Synthetic identity fraud in Canada: how it works and how to stop it

Synthetic identity fraud is the creation of a fake identity by blending fabricated information with a fragment of real data, then using it to open accounts, obtain credit, or move funds. It is an identity assembled rather than stolen: the fraudster combines invented details with whatever real data helps the record pass scrutiny, then nurtures it until it looks legitimate enough to be useful. Because the resulting person does not fully correspond to any one real individual, there is usually no victim to dispute a charge or flag an account, which is exactly what makes the fraud durable. Unlike stolen-identity fraud, it has no tripwire, so a synthetic identity can build a thin credit history, pass checks, draw down credit or move money, and then be abandoned. The loss lands on the firm rather than on a complaining customer, which is why it is the quiet cousin of stolen-identity fraud.

Stolen-identity fraud impersonates a real person, who usually notices and disputes it, so the fraud has a short life and a built-in alarm. Synthetic-identity fraud assembles a new identity that does not fully correspond to any one real person, so no individual reports it and there is no tripwire at all. That absence of a victim is the structural difference, and it is what lets a synthetic identity behave patiently. Where a stolen identity is used quickly before the real owner reacts, a synthetic one can build a thin credit file, pass bureau checks, and mature until it looks legitimate, then default or disappear on the fraudster's timing rather than the victim's. The loss surfaces as a first-payment default, a chargeback, or a money-movement pattern rather than as a complaint. That patience, not sophistication, is what makes synthetic identities harder to catch than stolen ones.

Generative AI made the two hardest parts of a convincing synthetic identity cheap and scalable: a believable face and a believable document. A fully synthetic face, a person who never existed, can be produced in seconds, and forged or manipulated identity documents that once required a skilled operator and effort can now be generated at volume. When the cost of producing a convincing fake approaches zero, the economics of the attack change. Fraud rings stop crafting one careful identity and start submitting thousands of synthetic applications, knowing that even a low success rate against weak onboarding is profitable. It is industrialisation, not sophistication, that makes the current wave dangerous. The face side of this is covered in depth in the deepfake detection in KYC guide, and the same cheap-fake dynamic is what forces onboarding to verify the live human before it trusts the assembled record.

Credit checks confirm that a record exists and looks internally consistent, not that a real, live human is behind it. A synthetic identity that has been nurtured to carry a thin credit file, and is often paired with a generated document, can pass both a bureau pull and a document check, because both are tests of records rather than of people. This is the structural gap: as long as onboarding trusts the record before it verifies the human, synthetic identities keep getting through, because the record is the very thing the fraudster controls. Traditional KYC leans on exactly these two checks, so it is built to be defeated by an identity assembled to satisfy them. The control that actually catches a synthetic identity is verifying the live human at onboarding, with liveness and a face match, before relying on the record the applicant presents.

Firms that extend value to remotely onboarded customers they never meet are the most exposed. In the Canadian market that means digital lending platforms and buy-now-pay-later providers, where a synthetic identity is built specifically to draw credit and default; neobanks and digital banking platforms, where synthetic accounts are used for money movement, mule activity, and promotional-credit abuse; payment service providers, where synthetic merchants or end users move funds through the rails; and marketplaces, where synthetic sellers run storefronts until the chargebacks land. What connects them is the point where they open an account or disburse money to someone met only through a screen. Because they onboard at volume and rely on records the applicant supplies, a synthetic identity nurtured to pass those records slips straight through. The losses rarely announce themselves as fraud; they surface as first-payment defaults, elevated chargebacks, and money-movement patterns that only later resolve into a synthetic-identity problem.

Stop it by reversing the sequence: verify the live human first, then trust the record. Four controls, run together at onboarding, close the gap. Passive liveness confirms a live person is present without adding friction for genuine customers. Deepfake detection screens out synthetic faces and injected video at the moment of capture, so a generated face never becomes an account. Document verification reads the identity document and cross-references it against the selfie and the application, so a fabricated document fails when matched to the face. Screening then clears the verified identity against sanctions, PEP, and adverse-media lists and keeps watching afterwards. Run together, these controls make synthetic identities die at the front door rather than on the balance sheet, and the same evidence that stops the fraud is the examiner-ready record a Canadian reporting entity needs to show its onboarding is effective.