured credit cards and utilizing micro trade lines to establish a seemingly healthy repayment history. This patient, automated approach allows the synthetic profile to mature into prime or even super-prime credit territory, making it appear legitimate to traditional credit scoring models.
Matt Vega, chief fraud strategist at Point Predictive, highlights that the gradual build-up of a positive credit history is a key factor that makes this type of fraud difficult to detect. A sudden leap from a dormant credit file to a strong repayment record is a significant warning sign, but the prolonged, automated nature of the activity masks this anomaly for extended periods. This patience on the part of the fraudsters is what allows these synthetic identities to gain traction and achieve higher creditworthiness than many real individuals.
Combating these advanced attacks requires a multi-layered defense strategy. No single technology can effectively stop them. Financial institutions must implement robust multi-layered verification processes, rigorous income checks, and continuous monitoring systems to identify synthetic identities before they can access substantial credit lines. Data sharing among institutions can also bolster defenses, creating a form of 'herd immunity' where collective defenses are strengthened by shared threat intelligence.
Vega emphasizes that even with advanced security measures, traditional rule engines often prove effective against sophisticated attack vectors. "Old-school rule engines can knock out a lot of the high-risk fraud that's out there," he stated. The principle is that while attackers innovate with AI and deepfakes, basic, well-defined rules can still catch many of the underlying patterns of fraudulent activity, especially when applied across multiple verification stages.
Beyond the injection kits, the AI's role extends to mimicking physiological signals that liveness checks often rely on, such as heartbeat and pupil dilation. Advanced AI can generate these signals convincingly, further complicating detection. Additionally, deferred first-payment loan programs provide fraudsters with a wider operational window, allowing more time to establish the synthetic identity's credibility before any actual repayment is due.
The limitations of data-sharing consortia also present challenges. While beneficial, these models rely on collective defense, and institutions unable to participate may miss out on crucial intelligence. This underscores the need for individual institutions to maintain strong internal detection and prevention mechanisms, even as they contribute to broader industry defenses.
Ultimately, the rise of AI-powered synthetic identity fraud signifies a new frontier in financial crime. The ability to create convincing deepfakes and meticulously build credit histories means that fraudsters can now achieve financial standing superior to that of many legitimate consumers, posing a significant and evolving challenge to the banking and fintech sectors.