Synthetic Identity Fraud: Red Flags in a Phone Number and Credit File
A synthetic identity can have a 750 credit score and no actual human behind it. The giveaways are rarely in one place. They show up when you compare the phone number, the name and the shape of the credit file.
On this page
Synthetic identity fraud is when someone builds a person who doesn’t exist out of a mix of real and invented details, usually a real Social Security number paired with a made-up name and date of birth, then uses that “person” to get credit. The fraudster nurses the identity for months or years, borrows as much as it can carry, and walks away. There’s no real victim to call the bank, which is exactly why it works.
The Federal Reserve described the pattern in its 2019 white paper on synthetic identity payments fraud: build creditworthiness over time, then “bust out” by maxing out credit and vanishing. When the Fed later published its mitigation toolkit, it cited an industry estimate of $20 billion in losses for U.S. financial institutions in 2020.
You don’t need to be a bank to run into one. Landlords, auto dealers, small lenders and anyone extending terms can end up holding the bill.
How synthetic identity fraud gets built
The Fed’s toolkit separates two methods, and it’s useful to know both because they leave different traces.
Identity manipulation takes a real identity and changes it slightly: a tweaked date of birth, a transposed digit in the SSN, a slightly different name. Identity fabrication invents a person from scratch. Many synthetics are a blend.
The SSN at the center is often one that nobody is actively using for credit. According to the Fed’s toolkit page on how synthetic identities are used, the most common source is children, whose numbers can go unwatched for years.
Then comes the slow part:
- The first application gets denied. That’s fine. The application itself often causes a credit file to exist at a bureau.
- Small credit arrives. A secured card, a store card, a subprime line. Payments are perfect.
- The file gets propped up. A common shortcut is being added as an authorized user on someone else’s old, well-managed card, which can make a two-year-old identity look like it has a long history.
- Limits grow. Good behavior earns increases and new accounts.
- Bust-out. Everything is drawn down at once, sometimes with checks that bounce after the payments “clear,” and the identity goes silent.
The Fed’s toolkit includes a sobering example: a line approved at $20,000, paid perfectly for three years, raised to $40,000, maxed out and charged off as an ordinary credit loss. With no fraud indicators anywhere, the bank wrote it off as a credit loss and never reported it as fraud.
Red flags in the phone number
A phone number is cheap to get. But it’s also one of the few pieces of an identity that has to work in real time, and it carries more information than people expect.
The line type doesn’t fit the story
A 45-year-old homeowner applying for a $30,000 loan from a VoIP number they got last month is possible. It’s also unusual. Online VoIP numbers can be created in minutes without much identity behind them, which is why fraud teams look twice. Mobile numbers from major carriers are tied to a contract or prepaid account and tend to stay with a person for years. Our guide to mobile vs. landline vs. VoIP explains the differences, and spotting burner phone numbers goes further.
The name on the line doesn’t match
Caller ID name (CNAM) data and carrier records are built independently of a credit file. When the applicant says they’re “Jordan Ellis” and the number’s caller ID name comes back as someone else entirely, that’s worth a question. A mismatch has innocent explanations (family plans, a work phone, a recently ported number), so it’s a reason to verify, not a reason to decline.
The fraud score is high
A phone fraud score rolls what’s known about a line into one risk number, so you don’t have to weigh every signal yourself. A high score on the number someone gave you for a credit application deserves a closer look. See how a phone number fraud score works for what goes into one.
The number is brand new, or recently moved
New numbers aren’t suspicious by themselves. People switch carriers constantly. But a new number combined with a new identity is a pattern. Recently ported numbers also deserve a little care, since port-out and SIM swap tricks are a separate fraud family we cover in SIM swap and port-out fraud.
Red flags in the credit file
The Fed’s toolkit lists several credit-file signals worth memorizing. Translated into plain language:
The file is too thin for the person’s age. A 41-year-old with a credit file that first appeared 18 months ago is unusual. Not impossible (recent immigrants, people who lived on cash), but unusual. The toolkit’s phrase is a credit profile that “does not match anticipated file depth.”
The history is mostly borrowed. A file made up mainly of authorized-user tradelines, with few accounts the person is actually liable for, is one of the classic synthetic patterns. The score can look excellent while the person has never personally repaid anything. Seeing whose account each line belongs to requires account-level detail, which our enhanced report adds if you need it. Our explainer on what a tradeline is covers ownership types.
A strong score sits on top of a short history. In the Fed’s example, the applicant had a 750 score and eight new inquiries. A high score with lots of recent credit-seeking on a young file is a combination to look at closely.
The SSN doesn’t fit the birth date. The Social Security Administration began randomly assigning new numbers on June 25, 2011. The toolkit flags an SSN issued after 2011 paired with a birth date before 2011 as a red flag. Most small businesses can’t see issuance dates themselves, but verification services can.
Everything was opened in a burst. Several accounts opened within a few months, then steady perfect payments, then a request for a large amount.
A worked example
Take a fictional application that should make you slow down.
A man calls about financing a $26,000 used truck. He gives his name as Jordan Ellis, age 38, and says yes to a credit check in writing. The lookup comes back like this:
| Signal | What came back | How it reads |
|---|---|---|
| Line type | VoIP | Unusual for a buyer this age financing a vehicle |
| Caller ID name | A different name | Doesn’t match the applicant |
| Phone fraud score | 87 out of 100 | High |
| FICO® Score 4 | 744 | Strong on its face |
| Credit file | About two years old | Thin for a 38-year-old |
| Accounts | Three, all small, perfect payments | Consistent with seasoning |
No single row proves anything. A real 38-year-old could have moved here two years ago and used a VoIP number for work. But together, the picture is a young, high-scoring file on a mismatched disposable line. That’s the profile the Fed describes. The right move is to step up verification before you hand over keys: an in-person visit with a government ID, a callback to a number tied to his bank or employer, proof of residence and income.
Compare it to the version you’d expect from a real applicant: a mobile number from a major carrier, a caller ID name that matches, a low fraud score and a 12-year-old file. Same 744. Totally different risk.
How to check without insulting real customers
Most thin files belong to real people. Treating every young file as fraud alienates exactly the customers you want to grow with. Some principles that keep you fair:
- Look for mismatches, not single facts. One red flag is a question. Three that agree with each other are a pattern.
- Verify, don’t accuse. “We need to confirm a couple of details before we finalize” works for everyone. Real customers comply. Synthetic identities tend to go quiet.
- Ask for something a fake person can’t easily make. A live video call with ID, a utility bill at the stated address, a callback through a verified number.
- Write it down. If you’re a creditor, the FTC’s Red Flags Rule (16 CFR Part 681) may require a written identity theft prevention program anyway. Your red flags list can live there.
- Mind your legal basis. A credit lookup needs a permissible purpose under the FCRA, most simply the applicant’s written OK or an application they started with you. And if something in the credit report leads you to decline, an adverse action notice is still required. Our explainer on permissible purpose covers the basics.
Where a phone-and-credit check helps
The trick with synthetic identity fraud is that each piece looks fine in isolation. The number works. The name is a plausible name. The score is good. It’s only when you put them side by side that something looks off.
That’s what our lookup is built to do. With the applicant’s permission, you send their phone number and get back the name and current address on their TransUnion credit file, their FICO Score 4 and credit profile, and phone details: line type, carrier, caller ID name and a fraud score. You can compare what they told you against all of it at once. For more on that approach, see identity verification by phone number.
Fraud teams processing volume can run the same checks programmatically through our API and send risky combinations straight to a human reviewer. Whatever tool you use, the habit is the same: don’t ask whether each detail is real. Ask whether they all describe the same person.
Frequently asked questions
How is synthetic identity fraud different from identity theft?
Classic identity theft uses a real person's whole identity, so the victim usually notices strange accounts. Synthetic identity fraud stitches real and fake details into a new person, often around a Social Security number that isn't being used for credit, so there's frequently no one checking the file and nobody to complain.
Can a synthetic identity have a good credit score?
Yes. That's what makes it dangerous. Fraudsters spend months or years building the file with small accounts and on-time payments, sometimes boosted by authorized-user tradelines, before borrowing as much as possible and disappearing.
Is a thin credit file a sign of fraud?
Not on its own. Young adults, recent immigrants and people who avoid debt all have thin files. A thin file matters when it doesn't fit the rest of the story, such as an applicant's stated age, a brand-new VoIP number and a name that doesn't match the line.
Can I run a credit lookup just to check for fraud?
You need a permissible purpose under the FCRA for every credit lookup. An application the person started with you, or their written OK, is the usual one. Phone details alone are a different question from pulling credit.
