Identity Fraud
Identity fraud is the use of identity information — real, stolen or fabricated — to obtain money, goods, credit or services by deception. It is the use stage. The acquisition of the data, where data was acquired at all, is identity theft, and the two are separate events that can be years apart.
The single most useful question about any case is whose identity was used, and whether that person was a participant. The answer splits the category into three types that need different controls and produce very different statistics.
| What it is | Using identity data to deceive an institution |
| Distinct from identity theft | Theft is acquiring the data; fraud is using it |
| Three types | Third-party, first-party, synthetic |
| Where it is decided | Application, account opening, and account recovery |
| Best-measured type | Third-party — because a victim reports it |
| Worst-measured | First-party and synthetic — nobody complains |
The three types
| Third-party | First-party | Synthetic | |
|---|---|---|---|
| Whose identity | A real victim’s, without consent | The fraudster’s own | Fabricated, often around one real identifier |
| Is there a victim | Yes | No individual victim | Sometimes — whoever owns the real identifier |
| Who reports it | The victim, on discovery | Nobody | Nobody |
| Typically recorded as | Fraud | Credit loss | Credit loss |
| Caught by | Document and biometric verification | Behavior and affordability | Verification, plus link analysis |
| Time to discovery | Months | Often never classified | Often only at charge-off |
The third and fourth rows carry the consequence that matters most, and it is a measurement problem rather than a detection one.
Only third-party fraud has a complainant. A real person eventually notices an account in their name and disputes it, which produces a fraud record. First-party and synthetic fraud generate no complaint, because there is nobody to complain — so the loss is booked as ordinary credit default and never enters the fraud statistics at all.
The result is that most institutions’ fraud numbers describe the type that reports itself, and the prevention budget follows the numbers. Two of the three types are systematically undercounted, and they are not the smaller two.
Why it matters for identity verification
Each type meets identity verification differently, and being precise about that is more useful than claiming it solves all three.
Third-party fraud is the case verification addresses directly. The fraudster holds the victim’s data — every knowledge-based question can be answered correctly, because decades of breaches have turned those answers into data. What they do not hold is the victim. An authenticated document plus a live face matched to its portrait asks for something no data purchase supplies.
Synthetic fraud is addressed at the same moment, for a different reason. A fabricated identity has no person behind it to present, so it fails a document-and-face check on day one. It also fails to resolve — which matters because resolution is what makes link analysis possible, and link analysis is how synthetic networks are found.
First-party fraud is not an identity problem. The applicant is exactly who they say they are, and every identity control passes correctly because there is nothing false about the identity. It needs affordability assessment and behavioral monitoring instead. Saying so is more useful than implying verification covers it.
The practical upshot: identity verification removes two of three types at the application, and the remaining one requires entirely different work. An institution that has bought verification and expects its total fraud losses to fall proportionately has misunderstood which share it addressed.
Where identity fraud is committed
The application is the most common point, and it is not the only one. New account fraud opens a facility under a false identity; account takeover uses identity data to seize an account that already exists; and account recovery is the quietest of the three, because it is the designed bypass around every credential control and is where a takeover is completed.
Beyond financial services, the same data supports medical identity fraud, benefit and tax refund claims, employment fraud, and obtaining documents in another name — each with its own victim profile and none of it visible to a bank.
What identity fraud controls cannot do
Knowledge-based authentication is largely spent. The answers it asks for — previous addresses, mortgage lender, car payment — were secrets when it was designed and are now widely available data.
Credit bureau checks confirm the identity exists. In third-party fraud it does exist, with a genuine file. A bureau match is evidence about the identity, not about the applicant.
Victim alerts arrive after the data is circulating. Freezes and monitoring shift the burden onto the victim to defend an identity somebody else is already using.
Verification does not address first-party fraud at all. Covered above, and worth repeating because it is the most common overclaim in this category.
Frequently asked questions
What is the difference between identity theft and identity fraud?
Identity theft is obtaining someone’s personal data. Identity fraud is using identity data to deceive an institution. They are separate events, often separated by months or years, and the organization that suffers the fraud is rarely the one that leaked the data.
What are the three types of identity fraud?
Third-party, using a real victim’s identity without consent; first-party, where the person uses their own identity and defaults deliberately; and synthetic, where an identity is fabricated, often around one genuine identifier such as a real Social Security number.
Why is identity fraud under-reported?
Because only one type has a complainant. Third-party fraud is reported when the victim discovers it. First-party and synthetic fraud produce no victim to report them, so the losses are usually recorded as ordinary credit defaults rather than as fraud.
How is identity fraud prevented?
At the application, by verifying that the document is authentic and that the person presenting it is live and matches its portrait. That addresses third-party and synthetic fraud, which both depend on an identity claim that cannot survive examination. First-party fraud needs affordability and behavioral controls instead.
Related reading
- Identity theft — the acquisition stage this page’s fraud follows
- Third-party identity fraud — the type with a real victim
- Synthetic identity fraud — the type with no person behind it
- Application fraud — the moment all three types are decided
