The "Frankenstein" Identity
Synthetic identity fraud isn't traditional identity theft. Attackers combine real data (like a stolen SSN) with fake data (a different name and address) to create a completely new, "synthetic" person. These accounts often lay dormant for months to build credit before being used for "bust-out" fraud.
Cross-Module Correlation as a Shield
A synthetic identity looks real on paper. But it *acts* like a botnet during the creation phase.
Creation-Phase Behavioral Fingerprinting
The Identity Fabric Monitor doesn't just look at the form data. It asks: Was this account created from a known residential proxy network? Did the "user" fill out the 20-field registration form in under 3 seconds? 1-SEC correlates these network-layer anomalies with the identity event.
Dormancy Monitoring
Botnet-managed identities often exhibit "Heartbeat" activity—logging in once a week exactly every 168 hours to maintain the illusion of an active user. 1-SEC's temporal analysis identifies these non-human cadences, flagging thousands of synthetic accounts in a single batch.