Synthetic identity fraud has been on the rise for some years, causing billions in losses and undermining trust in major enterprises.
With the advent of agentic AI, the speed and scale at which criminal syndicates can carry out synthetic identity fraud has increased exponentially.
Synthetic identity fraud is distinctly different from traditional identity theft, in which the credentials of a real person are stolen and used to create accounts fraudulently.
Synthetic identities are created by blending fabricated details and genuine personal information stolen through data breaches, malware or social engineering. Generative AI uses this information to maximise the total number of synthetic identities created from the source information, and these can be used to apply for new accounts or credit cards, or support scams.
Generative AI also enables bad actors to create more authentic-looking documents and deepfake images to make synthetic identities more believable.
Because synthetic identity fraud is harder to identify than fraud based on traditional identity theft, this form of fraud presents a significant and growing risk to financial institutions and retailers.
The bad actors are faster and more agile because criminal syndicates aren't hamstrung by corporate procedures and rules.
For criminal syndicates, synthetic identity fraud offers a relatively simple, lucrative and low-risk opportunity, so it is expected to continue growing.
Meanwhile, financial institutions, fintech firms, telecommunications and healthcare organisations are lagging behind the criminals, slowed by corporate compliance, committees and budget considerations. The bad actors are faster and more agile because criminal syndicates aren't hamstrung by corporate procedures and rules.
According to the Sumsub APAC Fraud in 2026 report, fraud cases where the selfie doesn’t match the ID document have increased by 73% year-on-year and now represent 35.4% of regional fraud.
In addition, synthetic identity fraud in the region has jumped 142% in a single year and automated attacks are also rising, with a 388% increase in duplicate submissions year-over-year. The report notes that fraudsters approach fraud like a business process, with various role players, stages and the laundering of the proceeds through various channels.
A US Federal Reserve report says synthetic identity fraud losses continue to grow and were estimated at $35 billion in 2023.
If synthetic fraud has escalated to this level in more developed regions, we can assume that more organisations across Africa are falling victim too.
Mitigating risk
Organisations can’t afford to be reactive to crime, particularly when they have contractual and regulatory obligations to keep credentials safe. Importantly, they also need to maintain customer trust.
Digital identity solutions are crucial for protecting businesses against identity fraud and synthetic identity fraud.
However, not all identity verification solutions are equal. To effectively mitigate risk, companies need trusted, sovereign AI solutions that deliver proven performance in real-world environments.
It’s important that they are able to identify spoofing attempts and verify identity using facial recognition, age estimation and liveness, as well as matching names and identity numbers to trusted national databases.
Any business investigating the implementation of a digital identity platform must also focus on the underlying technology, checking for NIST certifications and the iBeta stamp of approval.
iBeta carries out independent third-party biometric presentation attack detection (PAD) (or liveness detection) testing to ensure systems are secure against spoofing and fraud.
PAD testing is accredited to international standards like ISO/IEC 30107-3. This is the international standard that establishes the principles, methods and metrics for testing and reporting biometric PAD mechanisms and how effectively they detect spoofing, such as artificial fingerprints, deepfakes, or masks.
There are various levels of testing, from level one, with eight hours of comprehensive testing, to level three, which entails up to seven days of testing. The tests use a wide range of spoofing techniques, including hyper-realistic facial masks and fingerprints, to ensure devices can accurately determine whether an identity is real or faked.
This means that technology compliant with these standards has undergone days of constant attempts to break through using deepfakes, spoofing and multiple other methodologies to try to beat it. This is important because any software that doesn’t pass this test is not secure enough to withstand the onslaught by synthetic identity fraud syndicates.
With the right technology in place, backed by the necessary testing and internationally recognised certifications, organisations will have the confidence to tell customers that their information and money is safe with them.
Share
