Fraud at sign-up: synthetic identities, money mules and fake accounts

Fraud that starts before the first payment

Much of the fraud counted in the earlier posts in this series needs an account to work. A stolen card needs a merchant account or a wallet to spend from. A scam needs a recipient account to receive the money, and that account needs someone, often a money mule, to pass the money on. Stopping fraud at sign-up removes the account before it can be used.

Three kinds of new-account fraud come up again and again: accounts opened with a stolen identity, accounts opened with a synthetic identity, and accounts opened or lent to move criminal money. A fourth, promotion abuse, is common in consumer apps but is not measured in any official statistics we found, so this post describes it without figures.

Identity fraud in the numbers

Cifas, which runs the UK's National Fraud Database, reported in Fraudscape 2026 (March 2026) that more than 444,000 cases were recorded to the database in 2025. Over 242,000 of them were identity fraud cases, 54% of all fraud-risk cases, and Cifas says almost three quarters (72%) of all cases in 2025 were linked to identity fraud and facility takeover. The same report records more than 106,000 misuse of facility cases, a 43% rise on 2024, and more than 78,000 facility (account) takeover cases.

The trend continued into 2026. In its Fraudscape 2026 6 Month Update, published in August 2026, Cifas reported more than 220,000 fraud-risk cases in the first half of 2026, with identity fraud accounting for 59% of them. It said identity fraud rose 9% to nearly 130,000 cases, and that it has growing concerns about the criminal use of synthetic identities.

UK Finance's Annual Fraud Report 2026 counts a narrower slice: third-party application fraud, where a criminal opens a card account in someone else's name. It reports 21,141 cases and 16.1 million pounds of losses from this in 2025.

Synthetic identities

A stolen identity belongs to a real person, who may notice and complain. A synthetic identity does not. The Federal Reserve's industry-recommended definition, released in April 2021, describes synthetic identity fraud as using a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain.

The Federal Reserve's toolkit lists factors that make these identities easy to create, including frequent data breaches that increase the availability of personal data and limited verification of identities. Because there is no real victim to raise the alarm, a synthetic identity can build a normal-looking history before it is used for fraud.

Checks against a single identity document or a single database are therefore weak against synthetics. What gives them away is usually the network around them: the same device, phone number or address showing up across several new identities, or identities that were all created in a short burst.

Money mules

A money mule receives stolen money and moves it on, sometimes knowingly and sometimes after being recruited with an offer of easy money. In Fraudscape 2026, Cifas reported that over 22,000 cases were recorded in 2025 after it introduced a new money mule filing category, and in its August 2026 update it said cases linked to money muling rose 70% in the first half of 2026 compared with the first half of 2025, to nearly 13,000. Cifas says people under 30 represent a majority (57%) of muling cases.

UK Finance's Intelligence Unit reports that 12,438 money mules were disrupted in 2025. Mule accounts matter to every business that pays money out, because a payout to a mule is how fraud elsewhere turns into cash.

Promotion abuse

Sign-up bonuses, free trials and referral rewards attract a different kind of fraud: one person opening many accounts to collect the same reward many times. It rarely appears in fraud statistics because the losses sit in marketing budgets rather than in payment fraud reports. The signals overlap heavily with synthetic identities: many accounts from the same device, disposable email addresses, sequential or random-looking addresses, and bursts of sign-ups from the same network.

Signals that help at sign-up

No single check stops new-account fraud, but several cheap signals together catch a lot of it. The device: has it been seen before, on how many accounts, and does it show signs of automation such as a headless browser? The email: is the domain disposable, newly created or unable to receive mail? The phone: is the number valid, what type of line is it, and how many identities have used it? The network: does the IP sit in a hosting provider or a country that does not match the rest of the application?

Then look at links and timing. Velocity counts show many sign-ups from one device or IP range within minutes. Links between identities, through a shared device, card or phone, show groups of accounts acting together. And the account's later events matter as much as its first: a new account that quickly receives payments from many unrelated senders, or changes its payout details right before a withdrawal, is worth a closer look.

How FRAPE uses this

FRAPE scores sign-ups as events in their own right, with device recognition, bot and automation hints, email and phone checks worked out locally, and velocity on every identifier. Its identity graph links events that share strong identifiers such as a device, card, email or phone, and its fraud ring detection groups identities that act together, such as accounts created in a coordinated burst.

Rules settle the clear cases, FRAPE Decision Core advises on the uncertain ones, and your policy decides whether to approve, challenge, review or decline the sign-up. Later logins, profile changes and payouts are scored against the same identity, so an account that looked fine at sign-up can still be stopped before it pays out.

• How a FRAPE decision is made
• Identity and fraud ring features
• Device signals