Inside the AI-powered networks, fabricating a shadow economy

Financial institutions worldwide are grappling with losses estimated in the tens of billions, approximately USD 35 billion in 2023 alone, according to FiVerty, an anti-fraud collaboration platform. These losses are no longer limited to one-off fraud attempts but are driven by a hyper-realistic, AI-coordinated threat known as the Synthetic Identity Fabric (SIF). 

It is not a simple digital equivalent to a fake identity; it is the automated creation of an entire, plausible criminal ecosystem designed to live in the shadows of the legitimate financial system.

The genesis of the Phantom identity

Traditionally, fraud involved stealing an existing person’s identity. The Synthetic Identity Fabric flips this script entirely with the utilisation of Generative AI. Malicious actors can now construct entirely new, non-existent personas by weaving together a mix of real and fictitious data.

How the Fabric is Woven:

First in the process comes the data sourcing. Criminals begin with fragments of real, non-sensitive data, a genuine address, a correct but unused Social Security Number (SSN), or a legitimate phone number, often harvested from old data breaches.

Then GenAI tools are employed to automatically create the missing, yet highly realistic components like multi-year biographical backstories, fake supporting documents that can pass initial screening. The next step involves creating consistent digital footprints across social media profiles and online accounts, often aged for months to appear authentic.

Unlike quick-hit fraud, SIFs are cultivated over months, sometimes even years. The fraudsters open small, low-risk accounts, make regular payments, and establish a legitimate-looking credit history. This 'sleeper' phase is specifically designed to bypass legacy systems that flag new, thin-file identities.

Once the synthetic identity is deemed credible, with high credit scores and large limits, the coordinated fabric strikes. Multiple accounts, often controlled by a single fraud ring, simultaneously max out credit cards, take out loans, or initiate large-scale money transfers, and even disappear before the fraud is discovered.

The problem of ‘Normalcy’

The greatest challenge of the SIF is its very success in mimicking normalcy. Traditional security models rely on entity-level checks; verifying the authenticity of one ID document, one IP address, or one credit score. The SIF intentionally avoids triggering these checks.

“Most bank fraud checks flag individual fake IDs. Synthetic Identity Fabrics bypass this entirely by operating as coordinated clusters of fake accounts that mimic normal behaviour for months, staying invisible until it’s too late. The single most important proactive step is network graph analysis powered by behavioural AI, mapping interconnections across accounts and platforms to uncover subtle patterns like shared activities or anomalies before large-scale fraud erupts.” – said Diwakar Dayal, Managing Director & Area Vice President – India & SAARC, SentinelOne.

This highlights a critical truth: one cannot catch a network by inspecting only one node. When a fraudster uses one device to manage dozens of synthetic identities, each identity passes the single-check test, but the pattern of shared access is a massive red flag that legacy systems simply cannot see.

The proactive defence

The modern defence requires a fundamental shift from identity verification to ecosystem anomaly detection. This is where advanced AI becomes the necessary counter-weapon. Financial institutions can deploy Graph Databases and Behavioral Biometrics to link every entity, accounts, devices, IP addresses, email domains, and phone numbers, into one massive, interconnected network model.

“The most important step is to move from individual identity checks to proactive network-based entity resolution, where the bank correlates signals across devices, phone numbers, emails, behavior, IP infrastructure, and digital footprints to reveal hidden synthetic identity clusters... The key is to identify interconnected anomalies such as shared devices, overlapping contact points, unusual behavioral similarities, repeated form-fill traits, or coordinated login patterns rather than evaluating each customer in isolation.” – said Anuj Khurana, Co-founder and CEO, Anaptyss.

The digital fingerprint of a criminal

GenAI can create a convincing name and address, but it still struggles to consistently replicate the subtle, subconscious behavioral patterns of a real human over time.

Here what security systems can look for:

• Accounts with no official link that consistently log in from the same virtualised IP range or share a unique browser fingerprint.

• Identities that exhibit suspiciously perfect, low-variance typing cadence, mouse movements, or transaction velocity, patterns real customers rarely maintain.

• Two seemingly unrelated accounts making the same exact type of transaction to the same merchant within a minute of each other.

The fight against the Synthetic Identity Fabric is a crucial inflection point in the AI arms race. Criminals have automated the creation of plausible identity at scale, weaponising our trust-based financial infrastructure. The only path to resilience requires firms to become data cartographers, abandoning the isolation of single identity checks for the comprehensive, proactive visualisation of an entire web of interaction.