Synthetic Identity Fraud Exposes US Lenders to $2.4 Billion Risk
TransUnion's report highlights a significant $2.4 billion exposure for US lenders due to synthetic identity fraud, with criminals exploiting customer accounts and brands.
Criminals are increasingly leveraging established customer accounts and well-known brands to perpetrate fraud and steal sensitive information, according to TransUnion's "Fraud in the Age of Continuous Trust" report. Analysis of the company's network during the first half of 2026 revealed that a staggering 81% of suspected digital fraud incidents occurred during account login attempts and financial transactions. This data underscores a critical vulnerability: the trust established during initial identity verification does not guarantee security throughout the entire customer lifecycle.
Synthetic identity fraud, a growing concern for financial institutions, involves criminals creating fabricated identities using a mix of real and fake personal information. These synthetic identities are designed to pass initial onboarding checks, allowing fraudsters to open accounts, obtain credit, and engage in further illicit activities across multiple services. The report emphasizes that once these fake identities are established, they can remain undetected within business systems, exploiting legitimate customer processes and business workflows.
US lenders, in particular, face substantial financial exposure from this type of fraud. At the close of June 2026, the estimated risk exposure to synthetic identity fraud for US lenders stood at a formidable $2.4 billion. Auto lending represented the largest segment of this risk, accounting for approximately $1.5 billion of the total potential losses. These figures represent the potential financial impact rather than losses already incurred, indicating a significant ongoing threat.
The report also points to the role of artificial intelligence (AI) in exacerbating these risks. AI tools can significantly lower the barrier to entry for cybercriminals by automating the generation of convincing fake documents, crafting sophisticated impersonation messages, and creating synthetic identities. This automation reduces the manual effort required to launch, scale, and adapt fraudulent schemes, enabling criminal networks to operate more efficiently and effectively.
Beyond synthetic identities, impersonation scams remain a prevalent threat. These attacks often begin with deceptive communications, such as emails or calls, that appear to originate from trusted entities like banks, insurers, or healthcare providers. Criminals exploit the reputation of these organizations to trick individuals into divulging personal details, one-time passcodes, or account credentials, ultimately leading to account takeovers or unauthorized payment redirections.
The sophistication of these attacks is further amplified by their ability to occur through communication channels outside a business's direct control, influencing customer behavior before internal fraud detection systems can intervene. Scams and authorized fraud were identified as the leading sources of business fraud losses by 29% of surveyed fraud and risk decision-makers at large consumer-facing organizations.
Regional fraud patterns highlight the diverse tactics employed globally. While North America sees significant fraud during logins, Europe experiences a higher percentage of fraud post-account creation. Latin America's expanding mobile commerce and instant payment systems create new avenues for phone scams, whereas African clients predominantly face account access issues. In Asia, mobile services and instant payments facilitate account compromise and manipulated transfers, with scams and authorized fraud being significant loss drivers in countries like the Philippines and India.
The increasing scale and sophistication of fraud, partly driven by AI, are placing severe pressure on organizations. Forty-two percent of surveyed business leaders reported that this trend is significantly impacting their operations. As businesses strengthen login controls, attackers are increasingly targeting secondary authentication processes and account recovery services to gain unauthorized access.