Industry Reports: Is AI Making Synthetic Identities Harder to Spot? How This Credit Union Looks Deeper

By Marc Rapport
Contributing Editor

Key Points

• Synthetic identity fraud increasingly requires credit unions to connect inconsistencies across identity, credit, document and behavioral data rather than rely on a single verification check.
• AI is making fraudulent documents and supporting identity signals more convincing, putting greater importance on automated authentication, historical data and cross-institution intelligence.
• Credit unions can limit member friction by reserving additional verification and manual review for applicants whose combined risk signals warrant a closer look.

At BCU, the change has shown up in the details: an address that doesn’t quite fit, personal information that conflicts with another source or a bank statement that looks legitimate until technology detects the one field that was altered.

Nickie Christianson

For Nickie Christianson, senior manager of Account Protection at the $6.4 billion cooperative, those small inconsistencies increasingly separate legitimate applicants from synthetic identities built to survive conventional verification.

Christianson has spent nearly 10 years with BCU, including five in fraud-fighting work at the suburban Chicago institution, which serves more than 370,000 members nationwide through 43 branches and multiple divisions, FOMs and SEGs.

“One of the biggest outliers is inconsistent information and PII,” Christianson said, describing BCU’s shift from a heavier volume of traditional identity theft toward synthetic identity and first-party fraud.

That shift is showing up across lending: In Celent research commissioned by Zest AI and published in May, 61% of 115 U.S. financial institutions identified synthetic identity fraud as the fastest-growing fraud type, while 64% said their fraud IT does not keep pace with new fraud methods.

“Creating the identity itself is only part of the process,” said David Maimon, head of Fraud Insights at SentiLink, specialists in stopping identity fraud at the point of application.

Look for the story behind the identity
The challenge for credit unions is that a synthetic identity can have many of the signals managers have traditionally associated with a real person, including an address, telephone number, public records and even a credit score. Maimon said fraudsters can deliberately cultivate those signals over time.

That makes an isolated discrepancy less useful than the story told by multiple data points, particularly when a credit union compares information across applications, credit bureaus and its own records.

“You’re looking at the different data points together rather than relying on one individual red flag,” Christianson said, adding that BCU investigators may examine online-banking audit logs, new-member applications, referring memberships and other internal information when something looks wrong.

---

David Maimon

Maimon recommends looking closely at how an identity developed, because legitimate identities generally acquire financial and other records through a natural progression rather than appearing fully formed.

“If you examine the historical signals around an identity and see significant gaps, or see an identity suddenly appear or become ‘resurrected,’ that can be an anomaly in the normal evolution of an identity,” the SentiLink expert said.

More on this timely topic:

• CUbroadcast's AI-supercharged phishing coverage
• CUbroadcast's LexisNexis synthetic-identity interview

Make suspicious applicants prove the difficult details
AI raises the stakes because it can help fraudsters create much more convincing supporting evidence around a synthetic identity, including photographs, passports, driver’s licenses and other documents.

Maimon said generative AI’s more consequential role is not necessarily inventing the basic name, birth date and Social Security number combination, but helping create “the façade around an identity and the signals that support it.”

That makes document authentication an increasingly useful step-up control when other signals indicate elevated risk, rather than something every legitimate applicant must endure.

“Document authentication is non-negotiable,” Christianson said, noting that BCU may request bank statements, proof of income or utility bills and has caught documents in which nearly everything was legitimate except a critical altered field such as the address.

Credit union managers should review where their processes still depend heavily on whether a document looks convincing to an employee, because Christianson said fake and altered documents have become substantially harder to recognize visually in just the past few years.

Metadata, authentication technology and comparisons against broader data can expose discrepancies that manual inspection misses, and Christianson’s conclusion is straightforward: “We have to fight AI with AI.”

Apply friction where the risk is
More fraud controls do not have to mean slowing down every prospective member, and both BCU and SentiLink point toward the same basic model: gather multiple signals first, then escalate the smaller group that presents elevated risk.
“It’s really about applying that friction strategically and only when the risk warrants it,” Christianson said.

BCU uses KYC and fraud risk scores to determine which new-member applications require manual review, while the majority of applicants go through a step-up identity-verification process involving a driver’s license and liveness check.

Managers should also regularly validate those thresholds, Christianson said, because a high volume of manually reviewed applications that ultimately get approved may indicate that controls can be adjusted without unnecessarily increasing risk.

Maimon similarly recommends risk scoring that can assess PII along with signals such as telephone numbers and IP addresses before requiring more intrusive verification. “If the solution returns a higher risk score suggesting the identity may be suspicious, that’s when you can introduce additional friction,” he said, whether that means a telephone conversation with the applicant or asking the person to visit a branch for further verification.

Stop treating each application as an island
Synthetic identity fraud becomes particularly difficult when institutions see only their own slice of an organized attack, making internal link analysis and broader data sharing increasingly important.

The Celent research illustrates that gap: Just 34% of institutions currently participate in a fraud data-sharing consortium even though 73% agree such consortiums benefit the industry.

Credit unions don’t need to wait for an industrywide solution to start making connections inside their own data. Christianson at BCU recommends looking beyond the individual application to online-banking audit logs, new-member applications, referring memberships and other internal information.

“Identifying the applicant or individual as bad is great but being able to identify the source of the activity and stop it from continuing, that’s a win,” Christianson said.

She recommends that institutions also compare credit information across bureaus when possible because discrepancies can expose synthetic or first-party fraud.

The broader lesson is to treat identity as a pattern that must make sense across time, systems and institutions, not as a collection of credentials that simply passed individual checks.

“Identity verification is difficult to do effectively without access to many databases,” said Maimon at SentiLink, and for resource-constrained credit unions that makes the priority clear: use technology to connect more signals, escalate the anomalies and preserve the low-friction experience for members whose identities tell a coherent story.

---