Identity theft is the use of someone else's personal information, without their consent, to open accounts or complete transactions under a false identity. It matters to AML compliance because a stolen identity is often the fastest way for a launderer or fraudster to get past onboarding checks that would otherwise flag them.
How does identity theft undermine AML controls?
Customer due diligence assumes the identity being verified belongs to the person presenting it. When that identity has been stolen, a business can complete every step of its onboarding process correctly and still end up dealing with someone entirely different from who its records say. That gap is exactly what identity theft is designed to exploit.
Is synthetic identity fraud the same thing?
Not quite, and the distinction matters operationally. Classic identity theft uses a real victim's genuine details end-to-end. Synthetic identity fraud blends real and fabricated data — a real, sometimes stolen, government identifier combined with a fabricated name, date of birth, or address — to create an identity that doesn't correspond to any actual living person. That makes it harder to catch with a simple "does this person exist" check, since parts of the identity genuinely do exist; it's the combination that's fabricated. Synthetic identities are also harder for a victim to notice and report, since there's often no single real person whose life is being disrupted, which lets a synthetic identity build a plausible transaction history undetected for longer than stolen-identity fraud typically survives.
How is identity theft detected during onboarding?
Identity verification combines document authentication, biometric liveness checks, and data verification against independent sources — checking not just whether a document looks genuine, but whether the person presenting it is demonstrably the same person the document describes. Document authentication checks the physical and digital security features of an ID — the machine-readable zone, embedded chip data on modern passports and some driving licences, hologram and font consistency — that are difficult to reproduce convincingly. Biometric liveness goes a step further, using techniques like depth mapping and challenge-response prompts (asking the user to blink, turn their head, or follow an on-screen instruction in real time) to confirm a live person is present, not a photo, video replay, or increasingly, an AI-generated deepfake. Biometric liveness in particular is much harder to fake convincingly than a stolen or forged document on its own, which is why it's become standard rather than optional for higher-risk onboarding.
What should happen if identity theft is suspected?
It should be treated as a due diligence failure rather than a one-off fraud incident: decline or escalate the application, document the reasoning, and record the identity details involved so the same stolen identity doesn't succeed in a future attempt with a different account or provider. Whitelisting and due diligence decisions exist for exactly this kind of record-keeping.
Is identity theft only a fraud risk, or an AML risk too?
Both. It's a fraud risk to the business or individual whose identity was stolen, and an AML risk to any organisation whose onboarding it bypasses — a stolen identity used to open an account is a route into the financial system that standard KYC is meant to close.
