AI-generated synthetic identities expose flaws in document-only verification

Full text

Most fraud strategies fail before a fraudster is ever detected, because they evaluate documents, rather than people.

Consider the operational reality: a customer signs up for a fintech service. Their government-issued ID clears every document check. Their selfie matches. Their name passes the database lookup. Onboarding completes.

What no one detected was that the identity didn’t belong to a person. It was assembled by generative AI in minutes — a synthetic construction engineered to pass exactly the checks that were run.

The account sits dormant for weeks, builds behavioral credibility, then executes a scheme that costs the platform tens of thousands of pounds. Deepfake-enabled fraud alone caused more than $200 million in losses in the first quarter of last year.

This is not a stress-test scenario. Synthetic identity fraud is the operating condition for every business that onboards customers digitally. And the industry’s default response — collect an ID, verify it, move on — was not designed for it.

The document-first blind spot

The document-first model has a structural flaw in that it only responds to fraud after a document arrives. Intent, behavioral context and the coherence of a user’s digital existence sit outside its scope entirely. Identity verification becomes a single event rather than a continuous assessment.

That architecture now has a measurable cost. GenAI-enabled fraud losses in the U.S. will reach $40 billion by 2027, up from $12.3 billion in 2023 — a compound annual growth rate of 32%. The dark web has already industrialized the supply side: scam kits that produce deepfake videos and synthetic documents sell for as little as $20, placing sophisticated fraud tools within reach of anyone willing to pay.

The damage shows up at the portfolio level. Synthetic identity fraud, fabricated identities assembled from combinations of real and invented data, accounts for 10 to 15% of charge-offs in a typical unsecured lending portfolio. That is not a tail risk. It is built into the cost structure of credit.

From KYC to proof of personhood

The problem is not that document verification is imperfect. The problem is that document verification asks the wrong question. Proof of personhood reframes the objective entirely. Rather than asking "Is this ID real?" it asks "Is there a real, unique human being behind this transaction?" And it maintains that inquiry continuously across the customer lifecycle rather than resolving it once at onboarding.

The distinction matters operationally. Fraudsters engineer synthetic identities specifically to clear document checks. A convincing fake ID passes the same OCR and liveness detection as a legitimate one. What it cannot reproduce — not convincingly, not at scale — is the full context of a real person’s digital existence. That context is where proof of personhood lives and where effective verification has to operate.

A real person leaves years of accumulated traces across the digital economy: email addresses registered to real services, phone numbers tied to consistent carriers, devices with histories spanning multiple sessions and networks, and behavioral patterns shaped by how actual humans navigate products.

None of these traces is individually decisive. But their presence or their absence tells a story that a fabricated identity, however polished its documents, has not had time to build.

What a multi-signal assessment looks like

No single signal tells the full story. Effective identity assessment requires multiple independent signals that together reveal a coherent identity or expose its absence.

Explicit signals form the foundation. eKYC and eID database verification cross-references user-provided information against authoritative government records, confirming that the identity exists and belongs to the person claiming it. Document authentication validates submitted IDs. Biometric liveness checks confirm a real person in real time.

These explicit signals are necessary but insufficient. Implicit signals provide the surrounding context and a fraudster finds them far harder to fabricate. Digital footprint analysis examines whether an email address carries a real history, whether social media accounts show genuine activity and whether a phone number maps to real-world patterns. Device intelligence surfaces anomalies in hardware and software environments. Behavioral signals flag interaction patterns that deviate from how humans actually behave.

The value of layering these signals is combinatorial. A fraudster can fabricate a convincing document. Simultaneously manufacturing a years-old email address, a coherent social presence, a clean device fingerprint and natural behavioral rhythms is a different order of problem. Each additional signal compounds the cost and complexity of fabrication until spoofing the full picture becomes economically unviable.

Operating across borders

For businesses with multinational customer bases, multi-layered verification is a structural requirement. The regulatory landscape is moving fast. The European Union’s Digital Identity Wallet, which all member states must support by December 2026, will reshape how consumer identity functions across the bloc. National eID programs are expanding across Asia, Africa and Latin America on varying timelines and to varying technical standards. The World Bank estimates 850 million people still lack official government identification — a reality that makes digital coverage and inclusion inseparable priorities.

Businesses that operate effectively in this environment will need verification coverage broad enough to match their customer base and adaptable enough to keep pace with shifting regulatory requirements. eKYC and eID checks across national and regional schemes are the baseline. The operational advantage lies in what surrounds them; the implicit signals that distinguish a genuine applicant from a synthetic one, regardless of which jurisdiction’s ID scheme they present.

Verifying the person, not the ID

Risk assessment should be well underway before a document is ever presented. When digital footprint, device intelligence and behavioral signals work at first contact, synthetic identities are filtered before they reach your most expensive verification steps — and legitimate users clear faster because the system already has context.

That architecture only works when fraud, IDV and AML share a unified data environment instead of operating in parallel. The organizations building that capability now set themselves up to absorb fewer losses and onboard the customers that their competitors cannot confidently clear.

Best Identity Theft Protection: tried and tested protection from Aura, Norton, Experian, and more.

This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit