Application Fraud: How Fake & Synthetic Identities Slip Through Onboarding

As digital onboarding becomes the new gateway for customer acquisition, fraudsters are exploiting weak verification processes to submit fake applications, using stolen information and fabricated identities to create accounts before businesses detect the risk.

Digital onboarding has made it easier than ever for customers to apply for services, open accounts, make purchases, and access new platforms. But that same convenience can also create opportunities for fraudsters.

Application fraud occurs when someone uses false, stolen, or manipulated information to complete an application with the goal of gaining access to a product, service, account, or financial benefit. In some cases, the identity belongs to a real person. In others, the identity is entirely fabricated.

For businesses, the challenge is that a fraudulent application can look legitimate at first glance. By the time suspicious activity is detected, the account may already be active.

What Is Application Fraud?

Application fraud is a type of identity-related fraud that occurs when someone provides false, stolen, or manipulated information during an application or onboarding process.

The application could be for almost anything: a bank account, credit or debit card, financial loan, insurance policy, job, ecommerce account, online gaming account, or another service.

Fraudsters may use stolen personal information, altered documents, fabricated details, or combinations of real and false information to create an identity that appears legitimate enough to pass basic checks.

Application fraud isn't limited to customer accounts. Fake identities, stolen information, and fraudulent documents can also make their way into the hiring process. Learn more about the employment scams businesses should watch for.

How Application Fraud Works

While the details vary depending on the target, application fraud often follows a similar pattern:

Step #1: Create an Identity

The fraudster gathers or creates the information needed to represent an individual during the application process. This may involve a stolen identity, a synthetic identity, or fabricated personal details.

Step #2: Submit an Application

The identity is used to apply for a product or service. The application itself may look similar to a legitimate customer application.

Step #3: Provide Supporting Documents

Depending on the business and application, the applicant may be asked to provide identification, personal information, or other supporting documentation.

Step #4: Get Onboarded

If the business's verification process does not identify anything suspicious, the application may be approved and the account activated.

Step #5: Commit Fraud

Once onboarded, the fraudster can use the account or service for fraudulent activity. This could result in financial losses, chargebacks, stolen goods, compromised customer information, or other forms of abuse.

How Fake Identities Slip Through Onboarding: 5 Common Tactics

Fraudsters do not always need to completely invent an identity. In many cases, they combine legitimate information with false or stolen details.

1. Fake or Altered ID Documents

Fraudsters may submit identification that has been manipulated or does not legitimately belong to the person using it. If a business only checks whether a document appears valid, rather than verifying the information and person behind it, suspicious applications can slip through.

According to the Federal Trade Commission's guidance for businesses, altered or forged identification and applications, along with inconsistencies in personal identifying information, can be red flags of identity theft.

2. Stolen or Borrowed Identities

A fraudster may use information belonging to another person to make an application appear legitimate. Because the information may correspond to a real individual, basic checks may not immediately reveal the problem.

3. Fabricated Details on the Form

Not every fraudulent identity is based entirely on stolen information. Fraudsters may provide made-up or manipulated details, creating an identity that appears consistent enough to pass a limited screening process.

4. Account Farming and Bulk Sign-Ups

Creating multiple accounts can allow fraudsters to test different applications, take advantage of promotions, or establish a network of accounts. A single application may not look unusual, but patterns can become more apparent when applications are viewed together.

5. Mule and “Clean” Accounts

Some accounts are created or controlled to receive, move, or facilitate fraudulent activity. These accounts can appear legitimate during onboarding, making ongoing monitoring just as important as the initial identity check.

Who Is Targeted?

Application fraud can affect businesses across industries, particularly those that rely heavily on digital onboarding.

1. Ecommerce Retailers

Online retailers may face fraudulent account creation, payment abuse, promotional abuse, and attempts to obtain goods through illegitimate accounts.

2. Age-Restricted Retailers

Businesses selling alcohol, tobacco, CBD, or other age-restricted products have an additional responsibility to verify that customers meet applicable requirements. Weak identity and age verification can create opportunities for fraudulent accounts and transactions.

3. Online Gaming & Gambling (iGaming)

iGaming platforms can be attractive targets because accounts may provide access to financial transactions and other valuable services. Strong identity verification can help businesses identify suspicious applicants before accounts become active.

If you work in iGaming, knowing who’s behind an account is an important part of creating a safer onboarding experience. See how ID verification can help operators verify players before they gain access.

How Businesses Can Detect Application Fraud

When it comes to application fraud detection, no single warning sign proves an application is fraudulent. Instead, businesses should look for patterns and inconsistencies that may require additional review.

1. Unusual Application Velocity

A sudden increase in applications over a short period can be a signal that automated or coordinated activity is occurring.

2. Repeated Contact Information

The same phone number, email address, mailing address, or other contact information appearing across multiple applications may indicate a need for closer review.

3. Suspicious Device or Network Patterns

Applications associated with unusual or repeated device and network activity may indicate that multiple accounts are being created from a common source.

4. Inconsistent Identity Information

Differences between an applicant's name, address, date of birth, identification, or other information can indicate that additional verification is needed.

5. Suspicious Documents

Altered, inconsistent, or otherwise questionable identity documents should receive additional scrutiny rather than being accepted based solely on appearance.

6. Multiple Accounts with Similar Behavior

When several accounts demonstrate similar activity or characteristics, businesses may be able to identify connections that would not be apparent when reviewing each application individually.

How Businesses Can Prevent Application Fraud

Prevention starts with making identity verification part of the onboarding process rather than treating it as an afterthought.

1. Strengthen Identity Verification During Onboarding

Businesses should use verification processes that confirm the applicant is a real person and that the information provided is consistent with the identity being claimed.

2. Verify Identity Documents

Document verification can help businesses identify potentially altered, invalid, or mismatched identification before an account is approved.

3. Add Biometric Verification Where Appropriate

Biometric methods, such as facial verification or liveness checks, can add another layer of confidence by helping businesses determine whether the person completing the onboarding process is physically present.

4. Monitor Applications for Repeated Patterns

Fraud indicators can become easier to recognize when businesses analyze applications collectively instead of reviewing each application in isolation.

5. Use Risk-Based Verification

Not every application presents the same level of risk. Businesses can apply additional verification steps when an application raises specific concerns while keeping lower-risk onboarding experiences more streamlined.

If You Suspect Application Fraud

If an application appears suspicious, businesses can take several steps to contain potential risk while investigating the activity:

• Pause high-risk activity: Temporarily hold account activation, transactions, or other high-risk activity while the application is reviewed.
• Preserve evidence: Keep application records, submitted documents, transaction details, and other relevant information that may help with an investigation.
• Review linked accounts: Look for other accounts connected through shared contact information, devices, payment details, or other identifying information.
• Contact the affected customer: If legitimate customer information may have been used, notify the individual and provide guidance on the steps they can take to protect their identity.
• Update fraud rules: Use findings from the investigation to strengthen verification procedures and improve rules for identifying similar activity in the future.

Where to Report Application Fraud

If you suspect application fraud, the appropriate reporting channel may depend on the type of fraud, who was affected, and whether financial or personal information was compromised.

Businesses and individuals may consider reporting suspicious activity to:

• Federal Trade Commission (FTC): Report fraud, scams, and identity theft, and access resources for responding to identity-related fraud.
• FBI Internet Crime Complaint Center (IC3): Report suspected internet-enabled fraud and other cyber-related crimes.
• State or local law enforcement: Contact the appropriate law enforcement agency when fraud involves criminal activity or an immediate local impact.
• Banks, payment providers, and business partners: Notify relevant financial institutions, payment processors, or other partners when fraudulent applications involve accounts, payments, or transactions they support.
• Credit bureaus or relevant reporting agencies: When an individual's identity or credit information has been misused, reporting the incident to the appropriate credit reporting agencies may help limit further fraudulent activity.