Synthetic identity theft accounted for 11% of reported fraud in LexisNexis Risk Solutions’ 2026 Cybercrime Report, up from 1.4% in the prior year. The report analysed activity across the LexisNexis Digital Identity Network, so the figure should be read as evidence from that network rather than a universal global incidence rate. For digital lenders, it illustrates why identity verification alone cannot establish creditworthiness, repayment intent or the integrity of the surrounding application context.
Quick answer: Synthetic identity and AI-assisted document fraud can combine real and fabricated attributes to create applications that appear internally consistent. Lenders need layered controls rather than a single identity check: approved identity verification, document forensics, bureau inquiry and velocity signals, device and behavioural risk indicators, destination-account checks, human review for exceptions and monitoring after disbursal.
From Stolen Identity to Synthetic Identity: What Changed
Traditional identity fraud used a real person’s stolen details wholesale. Synthetic identity fraud is different, and harder to catch. Fraudsters combine a real document number (often a dormant or low-activity PAN) with a fabricated name, address, or photograph, creating an identity that has no single victim to report it stolen.
LexisNexis Risk Solutions reported an eightfold increase in synthetic identity theft, from 1.4% to 11% of reported fraud in its network, while first-party fraud remained the most commonly reported category. These findings show a rapid change in the observed fraud mix; they do not establish the prevalence of synthetic identity fraud at every lender or in every market.
For lenders, the distinction matters operationally. A stolen-identity fraud case gets flagged the moment the real person disputes a transaction. A synthetic identity, because it belongs to no one, can operate undetected for months, building a thin but plausible credit history before it is used for a larger loan and then abandoned.
How Synthetic Identities Get Built and Pass eKYC
The typical construction pattern layers three things: a real or lightly-altered government ID number, a fabricated or AI-generated photograph, and a synthetic digital footprint (a new phone number, email, and device) built to look aged rather than freshly created.
Approved eKYC processes can verify specified identity attributes, but they do not by themselves establish repayment intent or prove that the device, contact details, documents and account relationships around an application are genuine. Those questions require additional risk signals and controls appropriate to the lender’s product and regulatory obligations.
Fraud rings may submit related applications to several lenders in a short period, a pattern commonly called loan stacking. Timely bureau inquiries and velocity indicators can help reveal that pattern, while device intelligence, entity resolution and destination-account analysis can identify other links that a single application view may miss.
Document Fraud Gets an AI Upgrade
Forged bank statements and salary slips are not new. What has changed is the tooling. Generative AI tools can now produce a bank statement, a salary slip, or an employer verification letter that matches the formatting, fonts, and layout of a genuine document closely enough to defeat a human reviewer working at volume.
Selfie and liveness controls also face pressure from presentation attacks and synthetic media. Lenders should assess their verification provider’s current testing, passive and active signals, device binding, fallback controls and escalation path rather than assume that one prompt defeats every spoofing technique.
This does not mean document and biometric checks are obsolete. It means they can no longer be the only layer. A document that is internally consistent and a selfie that passes a liveness prompt are necessary conditions for approval, not sufficient ones.
Fraud Technique vs Detection Signal
| Fraud technique | What it exploits | Relevant detection signals |
| Synthetic identity (real ID + fabricated profile) | Identity verification does not assess intent or all surrounding relationships | Bureau inquiry velocity, thin-file behaviour, device and identity mismatches |
| AI-generated or forged documents | Manual or basic OCR-based document review | Forensic document analysis (metadata, font consistency, compression artifacts) |
| Deepfake or spoofed liveness checks | Controls that rely on a limited set of liveness prompts | Passive liveness detection, behavioral biometrics during the session |
| Loan stacking across lenders | Each individual application looks clean in isolation | Real-time bureau pulls, velocity checks across CIC records |
| Mule accounts for disbursal | Verifying the borrower, not the destination account | Bank account age and activity analysis, name-match on disbursal account |
Why This Hits Digital Lending Harder Than Other Sectors
Digital onboarding can compress the time available to detect coordinated applications. The RBI’s public directory of Digital Lending Apps is intended to improve transparency and help customers verify an app’s association with a regulated entity; it should not be treated as a substitute for applicant-level fraud controls within legitimate lending channels.
The economics also favor the fraudster. A synthetic identity with a thin but clean credit history costs little to build and can be reused, sold, or aged for a larger loan attempt later. Detection has to work at the same speed the fraud does, which is why point-in-time document checks alone are no longer sufficient.
Evaluation Checklist: Is Your Fraud Detection Layered Enough?
- Does the platform check bureau inquiry velocity across lenders, not just within its own application history?
- Is document verification doing forensic analysis (metadata, compression artifacts) rather than visual review alone?
- Does liveness detection include passive or behavioral signals, not just a single blink or head-turn prompt?
- Is device and digital footprint age analyzed, or does a brand-new phone number and email pass without flags?
- Is the disbursal account checked for age and activity pattern, not just name-match against the applicant?
- Can the fraud detection layer be updated independently of the core LOS as new fraud patterns emerge?
Bottom Line
The LexisNexis network observed a sharp increase in synthetic identity theft as remote, document-led journeys continued to scale. Lenders should therefore test a layered control framework against current attack patterns and monitor its false-positive, false-negative and manual-review outcomes. Identity verification, document forensics, bureau velocity, device and behavioural indicators, destination-account checks and post-disbursal monitoring each address different parts of the risk.
Frequently Asked Questions (FAQs)
Identity theft uses a real, existing person’s stolen details, and that person can eventually report the fraud. A synthetic identity combines a real document number with fabricated personal details, so there is no single victim to flag it, which lets it operate undetected for longer.
No. An approved eKYC process verifies defined identity attributes; it does not establish repayment intent or validate every document, device, contact detail and account relationship around the application. Lenders need additional controls proportionate to the risk.
Loan stacking involves multiple loan applications submitted across lenders within a short period. A single application can appear plausible in isolation, so lenders use timely bureau inquiry and velocity data alongside device, identity and account-linkage signals to assess the wider pattern.
