Latest / Fintech Conversations with Fexingo: Banking, Payments, and Financial Software Companies / How Fintechs Use AI to Detect and Prevent Synthetic Identity Fraud
Transcript
- Lucas: So synthetic identity fraud — it's been called the fastest-growing financial crime in the US, and it's estimated to cost lenders around six billion dollars a year. But unlike a stolen identity, a synthetic one is built from scratch, using a mix of real and fake information. Luna: Right — the classic recipe is a real Social Security number, often stolen from a child or someone with no credit history, paired with a fake name, a fake date of birth, and maybe a fabricated address. Lucas: Exactly. And because the identity doesn't exist in any credit bureau's database as a whole, it can pass traditional Know Your Customer checks. The fraudster then 'nurtures' the synthetic identity over months or even years — opening small credit lines, paying them off, building a thin but positive file — before 'busting out' with a massive credit run. Luna: And by the time the lender realizes it's fake, the fraudster is gone with the money. So how are fintechs trying to catch this earlier? Lucas: One of the most promising approaches is graph-based analysis — specifically, graph neural networks. Instead of just checking the applicant's data points in isolation, the model maps the relationships between every device, phone number, email address, and account that has appeared across the entire applicant pool. Luna: So if a phone number has been linked to ten different 'names' over the past six months, the model can flag that cluster as suspicious, even if each individual application looks clean. Lucas: Correct. And this is where machine learning excels — it can detect those connection patterns at scale, in real time. A startup called Socure, for example, claims its graph-based model can reduce false positives by up to 40 percent compared to traditional rule-based systems, while catching more synthetic identities. Luna: Forty percent fewer false positives is huge for customer experience. Nothing frustrates a legitimate user more than getting rejected for a credit card because the bank's fraud model flagged them incorrectly. Lucas: Exactly. And that's the tension every fintech faces — you want to catch fraud, but you don't want to churn good customers. Another technique that's gaining traction is behavioral biometrics. Instead of just verifying who you are at the moment of application, the system analyzes how you interact with the device. Luna: Like keystroke dynamics, mouse movements, how you hold your phone — things that are very hard for a fraudster to mimic because they're subconscious. Lucas: Right. A synthetic identity operated by a fraudster will often show typing patterns that are too consistent — because they're copying and pasting information, or they've memorized the script. A real user hesitates, backspaces, types at varying speeds. That behavioral signature is incredibly hard to fake. Luna: There's a company called BioCatch that does exactly this. They've been around for a while, but the adoption really accelerated in the last two or three years as more fintechs moved to digital-first onboarding. Lucas: Yeah, BioCatch claims they can detect synthetic identity fraud with over 90 percent accuracy by combining behavioral biometrics with device intelligence. And the key is that they do this passively — the user doesn't even know they're being analyzed. Luna: That's smart, because if a fraudster knows they're being watched, they can try to game the system. Passive detection keeps the advantage with the defender. Lucas: There's also a collaborative approach gaining steam — consortium data sharing. Fintechs are pooling anonymized fraud signals so that if a known synthetic identity tries to open accounts at multiple lenders, it gets flagged immediately. Luna: But doesn't that raise privacy concerns? Banks and fintechs sharing customer data sounds like a regulatory minefield. Lucas: It does, but the data is typically hashed and encrypted — no raw PII is shared. Companies like Early Warning Services, which runs the ChexSystems network, and newer players like Alloy and Mitek have built platforms that allow real-time fraud intelligence sharing while staying within regulatory bounds. Luna: So instead of each fintech fighting fraud in a silo, they get to benefit from the collective intelligence of the whole network. Lucas: Exactly. And it's especially critical for smaller fintechs that don't have the massive fraud detection teams that a JPMorgan or a Capital One can afford. Consortium data levels the playing field. Luna: Let's talk about the cost side for a second. You mentioned synthetic identity fraud costs lenders six billion a year. But that's just the direct loss, right? Lucas: Right, that's the charge-off figure. But there are also indirect costs: the expense of investigating suspicious applications, the opportunity cost of turning away legitimate customers because of overly aggressive filters, and the reputational damage if a fraud incident becomes public. Luna: And then there's the cost of building and maintaining the fraud detection infrastructure itself. AI models aren't free to train, and they need constant updating as fraudsters adapt. Lucas: That's the arms race nature of this. As soon as one detection technique becomes widespread, the fraudsters shift tactics. For example, when fintechs started using device fingerprinting, fraudsters began using emulators and virtual machines to generate new device IDs. Luna: So the AI models have to learn to detect emulators too. That's cat and mouse on a technical level. Lucas: Yeah. And that's why the most effective systems combine multiple signals — graph analysis, behavioral biometrics, device intelligence, and consortium data — into a single risk score. No single technique is enough. Luna: It reminds me of the challenge we talked about in the biometrics episode — no single biometric is perfect, but fusion of multiple modalities gives much better accuracy. Lucas: Exactly the same principle. And it's working. Fintechs that have deployed multi-layered AI fraud detection report synthetic identity detection rates north of 85 percent, compared to maybe 50 percent with traditional rules. Luna: That's a big improvement. But I'm curious — are there any downsides or unintended consequences we should be aware of? Lucas: One concern is bias. If the training data over-represents certain demographic groups, the model might unfairly flag legitimate applicants from underrepresented groups. There have been cases where behavioral biometric models were less accurate for non-native English speakers, for instance. Luna: So you need diverse training data and ongoing fairness audits. That adds another layer of complexity, but it's necessary. Lucas: Absolutely. And the regulatory landscape is evolving too. The CFPB has been looking at how AI models make credit decisions, and there's pressure to ensure 'adverse action' notices can explain why someone was rejected — even if the reason is a graph neural network's hidden layer. Luna: That's a tough technical challenge. Explainable AI is still an active research area, especially for deep learning models. Lucas: Right. But some fintechs are already using simpler models like gradient-boosted decision trees for the final risk score, while using the neural networks only for feature generation. That gives them better interpretability. Luna: So there are workarounds. It's not an unsolvable problem. Lucas: Exactly. And speaking of solving problems — it's conversations like this that remind me why we keep the show free and ad-free. We want anyone building or running a fintech to have access to these insights. If you find this useful and want to support us, you can always buy us a coffee at buy me a coffee dot com slash fexingo. No pressure, it just helps keep the lights on and the episodes coming. Luna: Yeah, it's a small way to say 'this matters to me,' and we appreciate it. Now, back to the technology — one thing I wanted to ask: how are fintechs handling the 'bust-out' phase specifically? That's where the fraudster maxes out credit and disappears. Lucas: Great question. Some fintechs are using AI to monitor credit utilization patterns in real time. If a synthetic identity that has been building credit for two years suddenly applies for five new cards in a week, that's a red flag — even if the credit score is high. Luna: So it's not just at onboarding, but ongoing monitoring throughout the account lifecycle. Lucas: Exactly. And that's where traditional banks have lagged — they often only check fraud at account opening. Fintechs, because they're digital-native, can afford to run continuous risk scoring on every transaction and every login. Luna: That's a structural advantage. So the fintechs that are winning the fraud fight are the ones that invest in real-time analytics across the entire customer journey, not just at the front door. Lucas: I think that's the key takeaway. Synthetic identity fraud is a tough problem, but the tools to fight it are getting smarter. Graph neural networks, behavioral biometrics, consortium data — combined with continuous monitoring — are raising the bar for fraudsters. Luna: And as those techniques become more affordable, even smaller fintechs can adopt them. That's good for the whole ecosystem. Lucas: Yeah. It's an arms race, but the defenders are finally getting better weapons.