Synthetic Identity Fraud Detection

Synthetic identity fraud affects any organization that onboards individuals and extends services, benefits, or access based on a verified identity. Unlike stolen identity fraud, where a real person’s credentials are misappropriated, synthetic identities are constructed, assembled from combinations of real and fabricated PII. Generative AI has fundamentally changed the scale and accessibility of that construction: identities that previously required technical sophistication to fabricate are now assembled with widely available tools, and the volume of attempts has increased accordingly.

The construction methods have evolved alongside verification controls:

• PII harvesting: real identifiers sourced from data breaches are combined with fabricated details to create identities that pass database-level checks; AI tools now automate the aggregation and correlation of breach data, public records, and social sources, accelerating assembly of convincing personas at scale
• Document fabrication: LLMs and image generation tools now produce convincing forgeries, including manipulated images of legitimate documents, without technical expertise, at scale, and designed specifically to defeat optical verification
• Biometric spoofing: presentation attacks using printed images, video replays, and masks, and injection attacks that bypass the camera entirely by injecting edited or deepfake video directly into the verification pipeline
• Identity seasoning: synthetic identities used in low-risk interactions over time to build a history that passes screening at higher-stakes moments

Database matching and optical document verification alone cannot fully detect fabricated identities with no prior fraud history.

Daon provides identity verification that binds a claimed identity to a live, present individual and maintains that binding through continuous authentication across every subsequent interaction throughout the customer or user lifecycle.

At enrollment, physical documents are scanned and checked to be real, valid, and unaltered, and identity data is extracted via OCR. Cryptographically verified data can also be extracted directly from NFC chips or mDLs. Biometric face matching confirms the person presenting the document is the person pictured on it, with Presentation Attack Detection tested by iBeta to ISO 30107-3 Level 2, and injection attack detection aligned with CEN/TS 18099 operating simultaneously.

Beyond enrollment, continuous authentication draws on a full factor library, all bound to the verified identity through the server-side biometric established at enrollment. Risk signals can trigger step-up authentication against the server-side biometric or full re-verification, ensuring that anomalies surfaced at any point in the lifecycle are resolved against the same identity record.

Each verification and authentication event produces a structured evidence record that supports both internal fraud investigation and audit requirements under applicable frameworks, including NIST SP 800-63-4 IAL2 and eIDAS 2.0.