Preventing Synthetic Identity Fraud With Layered Checks, Explained

In early 2024, a finance employee at Arup, a well-regarded U.K. engineering firm, transferred $25 million to fraudsters. He wasn't phished by a spoofed email or tricked by a badly written text message. He sat through a video call. He saw his CFO's face. He saw other senior colleagues. Every face on that screen looked exactly right. Every voice sounded exactly right. Every single one of them was synthetic, and nobody caught it in real time.

That case should have been a wake-up call. For some organizations, it was. For most, it became a headline they bookmarked and forgot. Here's the problem with that: the number of attacks hitting identity systems isn't leveling off. According to Entrust's 2025 Identity Fraud Report, deepfake attacks struck identity verification systems every five minutes in 2024, while digital document forgeries surged 244% year-over-year. Every. Five. Minutes. That's not a trend line anymore. That's a drumbeat.

---

The 25 Million Dollar Wake Up Call for Preventing Synthetic Identity Fraud

Fraudsters Are No Longer Relying Only on Faces

Fraudsters are no longer relying only on a convincing face or a cloned voice to get money out the door, they're combining synthetic media with a stolen identity, fabricated documents, and social engineering timed to hit a busy finance team on a Friday afternoon. That combination is what made the Arup case work: no single element was the whole scam, and no single check would have stopped it. Understanding that layered attack pattern is the first step toward understanding why layered defenses now matter more than a single facial match ever did.

Forget the AI hype cycle for a second. The number that actually matters, the one with teeth, comes from Gartner: by 2026, 30% of enterprises will no longer consider identity verification and authentication solutions reliable when used in isolation, specifically because of deepfakes. That's not a fringe prediction from a boutique research shop. That's Gartner telling the enterprise world, formally, publicly, that the single point verification model is broken.

Think about what that actually means. We're not talking about a niche vulnerability that only affects cryptocurrency exchanges or social media platforms. We're talking about the foundational trust layer that enterprise security, law enforcement workflows, tax agencies, and financial institutions all rely on, and it's cracking under pressure from fraud ecosystems that are now fully industrialized. This article is part of a series, start with Deepfake Laws Biometric Standards Gap Investigators.

Because that's the other story here: this isn't some lone hacker running fraud software in a basement. Fraudsters can now purchase complete persona kits, pre-packaged synthetic identities that include AI-generated faces, cloned voices, fabricated digital histories, and behavioral patterns trained specifically to pass common verification checks. It's plug-and-play fraud. The skill floor dropped to near zero. The attack volume, predictably, went through the roof.

---

How Synthetic Identity Fraud Targets the IRS

Identity Verification Requirements the IRS Actually Uses

Identity verification requirements at the IRS typically ask a taxpayer to confirm details from a prior tax return, a current address, and information tied to an IRS letter the taxpayer actually received. The IRS built these identity verification requirements specifically because a fraudster working from a stolen identity usually cannot answer questions tied to a taxpayer's real filing history. Anyone who gets an IRS letter asking them to verify their identity should treat that letter, not a phone call or text, as the starting point for verification.

Here's where the availability heuristic kicks in, and it's working overtime right now. It's one thing to read a statistic about enterprise security. It's another to hear that the person claiming to be your IRS agent over video call might be a synthetic construct. That scenario is no longer hypothetical. Tax scammers are actively deploying synthetic media to impersonate government officials, according to reporting from KGW. The psychological weight of that is significant: when the IRS, an institution people already have complicated feelings about, can be convincingly faked, it erodes a baseline trust that most security models assumed was stable.

And it's not just tax agencies. California Attorney General Rob Bonta issued a formal alert warning residents about sophisticated deepfake scams running on Meta's platforms, according to Westside Today. An Australian billionaire's law firm dragged Meta into litigation over deepfake scam advertisements, according to LawFuel. LeBron James filed a cease and desist over deepfake imagery circulating in his name. A Democratic politician was forced to cancel his re-election bid after an AI-generated deepfake of him went viral, per MSN reporting.

"The increasing scale and sophistication of deepfake attacks is forcing businesses to augment techniques that rely on facial biometrics with other processes, including device profiling, as fraudsters' perceived ability to evade detection prompts CISOs to reconsider single-factor verification entirely." InformationWeek, covering enterprise CISO response to deepfake fraud escalation

The pattern across all these incidents isn't random. It's a stress test playing out simultaneously across every institution that uses digital identity as a trust signal, and right now, a lot of those institutions are failing the test. Businesses need to stop treating any single signal as proof and start treating identity as a chain of evidence.

---

Why Fraud Prevention Cannot Rely on One Signal

Identity Screening Is Not a Single Checkpoint

Identity screening is often treated like a single gate a person either passes or fails, but that mental model is exactly what synthetic identity fraud exploits. Identity verification works best as a chain of separate, cross-checked signals, face, document, device, and behavior, where a fraud kit that clears one link still has to clear the next. Investigators who understand identity verification this way stop asking "did it pass?" and start asking "did it pass for the right reasons?"

How an IRS Identity Verification Letter Works

An IRS identity verification letter, often a Letter 5071C or similar notice, tells a taxpayer that the IRS received a tax return under their Social Security number and needs to confirm the return was really filed by them before it processes a refund. That IRS identity verification letter will direct the taxpayer to verify online through the IRS's own site or by phone, and it will never ask for payment or gift cards as part of the process. Because scammers now know this letter exists, they've started mimicking its language, which is exactly why taxpayers should verify a letter's legitimacy directly with the IRS rather than through any number or link the letter itself provides if something feels off.

Here's something that should make every investigator uncomfortable: humans correctly identify high-quality deepfake videos roughly 24.5% of the time, according to research compiled by Bright Defense. That's barely better than a coin flip. Worse, only 0.1% of participants across mixed modality tests could reliably spot fakes. Not 10%. Not 1%. Point one percent. Previously in this series: The Faces Were Fake The 25 Million Was Real.

The natural response is to reach for automated detection tools, and those are improving. Some models have achieved 98% accuracy in controlled conditions. But (and this is a significant but) lab accuracy can drop by as much as 50% when those same tools encounter novel real-world synthetic fraud attempts they weren't trained on. That 98% figure means 1 failure in every 50 attempts under ideal conditions. In a high-volume investigation environment, or in a fraud operation targeting a financial institution processing thousands of identity verifications daily, that failure rate produces real, expensive consequences.

There's a deeper technical problem too. Keepnet Labs reports that injection attacks, where synthetic media is fed directly into verification systems, bypassing liveness detection entirely, grew 200% in 2023. Bad actors aren't trying to fool the camera anymore. They're feeding pre-rendered synthetic media directly into the data pipeline, upstream of where most detection runs. The liveness check you're relying on? It never saw the attack coming because the attack didn't go through the camera at all.

---

Closing the Workflow Gap Behind Most Synthetic Identity Fraud

Document Verification Closes Gaps Facial Matching Misses

Document verification catches a category of fraud that facial comparison simply cannot see: a document that has been digitally altered, reissued with fabricated data, or built from scratch to look plausible. Document verification run alongside facial comparison, rather than after it, means a fraud attempt has to fool two independent systems at once instead of one system twice. That combination is a large part of why layered workflows can help financial institutions reduce fraud without slowing down legitimate customers.

Verifying an IRS Account Without Getting Scammed

An IRS account, accessed through the agency's own online portal, gives a taxpayer a direct way to check refund status, payment history, and any identity verification notices without relying on a phone call from someone claiming to represent the agency. Setting up and checking an IRS account directly is one of the simplest ways a taxpayer can verify that a letter or call claiming to be the IRS is legitimate, because the same information should already be visible inside that account. Taxpayers who never set up an IRS account are, in practice, more dependent on trusting unverified calls and letters at face value, which is exactly the position scammers want them in.

Most organizations have detection somewhere in their stack. Very few have built workflows where facial comparison, document authentication, and behavioral context are cross-checked by default, not as an exception triggered by suspicion, but as the standard operating procedure for every identity claim. That gap is where synthetic identity fraud lives.

The ACFE has flagged government agency impersonation and synthetic identity fraud as among the most significant emerging fraud vectors, and both rely on that workflow gap. Fraudsters aren't outsmarting detection technology. They're finding the seams between disconnected verification steps and walking through them.

This is the actual opportunity, and it's substantial: not building a better detector in isolation, but rebuilding the verification chain so that no single check carries the full weight of trust. Facial comparison tools, including the kind CaraComp builds for investigators, are most effective when they're the first layer of a layered workflow, not the last word on identity. Fast, accurate biometric matching gives investigators a confident starting point. What comes after that match determines whether the investigation holds up. Up next: The Cop Who Made 3 000 Deepfakes Exposed A Bigger Problem Th.

Regula Forensics puts it plainly in their identity verification trend analysis: the fraud ecosystem has matured to the point where organizations need to plan for industrial-scale synthetic fraud as a baseline assumption, not an edge case. That means building for the threat, not reacting to individual incidents, and coordinating with other industry partners rather than working alone.

There's also a secondary implication worth sitting with: as regulators and attorneys general start issuing specific scam alerts, not general AI warnings, but targeted consumer fraud advisories, the legal and evidentiary standards around digital identity are quietly shifting. Evidence that looked airtight in 2022 may face challenges it didn't face before. That's a problem for prosecutors, for civil litigators, and for anyone building a case on digital media they can't definitively prove is authentic.

So here's the question that matters: When you get a "perfect" match on a suspect's photo or video today, what's your second step to rule out synthetic fraud, or are you still treating matching media as inherently trustworthy? Because in 2024, with attacks hitting every five minutes and injection fraud bypassing liveness checks entirely, "it looked right" is exactly what the Arup finance employee said too, right before he wired $25 million to people whose faces never existed.

Preventing Synthetic Identity Fraud Starts With Layered Checks

Preventing synthetic identity fraud means accepting that no single signal, not a face, not a voice, not a document, can carry the full weight of a verification decision anymore. Fraud teams that once leaned on one strong check are now stacking several weaker ones together, because a fraud ring that can beat one layer often stumbles on the second. That shift is less about buying the most advanced technology available and more about changing the sequence of decisions a case worker or system makes before an identity is approved.

How Teams Detect Synthetic Identity in Practice

Detecting synthetic identity starts with noticing what's missing, not just what's present. A synthetic identity often has a face, a name, and a document, but a thin or inconsistent history behind all three, no prior address trail, no aging pattern across photos, no coherent behavioral footprint. Investigators who compare an applicant's claimed history against these gaps catch synthetic identity fraud that a single facial match would wave through without question, and they proactively spot them early rather than after a loss is reported.

Multi-Factor Authentication as a Second Layer

Implementing robust identity verification measures often starts with multi-factor authentication, which adds friction exactly where fraud rings want speed. A synthetic identity built from a persona kit can often pass a facial check and a document check, but a one-time code sent to a verified device, or a knowledge question tied to genuine account history, breaks the chain because the fraud kit was never built to answer it. Multi-factor authentication doesn't need to be perfect to be useful, it just needs to be one more step the fraud economy hasn't fully automated yet.

Prevent Synthetic Fraud by Closing the Workflow Gap

To prevent synthetic fraud at scale, organizations need to close the gap between separate verification steps rather than adding more of them. A face check that passes, a document check that passes, and a behavioral check that passes should all feed into one decision, not three separate approvals made by three separate systems that never talk to each other. Closing that gap is often cheaper than it sounds, because it's a workflow fix, not a technology overhaul.

What Customers Notice When Verification Works

Customers rarely notice a verification system working correctly, they only notice friction, or they notice a breach after the fact. Good synthetic identity defenses are built to stay invisible to legitimate customers while still creating enough resistance that a fraud ring gives up and moves to an easier target. That balance, invisible for real customers and expensive for fraudsters, is the actual design goal.

Why the Market Is Moving Toward Layered Verification

The market for identity verification is shifting away from single-signal tools and toward platforms that combine several checks by default, largely because Gartner's own prediction, that 30% of enterprises will distrust isolated verification by 2026, is already shaping procurement decisions. Vendors that once sold a single facial-matching product are now expected to show how that product fits into a layered chain of custody. That expectation is the market correcting for exactly the kind of attack that hit Arup.

Preventing synthetic identity fraud is not a single purchase decision; it's an ongoing commitment to re-checking assumptions as fraud tooling improves. An identity that would have passed every check in 2022 may fail today simply because the layered workflow around it has gotten smarter, even if the core facial-matching technology hasn't changed at all. That's the quiet, unglamorous work of fraud prevention: not a single breakthrough, but a steady tightening of the seams fraud rings rely on. This is also part of why protecting your personally identifiable information matters just as much on the customer side of the equation.

Detecting synthetic identity fraud reliably also means training staff to distrust their own confidence. An investigator who has seen thousands of real applicants develops a gut sense for what's normal, and synthetic identities are specifically engineered to satisfy that gut sense. The fix isn't better instincts; it's a checklist that runs regardless of how confident the reviewer feels, because confidence is exactly the emotion a well-built synthetic identity is designed to produce.

Multi-factor authentication also helps close the injection-attack gap described earlier in this piece, the one where synthetic media is fed directly into a verification pipeline instead of a camera. A second authentication factor tied to a device or account history doesn't care whether the face in front of the camera is real; it asks a separate question the fraud kit usually can't answer. That's why security teams increasingly treat multi-factor authentication as a baseline requirement rather than an optional upgrade for high-risk accounts.

Connecting the dots between facial comparison, document forensics, and behavioral history is ultimately what turns a pile of individually passable checks into an actual fraud defense. Data from any one of those checks, on its own, tells an investigator very little about whether an identity is synthetic. Data from all three, cross-referenced against each other, tells a much clearer story, and that story is what closes cases before a wire transfer goes out the door.

Organizations serious about preventing synthetic identity fraud tend to start small: pick the one workflow gap most likely to be exploited, close it, and measure whether fraud attempts shift toward a different weak point. That kind of iterative tightening won't stop every attack, but it steadily raises the cost of fraud until easier targets elsewhere become more attractive to the fraud economy than a hardened one.

Credit unions and community banks face a version of this problem too, often with smaller fraud teams than a national financial institution. A customer applying for a credit line online has to be verified quickly enough that the customer doesn't abandon the application, but thoroughly enough that a fabricated persona carrying a stolen identity doesn't slip through. Small institutions that adopt the same layered logic, face, document, device, behavior, can catch what a single credit report review alone would miss.

Someone steals a person's information long before a synthetic identity ever reaches a bank's front door. Stolen personal data get blended with fabricated details to create a persona that passes a basic check because parts of the underlying data are genuinely real. That blending is what makes synthetic identity fraud harder to catch than old-fashioned identity theft, where a criminal simply used one person's stolen name and credit outright.

Verify every new applicant against more than a name and a photo, and the economics of synthetic identity fraud start to shift. When a bank or agency can quickly verify address history, device consistency, and document authenticity together, a fraud ring has to fabricate a much deeper and more expensive persona kit just to get past the front door, and many won't bother.

Learn to treat identity verification as a process with stages, not a single yes-or-no gate, and the whole fraud picture gets easier to manage. Staff trained to expect a second and third check, rather than treating one clean match as the finish line, close far more of the gaps that synthetic identity fraud is specifically built to exploit.

Identity theft and synthetic identity fraud often get discussed as though they're the same crime, but they behave differently in practice. A stolen identity used outright tends to trigger fast, obvious red flags once the real person notices unfamiliar activity on their account. A fabricated persona, blended from a mix of real and fake data, can operate quietly for months before any single account or customer relationship raises a flag.

Digital identity verification is where most of this defensive work now happens, since so many financial and government interactions never involve a face-to-face meeting at all. Digital identity checks that combine document scans, biometric verification, and device signals give an investigator far more to work with than a single digital photo ever could. Building that combination into everyday customer onboarding, rather than reserving it for flagged accounts, is what actually helps financial institutions reduce fraud over time.

Government-issued credentials remain one of the sturdier anchors in a layered verification chain, precisely because they're harder to fabricate convincingly at scale than a face or a voice. Identity documents paired with biometric verification and a device check give investigators three independent signals instead of one, which is exactly the redundancy that prevents fraudulent activities from succeeding on a single lucky pass.

Identity authentication that relies on government-issued credentials also helps agencies fight the specific pattern described earlier in this piece, where scammers commit tax fraud by impersonating officials over video calls. A citizen or employee trained to independently verify a caller's identity through a separate channel, rather than trusting a face on a screen, closes exactly the gap that made the IRS impersonation scams work in the first place.

None of this requires an organization to distrust every customer by default. It requires building verification workflows where a customer who is exactly who they say they are barely notices the extra checks, while a fraud ring built around synthetic media runs into friction at every layer it tries to pass. That's the balance every serious identity verification program is now being built around.

Identity Protection Starts Before the Application Form

Identity protection works best when it starts long before someone fills out a loan or credit application, not after a fabricated persona has already slipped through the front door. Organizations that build identity protection into onboarding, checking address history, document authenticity, and device signals together, give fraud rings far less room to operate than teams that only investigate after a loss is reported. That earlier posture is also cheaper, because catching a fabricated persona at intake avoids the far more expensive work of unwinding fraud after funds have already moved.

Identity Monitoring Catches What a Single Check Misses

Identity monitoring extends verification past the moment of approval, watching for the kind of slow, quiet activity that a synthetic identity produces over time. Because a synthetic identity is built from a blend of real and fabricated data, it can pass an initial check cleanly and only reveal itself months later through inconsistent address changes or unusual account behavior. Ongoing identity monitoring gives investigators a second and third chance to catch a fraud ring that a one-time check, run only at onboarding, would never see again, using an antivirus software on shared devices is one small piece of that broader picture.

Fraud Risk Grows When Checks Run in Isolation

Fraud risk climbs fastest in organizations that treat facial comparison, document review, and behavioral analysis as three separate departments instead of one connected decision. Every isolated check a fraud ring only has to beat once, rather than every layer at the same time, adds fraud risk that a connected workflow would have caught. Reducing that fraud risk doesn't require the most advanced technology available in most cases, it requires connecting the systems an organization already owns so no single pass counts as a final answer.

Fraud Detection Works Best as a Team Effort

Fraud detection improves dramatically once facial comparison, document forensics, and device data are cross-referenced by the same reviewer or system instead of scattered across separate teams. A fraud detection process built around a single signal, even a highly accurate one, still leaves a gap that synthetic identity fraud is specifically designed to slip through. Connecting fraud detection tools so they trigger and inform each other automatically is what turns individually decent tools into an actual defense against synthetic fraud.

Fraud Mitigation Is a Sequence, Not a Single Step

Fraud mitigation works best as a sequence of increasingly specific checks rather than one large gate at the front door. An effective fraud mitigation plan assumes that some fraud attempts will pass the first check, so it builds a second and third check designed to catch exactly what the first one misses. Treating fraud mitigation this way, layer by layer, each one narrower than the last, is what actually connects a facial match to a genuine identity instead of just a convincing one.

Effective Strategies Combine People, Process, and Data

Effective strategies for stopping synthetic identity fraud rarely rely on a single piece of software; they connect trained staff, a documented process, and shared data across every verification step. An organization that treats identity screening as part of the whole business, not just a compliance requirement for one department, tends to catch fraud earlier and cheaper. Building effective strategies around cross-checked data, rather than any single tool, is what holds up as fraud tactics keep evolving.

Data sharing between the fraud, compliance, and customer service teams closes another quiet gap that fabricated personas rely on. When credit data, device data, and document data all feed into the same case file, a reviewer can connect a pattern across three departments that no single department would ever see on its own. Organizations that treat data as something to connect across teams, rather than something each team collects and keeps to itself, close far more fraud cases before money moves.

Credit data specifically deserves more scrutiny than it usually gets, because a fabricated persona's credit report is often the thinnest and most inconsistent part of the whole profile. A short credit history, a sudden jump in credit-seeking behavior, or credit accounts opened at addresses with no supporting history are all signals that connect back to a synthetic origin. Teams that treat credit data as one input among several, rather than the deciding factor, catch synthetic identity fraud that a credit-only review would approve.

Preventing synthetic identity fraud, in the end, comes down to connecting checks that already exist rather than waiting for a single tool that detects everything at once. Every layer described in this piece, facial comparison, document forensics, device data, behavioral history, and credit data, does a better job connected to the others than it ever could alone. That's the same lesson the Arup case taught the hard way: a single convincing signal, no matter how real it looks, is never the whole story.

Identity Verification Helps Teams Seamlessly Verify Identities Now

Identity verification has moved from a single gate toward a chain built specifically to seamlessly verify identities without slowing down a legitimate customer. Digital identity verification systems that combine document scans, biometric verification, and device signals let a case worker verify an applicant in seconds rather than days, while still forcing a fraud kit to clear several independent hurdles. That speed is not an accident; it's the direct payoff of connecting checks that used to run separately, one after another, on paper.

Identity verification also has to keep pace with credit-driven fraud, since a fabricated persona's whole purpose is often to open a line of credit under an identity that partly checks out. Credit files built from real fragments and fabricated additions can pass a shallow review but fail once digital identity verification and biometric verification are added to the same process. Teams that treat credit review and identity verification as one connected question, not two separate departments, catch far more of these blended profiles before a credit line ever opens.

Verification Scams Target the Weakest Link in the Chain

Verification scams succeed by aiming at whichever single check an organization still treats as final, whether that's a facial match, a document upload, or a one-time code. A well-run identity verification program assumes every individual check can be beaten and builds the next layer specifically to catch what the last one missed. Recognizing verification scams for what they are, an attack on a gap between checks, not on any one check itself, is what pushes teams toward the layered model this article keeps returning to.

Identity Documents and Credentials Anchor the Chain

Identity documents remain one of the harder pieces of a persona kit to fabricate convincingly, which is exactly why identity verification programs lean on them alongside a face and a device signal. Identity credentials issued by a real agency, checked against biometric data and a device signal, give a fraud ring one more expensive hurdle to clear before a fabricated profile can ever open an account.

Preventing synthetic identity fraud in day to day operations

Synthetic identities are built from pieces: a real Social Security number, a made up name, a fresh address. Because synthetic identities do not belong to one victim, nobody calls the bank to complain, which is why synthetic identity fraud grows quietly for months before a lender notices the losses.

Teams that prevent synthetic identity fraud treat every new applicant as unproven until the layers agree. A document check, a liveness check and a face comparison against the document photo catch most synthetic identities at the door, and the ones that slip through show up later as identity theft reports that never match a real person.

The cheapest place to prevent synthetic identity fraud is onboarding. Once a synthetic identity has a credit file, an account and a payment history, the fraud looks like a normal customer, and identity theft alerts stop helping. Preventing synthetic identity fraud early means fewer identities to chase, fewer charge offs, and fewer calls from regulators asking why the synthetic identity fraud losses doubled.