A bank processes a loan application from “Alex Chen.” Perfect credit history, 18 months of on-time payments, a modest starting limit that grew over time. The underwriter approves it.
Alex Chen doesn’t exist. But the Social Security Number attached to that application belongs to a 7-year-old in Ohio. Her parents have never checked their child’s credit, and won’t until she tries to get a student loan at 18 and finds a decade of ghost debt waiting for her.
That’s synthetic identity fraud: the fastest-growing financial crime in the United States, and one that most victims don’t know has happened to them until it’s too late to undo. It’s one branch of the wider problem we map in how identity theft happens.
The identity that doesn’t exist — but has a credit score
Traditional identity theft is conceptually simple: someone uses your name and your Social Security Number to impersonate you. Your existing credit gets wrecked. You notice.
Synthetic identity fraud is different. Attackers take only your SSN (or Aadhaar, or National Insurance number) and attach a completely fabricated name and address to it. No one named Alex Chen exists. There’s no real “Alex” whose credit report shows the damage. The fraud runs invisibly for months or years, because no living person’s credit file is being visibly damaged. Then an investigator traces the SSN and finds yours attached to a ghost’s entire financial history.
Estimates for US synthetic identity fraud losses in 2024 exceed $20 billion. The Federal Reserve put the figure at $6 billion in 2016. Eight years of growth, fueled entirely by the steady supply of breached national ID numbers flooding dark web markets.
The ingredients: what attackers need
The construction is deceptively simple. Attackers need three things:
- A valid national ID number — SSN in the US, Aadhaar in India, NI number in the UK
- A fabricated name that passes format checks
- A fabricated address (sometimes real addresses, sometimes generated ones)
The national ID number is the only real element. Everything else is invented. And those ID numbers are everywhere. They come from data broker databases, medical record breaches, HR system compromises, and dark web markets where bulk breach data sells for fractions of a cent per record.
The name and address only need to be plausible. No one cross-references them against the SSN at the point of application — that verification gap is the entire attack surface.
Building the ghost identity: the 12–24 month process
This is not a smash-and-grab. Synthetic identity fraud is patient, methodical work.
Step one: Apply for a secured credit card or credit-builder loan using the synthetic identity. It gets rejected — but that rejection creates a credit file. The SSN now has a record at the credit bureaus, even if it shows only a denial.
Step two: Get added as an authorised user on a legitimate account (“piggybacking”). Someone with good credit adds the fake name to their card as an authorised user. The ghost inherits payment history. This is legal when real — it’s fraud when done deliberately to inflate a fabricated identity’s score.
Step three: Apply for low-limit store cards. Pay on time for 6–12 months. Build the score.
Step four: Apply for progressively higher limits as the credit history looks cleaner. At 12–18 months, the ghost has a respectable credit file.
Step five — the bust-out: Max out every credit line simultaneously. Stop all payments. Disappear. The lenders are left holding the losses. The ghost identity is abandoned. The attacker moves on to the next SSN.
This endpoint has a name in fraud circles: bust-out fraud. The 12–24 month buildup is not the crime — it’s the setup. The crime takes about 24 hours.
Why children’s identities are prime targets
Children don’t use credit. A 7-year-old’s SSN has no credit history, no existing accounts to flag as suspicious, no adult checking the mail for odd statements. That clean slate is ideal for synthetic identity construction — there’s no existing credit profile to contaminate.
Parents almost never check their children’s credit. There’s no reason to, in normal circumstances. So the fraud runs undetected for years. Sometimes it isn’t discovered until the child applies for student loans or a first credit card and finds a credit file full of accounts they never opened.
The attack on children’s SSNs is not speculative. The Social Security Administration issues SSNs to infants at birth, and breaches of hospital systems, school records, and government databases regularly expose them. Children’s identity records sell at a premium on dark web markets precisely because they’re clean and unmonitored.
Place a credit freeze on your child’s SSN now. It costs nothing and prevents any credit file from being opened in their name. It’s the single most effective protection available, and you can lift it when they need credit. Our credit freeze vs fraud alert guide walks through the steps.
How this differs from traditional identity theft
The critical distinction: synthetic identity fraud doesn’t immediately damage your existing credit report.
When someone uses your name and SSN to open fraudulent accounts, those accounts appear on your credit report under your name. You get alerts. The damage is visible.
Synthetic fraud attaches a different name to your SSN. Those accounts don’t appear on your credit report — they appear on the ghost’s credit file, which is indexed under a name you’ve never heard. Most credit monitoring services monitor by name. They don’t catch it because they’re not looking for your SSN attached to someone else’s name.
Detection requires SSN-level monitoring: scanning for any credit activity associated with your SSN regardless of the name on the account. Most consumers never do this. Most credit monitoring products don’t offer it as a default.
How to protect yourself
In the US: Pull your credit reports at annualcreditreport.com — all three bureaus, free. Look for accounts you don’t recognise, even under names you’ve never heard. If you see unfamiliar activity, request your full credit report by SSN from each bureau and scrutinise everything. Then place a credit freeze at all three bureaus (Equifax, Experian, TransUnion). It’s free, reversible, and prevents new accounts from being opened.
For your children: Freeze their credit at all three bureaus now. The process requires mailing documentation to each bureau, but it’s worth every minute. Keep the PINs somewhere safe.
In India: Aadhaar-based synthetic fraud targets mobile account registration and UPI-linked financial accounts. Fabricated KYC documents paired with a real Aadhaar number open SIM cards used for OTP interception and payment fraud. Check your Aadhaar authentication history at uidai.gov.in under “Aadhaar Authentication History.” Any authentication you didn’t initiate is a red flag. Lock your Aadhaar biometric at the same portal.
In the UK: Check your credit file at any of the three UK bureaus (Equifax, Experian, TransUnion). If you see accounts linked to your NI number under a name you don’t recognise, contact the bureau’s fraud team immediately.
The common thread: monitor by national ID number, not just by name. And freeze what you’re not using.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.