Synthetic Identity Fraud Detection Beyond Graphs

Synthetic identity fraud: An identity graph will not solve fraud

TL;DR: More connections. Not more certainty.

Synthetic identity fraud detection requires more than identifying connections between identities. Identity graphs reveal relationships but cannot independently establish fraudulent intent
Device, behavioral, verification, and network signals provide complementary evidence that helps organizations interpret potentially suspicious activity
Connecting these signals can support more informed fraud decisions and help distinguish legitimate activity from elevated risk

Stop connecting dots. Start understanding risk.

Businesses need to identify suspicious applications earlier without adding unnecessary friction for legitimate customers. Identity graphs can reveal relationships between devices, addresses, and contact details, including patterns between seemingly unrelated identities. But those connections alone are not enough to detect synthetic identity fraud or establish whether a relationship indicates fraudulent activity.

This limitation is particularly important for synthetic identity fraud detection, where genuine, fabricated or manipulated information can be used to create seemingly legitimate identities. As fraud tactics evolve, organizations need to look beyond individual connections and understand how identity, device, behavioral and network signals work together to reveal potential risks that isolated checks may overlook.

The requirement is clear: connect identity evidence to the right verification response, not simply to more data. We bring identity verification and fraud intelligence together through one integrated platform, backed by decades of expertise in how checks are selected, sequenced, and applied. That combination gives businesses a practical way to interpret evidence in context and make more informed fraud decisions.

The next evolution in fraud detection is not simply about connecting more data, but turning those connections into actionable intelligence.

Connected identities are not proof of fraud

Synthetic identity fraud: A credible identity can still be fake

Synthetic identity fraud involves creating a deceptive identity using real, fabricated or manipulated personal information, often combining genuine details with invented attributes. These identities may appear credible when individual attributes are assessed separately, particularly during account opening and other forms of application fraud.

Identity graphs help organizations uncover relationships between seemingly unrelated applicants, accounts and attributes. However, identifying a relationship does not establish what that relationship means.

For example, several family members may legitimately share an address or device. Conversely, multiple applications associated with one device, alongside inconsistent identity details or unusual activity, may warrant further investigation.

Identity validation and graph analysis therefore serve complementary purposes. Validation helps establish whether identity evidence and attributes are authentic, accurate, or consistent, while graph analysis reveals relationships that may require closer examination. Additional verification may still be needed to establish whether an applicant is the rightful holder of the presented identity.

Synthetic identity fraud detection: Follow the evidence, not one signal

Effective synthetic identity fraud detection requires combining signals that answer different questions about an interaction.

Signal type	What it reveals	Why context matters
Identity and verification	Whether evidence supports the claimed identity	Valid details do not necessarily establish that the overall identity is genuine
Device and behavioral	Device characteristics and interaction patterns	Unusual activity may have legitimate explanations
Email and phone	Contact-point history, consistency, and reuse	Shared or reused details are not automatically fraudulent
Network intelligence	Network-level indicators, such as IP-related risk, location anomalies, or patterns across interactions	Network characteristics can be shared or obscured and should not independently establish fraud
Relationship intelligence	Links between identities through shared attributes	A connection alone does not establish fraudulent intent

Network intelligence also needs a clear definition. IP-related indicators describe the network used for an interaction; our cross-industry fraud network provide shared fraud and identity intelligence across participating businesses. These are distinct from a persistent identity graph. Trust Networks can help identify known risk patterns alongside verification and other risk signals, with granularity down to the region.

Device characteristics may reveal repeated use across applications, while behavioral patterns provide context about how an interaction unfolds. Together, they can help explain whether activity warrants closer investigation.

Device intelligence for fraud detection belongs within a broader risk assessment, not as a standalone verdict on whether an interaction is fraudulent. We bring device intelligence together with identity verification and other risk capabilities through our integrated platform, with expert guidance on which checks to apply and when. The value is a verification response informed by context, rather than a decision dictated by one device signal.

Shared device. Shared risk? Not so fast.

Shared devices can indicate potentially suspicious activity, but they are not proof of fraud.

Consider a first-time applicant using a previously unseen device. Even multiple applicants sharing that device may have a legitimate explanation, such as members of the same household.

However, several applications originating from the same device within minutes, accompanied by inconsistent contact details or unusual interaction patterns, may justify additional scrutiny. The response is to assess the combined evidence and introduce additional verification when warranted.

This illustrates how businesses can detect synthetic identity fraud more effectively: by interpreting combinations of evidence rather than treating one shared attribute as decisive.

For synthetic identity detection, the objective is to recognize suspicious patterns while avoiding unnecessary friction for legitimate customers.

One signal is not the whole story

Effective fraud detection depends on understanding how different signals reinforce or challenge one another. Identity verification may support a claimed identity, while device intelligence, behavioral patterns, and network data provide additional context about the interaction.

For example, a familiar device may suggest a lower level of risk, but inconsistent identity information or unusual activity could raise concerns. Conversely, an unfamiliar device does not necessarily indicate fraud when other evidence supports a legitimate interaction.

Synthetic identity fraud prevention requires more than collecting indicators: businesses need to understand how those indicators work together and when additional scrutiny is warranted. We combine verification and risk capabilities with decades of identity and fraud expertise, helping customers configure checks around their use case and level of risk.

Work with us to build a more complete risk assessment and apply additional verification where the evidence warrants it, rather than relying on a single signal.

Disconnected signals. Costly blind spots.

When identity, device, behavioral and network signals remain isolated, organizations may struggle to develop a complete picture of potential fraud. Managing disconnected providers and integrations also adds operational and technical complexity, leaving teams to reconcile evidence and determine how different checks should work together.

Fragmentation can create several challenges:

Repeated customer friction: Legitimate applicants may encounter unnecessary verification requests
Slower investigations: Analysts may need to reconcile evidence across disconnected systems
Missed suspicious patterns: Related activities may escape scrutiny when evaluated separately
Limited explainability: Risk scores may be difficult to interpret without their supporting evidence

Address fragmentation at its source: bring verification and risk capabilities together with expert guidance on how to use them. We provide one integration point and a single relationship for accessing those capabilities, reducing the burden of independently sourcing and integrating providers. Combined evidence provides a clearer basis for prioritizing investigations and making proportionate decisions; it does not, by itself, guarantee better detection or fewer false positives.

Four questions that expose fraud blind spots

As organizations rethink their approach to fraud detection, four questions can help identify where fragmented signals may be limiting the quality of identity decisions:

Which fraud decisions still depend on a single dominant signal?
Can teams explain why different identity, device, and behavioral signals agree or conflict?
Are fraud insights shared across onboarding, authentication and ongoing monitoring, with clear ownership of the systems supporting each stage? Our platform currently supports onboarding, step-up verification and re-verification; ongoing transaction monitoring sits outside the platform today.
Are false positives and missed fraud reviewed together to improve decision-making?

Use these questions to identify where evidence stops short of action: a dominant signal, conflicting checks, disconnected insights, or outcomes that do not inform better decisions. Bring those gaps to us. Our identity and fraud expertise helps customers determine which capabilities belong in their journeys and how to sequence them, so trustworthy evidence informs decisions across verification moments and supports establishing and maintaining digital trust.

GBG worked closely with us, pointing out opportunities to improve the identity data we were submitting to the GBG platform and offering actionable recommendations to enhance our pass rates.

Angus Preston,
Product Lead, myPOS

Turn connected evidence into decisive action

Identity graphs remain valuable for uncovering relationships. However, synthetic identity fraud detection requires understanding those relationships alongside identity, device, behavioral, and network evidence.

For us, the value is not simply access to more signals. Decades of identity and fraud expertise inform how verification and risk capabilities are selected, sequenced and applied through our integrated platform. Customers configure journeys with our guidance, helping them apply the right checks at the right moment without independently sourcing and integrating every provider.

Stronger identity fraud detection depends on making connections understandable and actionable, rather than assuming every unusual relationship indicates fraud.

Choose a partner that connects verification, risk intelligence and the expertise to apply them. We bring those elements together through our integrated identity and fraud platform. Work with us to determine which checks your customers need, where stronger verification is warranted, and how to keep legitimate interactions moving without unnecessary complexity.

Our integrated identity and fraud platform brings verification and risk capabilities together with decades of expertise to help you identify risk earlier, apply stronger checks when warranted and keep legitimate customers moving.

Explore how we can simplify your approach through one integration and expert guidance.

Synthetic identity fraud: The questions that matter

Businesses can assess inconsistencies across identity attributes, application details, and available behavioral patterns, even when an identity has no known fraud history. Comparing information against reliable sources and examining patterns across applications may reveal discrepancies that individual checks miss. However, the absence of previous fraud indicators neither confirms legitimacy nor establishes suspicious activity.

Identity theft typically involves the unauthorized use of an existing person's identity or personal information. Synthetic identity fraud involves creating a deceptive identity that does not correspond to an existing individual, potentially using genuine, fabricated, or stolen information. The two can overlap when criminals incorporate stolen personal details into synthetic identities.

Organizations can assess confirmed fraud outcomes, detection rates where reliable labels are available, false positives, manual review volumes, and customer friction. Evaluating these measures together helps identify trade-offs between fraud prevention and customer experience. Because synthetic fraud may be discovered or confirmed much later, performance assessments should account for delayed reporting and incomplete fraud data.