Quick answer: Synthetic identity fraud is the creation of a nonexistent person's identity by mixing real and fake information. AI amplifies this fraud: fake but realistic face photos, deepfake video and voice can fool remote identity verification (KYC) processes. Unlike stolen identity, there is no real victim, which makes it harder to notice. Defense rests on multi layered identity verification with liveness checks.

What is a synthetic identity and how does it differ from stolen identity?

In stolen identity fraud the attacker uses a real person's information, and that person eventually notices. In synthetic identity, the attacker combines real fragments (for example a valid ID number) with fake information (a made up name, a fake face) to create a person who does not exist.

That is why synthetic identity is more insidious: there is no complaining victim, because that person does not really exist. The fraud may go unnoticed until the fake identity opens an account, takes out credit and disappears. AI speeds up the process by adding convincing faces, documents and video to these fake identities.

How does AI amplify the process?

Component AI's role
Fake face Generating a nonexistent but realistic face photo
Fake document Convincing fake ID and document images
Deepfake video Fake video to fool liveness checks
Voice imitation Fake voice in phone verification
Scale Producing many fake identities quickly

Why is remote identity verification (KYC) a target?

Banking, fintech, crypto exchanges and many digital services verify customers remotely: uploading an ID and matching it with a selfie or video. AI generated fake faces and deepfake video aim to fool these processes. A weak KYC flow lets a fake identity enter the system as a legitimate customer.

Defense

  1. Apply liveness checks: use methods that verify a real human is present, live and interactive.
  2. Do not rely on a single signal (only a document or only a selfie), do multi layered verification.
  3. Analyze AI generation and manipulation traces in documents and images.
  4. Evaluate behavioral and contextual signals (device, location, speed).
  5. Monitor suspicious application patterns (variations of the same face, serial applications).

The KAOS and DSET approach

DSET evaluates the resilience of remote identity verification (KYC) processes against synthetic identity and deepfake attacks and forensically examines fake identity traces. We work in an evidence based way in deepfake and fake document examination and avoid claims of certainty without evidence. Our KAOS security engine reports the weak points of the identity verification flow. Our goal is to show whether your KYC process can actually be bypassed with a fake identity.

Related reading: identity verification in the deepfake era, deepfake fake voice and image fraud detection, AI content provenance and watermarking, AI assisted and polymorphic malware, AI fraud anomaly detection, leaked passwords and credential stuffing.

Frequently asked questions

What is the difference between synthetic identity and stolen identity? In stolen identity the attacker uses a real person's information, and that person usually notices and complains. In synthetic identity, real and fake information are mixed to create a person who does not exist. Because there is no real victim, synthetic identity is noticed much later and is hard to detect.

Can a deepfake fool selfie and video checks? In a poorly designed verification flow, yes. AI generated fake faces and deepfake video aim to fool simple selfie matching. That is why liveness checks that verify a real human is present, live and interactive, and multi layered verification, are needed. Relying on a single image is risky.

How do we strengthen our KYC process? Do not rely on a single signal. Liveness checks, document manipulation analysis, behavioral and contextual signals (device, location, application speed) and suspicious pattern monitoring should be used together. It is also recommended to verify the process's resilience by testing it with a real synthetic identity or deepfake.

Sources

To test the synthetic identity and deepfake resilience of your remote identity verification (KYC) process, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.