I was doing my usual Sunday reset — wiping down the kitchen counter, sorting through the mail — when a letter from a credit bureau landed in the pile. Routine stuff. But it made me stop and think: if a scammer only needed a sliver of my info to build a fake identity, how much of it was actually out there?
That question led me down a rabbit hole called synthetic identity fraud, and honestly, I wish I’d found it sooner.
Here’s my take: it’s not some far-off risk for people who are bad with passwords. It’s a quiet, slow-building scam that lenders are still catching off guard by — and the fix is mostly old-fashioned caution. Let me walk you through what I learned.
What synthetic identity fraud actually is
Think of it like this: a criminal grabs one or two real pieces of your information — a Social Security number, a date of birth, an address — and glues them to a pile of made-up details. The result is a brand-new “person” who never actually existed. That synthetic identity then takes out loans, opens bank and credit card accounts, and slowly builds a credit history.
Once the credit looks trustworthy, the scammer stages what the industry calls a “bust out” — they charge or borrow a big sum and disappear without a trace. Sometimes they use the accounts to park money from other crimes, or even to hide from authorities.
The scale is hard to ignore. In the U.S., synthetic identity fraud now accounts for one-fifth of all credit losses, per U.S. data cited in the coverage I read. And in Canada, it doubled as a share of all fraudulent credit applications between 2022 and 2024. It’s a growing problem on both sides of the border.
Why lenders keep missing it
There are a few tricks in the criminals’ toolkit. One is “identity compilation” — pairing a real identifier with a made-up name or address. Another is “identity manipulation,” where they steal several real details and just tweak them slightly.
But the real reason it slips past detection is patience. Crime networks spend months or even years nurturing each synthetic identity. Every small transaction helps validate the next one and builds up that credit file. So to a bank’s automated fraud systems, these accounts often look like exactly what a real, low-risk new customer should look like — the kind lenders actively want.
There’s another twist: at first, there’s no victim. The “person” on the account is a compilation, so nobody’s complaining. The fallout only reaches real people later.
Who’s at risk
Your personal details can leak through a hack or a corporate or government database breach. Criminals can also buy them on the dark web, dig through publicly available information and stitch it together, or just phish it out of you with a convincing email or call.
One group gets targeted over and over: people with limited or inactive credit histories — children, seniors, even deceased people. They’re less likely to check their credit reports, which gives the fraud the time it needs to grow quietly.
How I’d lower my own risk
Before the list, a quick honest note: I’m a deals editor, not a financial advisor, so treat this as practical common sense rather than professional advice.
Here’s what I’ve changed in my own routine:
- Guard my permanent identifiers. My SSN and date of birth are the most valuable pieces of my identity, so I’m stingy with them. I don’t post my birthday on social media, and when a form does need my SSN, I check that the site is a legitimate one using https and that I’m on a private network.
- Second-guess unsolicited contact. Emails, texts, and calls from unknown numbers offering some kind of reward are usually phishing. I check the URL before clicking and the domain name before replying.
- Check my accounts and credit report regularly. I go through my statements and my credit report more often than I used to. If something looks off, I notify my bank or card issuer right away — and if it’s serious, I’ll also file with local authorities or the FBI’s Internet Crime Complaint Center (IC3).
- Use solid password security. A good password manager and some basic digital security software go a long way.
If you want a hands-off layer on top of that, there are paid credit monitoring subscriptions out there. One example I came across, Equifax Complete Protection, runs about $34.95 a month and bundles credit monitoring, a password manager, dark web scans, and identity restoration. That’s not a bad price if it keeps you up at night — but it’s a subscription, so I’d treat it as an optional add-on rather than a must-have.
Frequently asked questions
Who actually suffers from synthetic identity fraud?
Businesses eat most of the losses — synthetic identity fraud now makes up one-fifth of all credit losses in the U.S. But individuals get burned too. If your SSN ends up linked to a fake identity, that negative association can follow you for years when you go to borrow or buy.
How do lenders even detect it?
They’re getting better at spotting what’s not there. Real people leave “digital dust” — the ordinary, irregular charges and money moves that show up in a genuine credit profile. A synthetic identity that’s too clean or too predictable stands out to trained systems.
What are police doing about it?
More than you might think. In the fall of 2025, Toronto Police wrapped up a three-year investigation into a family running a synthetic fraud operation out of their home. It cost financial institutions a combined $3.9 million, and sixteen suspects were arrested on 100 charges.
A note from Dana
The thing that stuck with me is how little it takes. I’ve always been careful with my passwords, but I wasn’t being careful about my birthday or how often I looked at my own credit file. Small habits, it turns out, do a lot of the heavy lifting. I’d start with a free credit report and a password manager — that’s my daily pick for protecting the money in your name.
If this was useful, you might also like my breakdown of what happens when your info lands on the dark web or how AI is changing online fraud.