7 ways synthetic identity fraud is changing in 2026
Synthetic identity fraud used to be a specialty fraud job. Bad actors created synthetic identities by modifying personal information, combining multiple real identities, or combining real and fake information. But building up identities convincing enough to pass muster took time, research, and effort.
As a result, you typically saw synthetic identity fraud when bad actors targeted organizations that could pay off in a significant way. For instance, fraudsters might target financial institutions and “bust out” after getting a mortgage, auto loan, or maxing out several credit cards. Or, the bad actor might go through the long process because they were funding terrorist groups or other illegal activities.
GenAI has changed this dynamic by making it easier to create and deploy synthetic identities. Below, we’ll look at seven ways this is changing synthetic identity fraud in 2026, and suggest strategies organizations can take to combat it.
1. Every organization becomes a target
Bad actors can use GenAI to quickly and easily create a detailed synthetic identity. AI tools can also test and figure out how to bypass systems on their own, increasing the chances that bad actors will succeed.
It’s not just more attempts, though. There are also more organizations at risk. Rather than solely focusing on financial institutions, we’re seeing bad actors use synthetic identities to target marketplaces, ecommerce stores, government programs, and insurance companies. Some even use synthetic identities to apply for jobs in almost every industry.
2. The identities have backstories
Fraudsters used to focus on the static data points of a synthetic identity, such as its name, date of birth, and tax identification number. Then, they’d establish and build its credit profile before targeting a financial institution.
In 2026, synthetic identities have a backstory. Bad actors can quickly spin up social media profiles with AI-generated photos and posts, fake professional histories, and even small websites that lend credibility to the identity.
3. GenAI documents look better than ever
Photoshop has been a fraudster’s friend for years, but in 2026, fake documents will reach a whole new level. Fraudsters can now create packages of documents in minutes, including an ID, a passport, utility bills, and pay stubs with consistent identity information. Because the images are generated rather than altered, you might not be able to use the same tactics to identify the fakes.
4. Deepfakes and AI-based face spoofs also improve
Fraudsters can also use GenAI to create headshots and videos for selfie checks. Real-time face-swapping technology can match the face on a fake ID during a live video call, a 2D image can become the base for a 3D video, and a voice can be cloned to bypass phone-based authentication.
It doesn’t work every time, but from the fraudster's perspective, it doesn’t have to. It’s simple to build a likeness for the synthetic identity, and to keep trying different targets and techniques until something gets through.
5. Fraudsters use real faces to verify synthetic identities
When fraudsters target organizations with strong fraud detection systems, they know that deepfake selfies likely won’t be enough. Some are adding their faces to government IDs and then trying to get through a selfie verification process. Or, they might hire an identity mule and use the mule’s face to complete the verification before taking over the account.
6. Details still get overlooked and sloppy
GenAI is often good at giving a strong initial impression, but it sometimes skimps on the finer details. For example, the personal identity information might match on all the documents, but there could be discrepancies in company names.
Or, the person’s “home” address might belong to a business. A little more digging could also reveal that their social media account is filled with low-quality deepfakes, or that the math on their utility bill doesn’t make sense.
Fraudsters get careless, too, and use the same personal or contact information for multiple synthetic identities. GenAI could make it easier to randomize these elements, but there might be patterns in the results that link analysis can uncover.
7. Identity theft adds fuel to the fire
In 2025, we discussed how fullz packages that included an individual's personal information, driver’s license, and selfie were available for $12. The widespread availability of this information will continue to impact synthetic identity fraud in 2026, especially if bad actors use AI to scale targeted social engineering attacks. As a result, the synthetic identities may be built on genuine personal information that could pass some database checks.
7 big changes to synthetic identities in 2026
What changed | Why it matters | How to respond |
|---|---|---|
Every organization could be a target
| Organizations that weren’t profitable enough targets for fraudsters are now at risk. | Learn more about synthetic identity fraud and how to combat it. |
The identities have backstories | Fraudsters build convincing digital footprints that pass surface-level scrutiny. | Check for inconsistencies in account age, engagement patterns, and content quality. |
GenAI documents look better than ever | Generated documents bypass traditional Photoshop-detection tactics since they aren't technically altered. | Use platforms and tools that combine visual analysis with contextual risk signals to flag generated documents. |
Deepfakes and AI-based face spoofs also improve | Fraudsters use GenAI selfies and videos to bypass some selfie verifications. | Ensure your selfie and liveness checks don’t rely on visual checks. |
Fraudsters use real faces to verify synthetic identities | Real faces can pass liveness checks that AI-based spoofs fail. | Use a multi-layered defense, including link analysis, to uncover other signs of fraud. |
Details still get overlooked and sloppy | Fraudsters reuse information, and GenAI outputs have patterns. | Scrutinize details and use link analysis to identify shared elements across users. |
Identity theft adds fuel to the fire | Synthetic identities built on stolen data may pass some database verifications. | Go beyond basic database checks. |
How Persona helps you fight synthetic identity fraud
Many of these trends were evident in 2025, but synthetic identity fraud and scams sometimes play out slowly. For example, bad actors might spend years building up a synthetic identity’s credit history and scores before attacking a lender or card issuer.
GenAI is increasing the pace and affecting almost every aspect of synthetic identity fraud, and you need a layered approach to stay ahead. Collecting different risk signals, running various checks, and adding risk-based friction to user flows can dramatically increase your ability to prevent synthetic identity fraud.
Persona’s verified identity platform can help you detect synthetic identity fraud across your user life cycle with:
Passive and active risk signals. Collect passive device, network, and behavioral signals to detect suspicious activity without adding friction for users. Layer on active signals, such as the results from liveness detection checks during a selfie, to increase assurance as needed.
Real-time link analysis. Persona’s Graph, a link analysis tool, can uncover connections between users in real time. Spot accounts that share an IP address, device fingerprint, hashed payment information, or similar selfies. Link analysis can help you investigate and shut down fraud rings, and you can add the results to verification flows to intercept new attempts.
AI-powered document checks. Document AI offers scalable document verification with global coverage and AI-powered verifications. It detects sophisticated fraud, including GenAI documents, by leveraging document-level, environmental, and population-level signals.
Progressive risk segmentation. Stopping synthetic identity fraud doesn’t have to negatively impact your good customers if you can automatically route users into different verification flows. Persona’s no-code Flow Editor and Dynamic Flow allow everyone on your team to build, test, and optimize user flows.
Issuing and authoritative database verifications. Persona can run database verifications against authoritative and issuing sources from 40+ countries, including AAMVA and eCBSV.
Thinking about how you can stay protected from the next wave of synthetic identity fraud? Contact us for a demo or to learn more.