Duplicates, recycled identities and synthetic identities are different problems
| Pattern | Who applies | What repeats | Why it matters in a lead flow |
|---|---|---|---|
| Duplicate application | One real person, more than once | Identity and contact details, often via another source | The same applicant can be delivered, and billed, twice |
| Recycled identity | The same person, or someone else using the same identity details | Name and birth date, a document, phone or email, with other details changed | Reads as a new applicant until it is linked to the earlier one |
| Synthetic identity | A fabricated person built from invented data, often mixed with some real data | Real or invented details reused across identities, including shared contact details | Built to look like a legitimate person, so it often passes a first check |
The three patterns as this page uses the terms.
Synthetic identities are built to pass a first identity check
The synthetic identity definition used here comes from an industry focus group convened by the US Federal Reserve. It is voluntary guidance, not a regulation. It describes synthetic identity fraud as combining personally identifiable information to fabricate a person or entity for a dishonest act aimed at personal or financial gain. It separates primary elements, such as name, date of birth and government-issued identifiers, from supplemental elements such as address, phone number, email address and digital footprint, which can help substantiate an identity but cannot establish one by themselves. For matching, that means a shared phone or email can link applications but does not show who the applicant is.
The Federal Reserve's 2019 release describes a synthetic identity as created by combining real information, such as a legitimate Social Security number (the US government identifier), with fictional details such as a made-up name, address or date of birth. Its October 2019 white paper words it more loosely: perpetrators combine fictitious and sometimes real information. The Fed's detection toolkit adds that these identities are created to look and act like a legitimate person and often pass KYC verification. Not every synthetic identity is built to default: the Fed also lists credit repair and fraud for living. The payment default scheme, where goods, cash or services are obtained with no intent to repay, is the use that ends in unpaid credit.
Evidence of a recycled or synthetic identity sits across applications
One loan application from a synthetic or recycled identity can look clean, so the evidence sits between applications. The Fed's toolkit calls similar customer information across accounts the biggest indicator: matching contact details such as address, phone and email, matching Social Security numbers (the US government identifier), and an identical digital footprint. It adds that typically no single indicator signifies a synthetic identity, while a combination of characteristics may suggest one. The Fed's white paper lists multiple account applications from the same IP address or device among the patterns worth checking. Its link-analysis overview adds that fraudsters often reuse personally identifiable information and may make minor alterations to it, which is why close matches matter as well as exact ones.
In lead data, patterns include:
- One phone number or email address on applications under different names.
- Many identities from one device, network or IP address (see emulators and device farms).
- The same name and birth date with a different phone number or email address each time.
- The same document details submitted through different sources.
# Fictional records and rule. Keys are normalised before they are compared.
# Plus-tags are stripped only for providers known to support plus-addressing.
phone_key = normalise_phone(phone)
email_key = lowercase(strip_plus_tag(email))
link = same phone_key OR same email_key
app_1 search Applicant A phone_key=7c1e device=d204
app_2 referral Applicant B phone_key=7c1e device=d204
app_3 apps Applicant C phone_key=7c1e device=d377
# One link, three names, two on one device: group for review. A link does not decide.
A phone match needs care. Carriers reassign disconnected numbers (the US Federal Communications Commission noted in 2018 that millions are reassigned there each year), so a phone match can join two different people. It is a link to weigh against device, network and timing, not a verdict.
Identity checks link contact details, devices and account activity
NIST's Digital Identity Guidelines (SP 800-63A-4) describe identity resolution as the starting point of identity proofing, a process that includes the initial detection of potential fraud; it means collecting the minimum evidence and attribute information needed to distinguish a unique identity in the population served. A lead flow can borrow the idea by comparing each application with earlier ones. What can be compared depends on what has been collected by then. Payout account details are normally the lender's data, so account linking sits on the lender's side.
| Check | What it compares | Pattern it exposes |
|---|---|---|
| De-duplication across sources | Each new application against earlier ones the checker can see, across sources | Duplicate application |
| Phone and email linking | Numbers and email addresses reused across names, and how recently issued | Recycled identity: one contact detail behind several identities |
| Device and network linking | Device and network traces across applications | Recycled or synthetic identities: many identities from one device or IP address |
| Payout and account activity (lender side) | The lender's own records of where money goes, compared across applications | Recycled or synthetic identities: several identities paying out to one account |
| Attribute consistency | Name, birth date, document details and postal address against each other | Synthetic identity: mismatched or fabricated combinations |
| Lender KYC | The lender's own verification against authoritative or credible sources | Synthetic identity: fabricated identity evidence |
Checks that can run before or after delivery, depending on who holds the data.
CYBERTECH's identity check, one of the signals read together when applicants are screened against the lender's rules, looks at the consistency of the details an applicant gives and at duplicate applications; how the screening works covers it.
Many applications from one device or contact detail in a short time fall under velocity and behaviour signals, and one identity applying to many lenders is loan stacking.
De-duplication should run before delivery and before billing
Duplicates can arise when the same applicant reaches the lender through two sources, or applies again after a rejection. When a lead is billed per qualified application or agreed outcome, as with CPA or CPD, every duplicate counted as qualified is paid for twice. A duplicate can also take a place in a daily or monthly cap that a new applicant could have filled. Corrected afterwards, it can become a dispute over which source came first.
Where a duplicate rule is part of the rules agreed for the market and product, an application that breaks it is not routed. The billable event is defined together before launch, and a duplicate rule can be settled at the same time. The rule should state:
- which identifiers make two applications the same person, for instance phone, email, government identifier or bank account;
- how phone numbers, emails and names are normalised before matching, so formatting, plus-tagged emails at providers that support them, and transliteration do not hide a match;
- the window in which a repeat counts as a duplicate, and which submission is kept;
- how legitimate repeats are handled, such as a rejected applicant who applies again after the agreed window, or relatives who share one phone;
- which counts each side keeps, so that submitted, delivered and billed figures reconcile;
- how the rule applies when the lender also works with other partners.
A partner can compare only the traffic it sees, so a lender with several partners still needs its own de-duplication, and the definition should say whose submission counts.
Technical duplicates are separate. An idempotency key on a direct API call lets the receiving system recognise a retried request and return the first result instead of creating a second application, provided the API implements it; an IETF Internet-Draft describes an Idempotency-Key HTTP header for this. The key does not show that two different requests come from one person.
Track the repeat rate per source next to first-payment default (FPD); lead quality by source covers how to read source-level metrics.
The lender's own KYC stays the final identity check
Screening before the handoff reduces what reaches the lender; it does not replace the lender's verification. The Fed notes that synthetic identities often pass KYC. NIST lists validation of core attributes against authoritative or credible sources, with biometric comparison, among its countermeasures for synthetic identity fraud, and says the list is not comprehensive. Steps of this kind are what a lender's own KYC would normally cover, along with matching against its own customers and credit bureau records; the final credit decision stays with the lender, and the exact requirements depend on the market.
The US sources cited here describe the patterns and how identity proofing is designed. They are not rules for lenders in India, Kazakhstan, Nigeria or Peru; check the local KYC and data protection requirements for your market. General information, not legal advice.
Related guides
- Loan stacking works in the gap before a bureau record existsHow one borrower takes loans from several lenders before bureau records update, how it shows, and which controls shorten the blind spot.
- Velocity and behavioural signals expose scripted loan applicationsHow velocity windows and form-fill behaviour expose bots and rings, where they misfire on shared devices and networks, and how to tune them.
- Screen loan leads for fraud and fit before they reach youFive checks, including fit to your own criteria, screen applicants before handoff. No single signal decides, and a stopped applicant is not delivered to you.
- How CPL, CPA and CPD price loan leadsHow CPL, CPA and CPD differ on risk and reporting, and which terms to fix in writing: billable event, validation window, caps.
Sources
- Federal Reserve (FedPayments Improvement): Synthetic Identity Fraud Defined (2021)
- Federal Reserve System: white paper examines the effects of synthetic identity payments fraud (press release, 2019)
- Federal Reserve (FedPayments Improvement): Synthetic Identity Fraud Mitigation Toolkit, How to Detect a Synthetic Identity (page accessed October 2026)
- Federal Reserve (FedPayments Improvement): Detecting Synthetic Identity Fraud in the U.S. Payment System, Payments Fraud Insights white paper (2019)
- Federal Reserve (FedPayments Improvement): Link Analysis Overview (page accessed October 2026)
- NIST: SP 800-63A-4, Identity Proofing and Enrollment, Security (2025)
- NIST: SP 800-63A-4, Identity Proofing Overview (2025)
- US Federal Communications Commission: news release on the reassigned numbers database (2018)
- IETF HTTPAPI Working Group: The Idempotency-Key HTTP Header Field, Internet-Draft draft-ietf-httpapi-idempotency-key-header (2026, work in progress)