Synthetic or stolen: which identity is your fake candidate using?

One of the questions that brings people to our site is "why are my fraud detection systems missing synthetic identities?" Usually the answer is that the system was built to catch the other kind. Most hiring teams I talk to don't say "synthetic identity" at all. They say "fake candidate," and they treat every fake candidate as the same problem.

For context: synthetic identity fraud in hiring means applying as a person who doesn't exist, built from invented details or a mix of real and fake ones. A stolen identity belongs to a real person, used without their knowledge. Both produce a fake candidate, and they leave different evidence: a synthetic identity has too little history, and a stolen one has history that doesn't fit the person on the call.

What is synthetic identity fraud in hiring?

A synthetic identity is a made-up person. Sometimes every detail is invented: a name, a work history, a headshot, an email address, a phone number. More often it's stitched together, with a real Social Security number or address underneath invented details on top.

The Justice Department described this in its June 2025 actions against North Korean IT worker schemes. Two defendants hid who they were by "providing false identification documents containing a mix of stolen and fraudulent identity information" (DOJ, June 30, 2025). Researchers at Palo Alto Networks' Unit 42 described the same pattern as "synthetic identities supported by compromised personal information" (Unit 42, April 2025).

For a recruiter, the thing to look at is how much sits behind the resume. A synthetic person can look complete on paper and have almost no history anywhere else.

How is a stolen identity different?

A stolen identity is a real person's name and paperwork in the hands of someone else. The real person usually has no idea. Their degree is real and their past employers will confirm they worked there. Their record is clean, because they did nothing wrong.

One case gives a sense of scale. According to the Justice Department's June 30, 2025 release, one indictment alleges that from 2021 to October 2024 the defendants "compromised the identities of more than 80 U.S. persons to obtain remote jobs at more than 100 U.S. companies," causing at least $3 million in losses. Those are allegations in an indictment, and the defendants are presumed innocent. Do the sum anyway: more companies than identities means some of those identities were very likely hired more than once.

There's also a third version, where the real person is in on it. They rent out their name and documents for a cut of the salary. We wrote about it in the collaborator model. From the outside it looks like a stolen identity, with one difference: the real person might pick up the phone when you call.

Why does the difference matter for your checks?

Synthetic and stolen identities each get past a different check, and a process tuned for one tends to wave the other through.

"But we run background checks," you might say. Most teams do. A background check verifies records about an identity. With a stolen identity, those records belong to a real, clean person, so the check passes. With a synthetic identity, the check might come back thin or flag a mismatch, but it usually runs after the offer, after your team has spent weeks of interviews on someone who doesn't exist. (We made the longer version of this case in why background check companies aren't built to catch fake candidates.)

Document checks have the same blind spot. They catch a crude forgery, and a real passport carried by the wrong person goes through. Same with reference calls: the real former employer picks up and confirms that the person worked there, and none of that tells you who is on your video call.

What signals point to a synthetic identity?

A synthetic identity usually breaks down when you look for its past, so these are the signs I'd check:

• A thin or recent online trail. A LinkedIn profile created in the last year, few connections, no posts, and nothing else under that name. The cheapest test is free, and it's the first thing I do: put the candidate's email address in quotes into a search engine. A real mid-career engineer usually turns up somewhere, on a conference attendee list or in an old GitHub commit.
• Employers and schools you can't confirm. The FBI tells companies to "verify prior employment and higher education history directly with businesses and educational institutions" (FBI public service announcement, July 2025). A company with no website, no address, no employees on LinkedIn, and a phone number that goes to voicemail is a reason to look harder.
• Contact details with no past. A brand-new email address and an internet (VoIP) phone number aren't proof of anything, since plenty of real people use both. On an identity with no other history, they add up.
• A headshot that doesn't show up anywhere else. Or one that looks a little too smooth. AI-generated faces are cheap now.
• A resume that mirrors the job description. Every requirement, in the same order, with the same words.

Any one of these has an innocent explanation. People change careers, delete old accounts, and work for small companies that never built a website. Some people just hate LinkedIn (fair). Three or four signals together on one applicant are what should slow you down.

What signals point to a stolen identity?

With a stolen identity the history is real, so the question is whether it belongs to the person applying:

• Contact details newer than the person. Fifteen years of work history attached to an email address created last month, or a phone number that doesn't match anywhere the person has lived.
• Location that doesn't match the identity. The identity lives in Ohio and the candidate's IP address or time zone points somewhere else. Shipping is the easy one to check: the FBI's July 2025 notice says to ship equipment "only" to the address on the employee's identification documents.
• A face or voice that doesn't match. The FBI recommends cross-referencing photographs and contact information "with social media profiles, portfolio websites, and payment platforms." If the person on the call doesn't look like the person in five years of conference photos, write it down.
• The same identity in more than one place. Given the DOJ's 80 identities at 100 companies, a stolen identity is worth reusing. The same Social Security number or phone number showing up across several applications is a strong signal, and it's invisible to a recruiter looking at one candidate at a time.

What about identities that are both?

The June 2025 DOJ release describes both in the same breath: workers "using stolen and fake identities," and documents that blended the two. A mixed identity might be a real Social Security number under an invented name, or stolen documents paired with a made-up work history. A mixed identity sets off one or two signals from each list, never enough on either side to look obvious, which is the whole point of mixing.

So don't decide in advance which kind you're looking for. Run both sets of checks on every applicant and let the evidence tell you which story fits. Your hiring checks verify documents, not people goes deeper on why the "is this a real, specific person?" question beats the "is this document authentic?" one.

How do you detect synthetic identities in hiring at scale?

Detecting synthetic identities at scale is mostly beyond what a recruiter can do by hand. Say a role gets 400 applicants and a recruiter spends five minutes on each running the checks above. Those 2,000 minutes come to about 33 hours. Per role. And they still miss identity reuse, because one recruiter can't see other companies' applicants.

Tofu builds candidate fraud detection for hiring and security teams, and our resume fraud detection runs these checks on every applicant. It enriches each candidate profile against more than 4 billion internet data points and surfaces discrepancies across employment history, contact information, credentials, IP address, and more. Every applicant gets a label inside your ATS, with the verification details added to the profile notes, and your team makes the call.

One number I'd like and don't have: how the split between synthetic and stolen falls. The DOJ cases count identities, not types, and nobody I've found has broken hiring fraud down that way. If you have that split, I'd like to see it.