Initiative 2
Transaction and Synthetic Identity Detection
A transaction and synthetic identity fraud detection methodology for community banks, credit unions, regional lenders, and smaller origination platforms.
Status
- Feature engineering specificationPublished 2026-06-24
- Threat model note (synthetic identity)Published 2026-06-24
- Implementation guidePublished 2026-06-24
- Methodology paperPublished 2026-06-24
- Reference implementationPublished 2026-06-24
The problem #
Detection capability is allocated by budget, not exposure
The largest national institutions operate sophisticated commercial detection systems, purchased from vendors at costs running into the millions annually and maintained by dedicated analytics staff. Community banks, credit unions, regional lenders, and smaller online origination platforms generally operate with a fraction of that capability, and in many cases with rule based screening alone. Fraud operations respond rationally to that allocation: they test defenses and route toward the institutions that do not detect them, which means capability concentrated at the top of the market does not eliminate fraud volume. It displaces it downward, onto the institutions least able to absorb loss.
Identity verification tests validity, not combination
A synthetic identity is an internally consistent false identity assembled from composite real data elements: a genuine Social Security number belonging to someone who does not actively use it, paired with a fabricated name, a real address, a plausible date of birth. Identity verification systems ask whether each data element is valid, and a synthetic identity passes every check because each element is valid. The falsehood is in the combination, and combinations are not what verification examines.
No single institution observes the complete pattern
A synthetic identity is cultivated deliberately across accounts at multiple institutions in multiple states, precisely because no single institution observes the complete pattern. Detection capability confined to a small number of large banks therefore leaves the scheme viable everywhere else; capability distributed broadly across the smaller institution tier degrades it everywhere at once.
How the method works #
-
Feature construction across the credit lifecycle
Input is transaction records as institutions already hold them, including amount, timestamp, merchant category, location, and account history, and, for synthetic identity detection, credit file and application behavior data over time: credit history depth, account opening sequence, debt to income relationships, revolving balance trajectories, and delinquency patterning. Because a synthetic identity is assembled from real, individually valid elements, detection has to move from field validation to behavioral pattern analysis across this feature space.
-
Class imbalance handling
Fraudulent transactions constitute roughly one percent of volume or less. A model that simply predicts "legitimate" for every transaction achieves 99% accuracy while detecting nothing, which is why accuracy alone is a misleading metric here. Handling this correctly is a matter of feature engineering combined with sampling and weighting techniques that prevent the majority class from dominating what the model learns.
-
Behavioral scoring
For transactions, the output is a fraud probability score for real time decisioning or batch review. For account applications, the output is a score reflecting the likelihood that an applicant profile reflects a constructed rather than an organic identity, derived from how a credit file was assembled and whether the borrowing pattern is internally consistent, not from whether any single field is valid.
-
Signal precision for cross institution comparability
Each behavioral signal is defined exactly: what is measured, over what observation window, and how it is calculated, so that a different institution with different data can compute the identical measurement and obtain a comparable result. This matters because a synthetic identity is typically cultivated across accounts at multiple institutions in multiple states specifically because no single institution observes the complete pattern; comparable measurements across the smaller institution tier are what make that pattern visible.
-
Deployable, not just published
The methodology is published as working, documented, openly licensed code alongside an operational guide, so that an institution's existing technical staff, typically one or two people at a community bank or credit union, can run it against their own data. Publishing working implementations rather than descriptions alone converts adoption from a system construction project into a configuration task.
What it produces #
What it consumes
Transaction records as institutions already hold them, including amount, timestamp, merchant category, location, and account history, and, for synthetic identity detection, credit file and application behavior data: credit history depth, account opening sequence, debt to income relationships, revolving balance trajectories, and delinquency patterning. No commercial analytics platform or vendor relationship is required.
What it emits
A fraud probability score per transaction, for real time decisioning or batch review; and, for account applications, a score reflecting the likelihood that an applicant profile reflects a constructed rather than an organic identity.
Who uses it #
The direct users are the financial institutions currently least protected against transaction and identity fraud. Their trade associations and state leagues provide established channels through which published methodology reaches many institutions simultaneously, which is how a specification, unlike a consulting engagement, scales without dependence on any one implementer.
- Community banks
- Credit unions
- Regional lenders
- Smaller online origination platforms
Artifacts #
Feature engineering specification
Threat model note (synthetic identity)
Implementation guide for smaller institutions
Methodology paper
Reference implementation: transaction fraud detection
Tier 2 artifacts are reference implementations, available at no cost after institutional identity verification. Tier 1 artifacts, including documentation, protocols, and papers, are open to anyone without registration.