The hidden cost of synthetic identity fraud

UK fraud losses reached £1.17 billion in 2024, with more than 3.3 million confirmed fraud cases. Identity fraud continues to accelerate, driven by synthetic identities, AI-assisted scams, and increasingly sophisticated payment fraud. As reimbursement rules tighten, financial institutions are facing a new reality: fraud is no longer just a security problem; it is becoming a direct financial liability.

Generative AI is making synthetic identities easier and cheaper to create, allowing fraudsters to combine authentic personal information with fabricated addresses and identities at unprecedented scale. Authorised push payment (APP) fraud alone accounted for £450.7 million of UK losses in 2024, while government-linked fraud reporting recorded a record 421,000 identity fraud cases during the same period. The fastest-growing category was false identity fraud, which increased by 60% year over year and now accounts for nearly one-third of all identity fraud cases.

While the UK’s reimbursement rules are specific to its regulatory environment, the underlying drivers – AI-enabled fraud, digital onboarding, instant payments, and synthetic identities – are affecting financial institutions worldwide, including Australia. What’s changed in the UK is that regulators have made the cost of inaction explicit. A mandatory reimbursement scheme puts a defined liability, capped at £85,000 per claim, on the banks that move fraudulent payments, split between the sending and receiving institution. That is a line item now, not a hypothetical, and it is a preview of where fraud prevention and AML accountability are heading in other markets.

Where the Finance Function’s Exposure Actually Sits

Most fraud prevention and KYC budgets are built around two layers: document verification at onboarding and biometric checks to catch deepfakes and presentation attacks. Both matter, and both are becoming more sophisticated as AI-generated fraud grows harder to detect. But there is a quieter layer underneath both that finance teams often underweight: the accuracy of the address data attached to every application, invoice, and payment instruction.

Synthetic identity fraud works precisely because it blends one real credential, commonly a genuine national identifier, with fabricated supporting details. Unlike names or identity documents, addresses must correspond to real-world locations. Verifying that an address is valid, deliverable, and consistent with identity records provides an additional layer of trust that synthetic identities often fail to satisfy. Most onboarding and fraud detection systems check whether an address looks plausible rather than whether it actually exists, which is exactly the gap synthetic identities are built to exploit.

That gap has a direct cost attached to it for finance leaders, not just a compliance one. Every synthetic identity that clears onboarding becomes a credit risk, a reimbursement liability, and, in many cases, a remediation cost once the account is flagged and unwound. None of that appears as a fraud loss on day one. It shows up months later – compounded.

Invoice and mandate fraud carry a similar blind spot. Business email compromise (BEC) scams that redirect payment instructions frequently rely on a plausible-looking but incorrect billing or remittance address to move funds to a criminally controlled account before anyone notices the mismatch. High-profile BEC incidents have resulted in losses exceeding £20 million after organisations acted on fraudulent payment instructions. Address verification at the point where payment instructions change, not just during onboarding, can help identify these inconsistencies before funds are transferred.

Why This Belongs on the CFO’s Desk, Not Just Risk and Compliance

Fraud prevention has traditionally been viewed as the responsibility of risk, compliance, or cybersecurity teams. However, reimbursement mandates and increasing regulatory accountability mean the financial consequences ultimately land on the CFO’s desk. When a reimbursement claim lands, it becomes a direct cost. When a synthetic identity account defaults after building a credit history over several months, it becomes a bad debt write-off that finance must explain. When an invoice fraud payment leaves the business, it is cash that may never be recovered.

For finance teams building the business case for stronger fraud controls, the conversation that resonates with boards is rarely about simply “reducing fraud.” It is about avoiding measurable financial liabilities: reimbursement exposure, remediation costs that increase the longer fraudulent accounts remain active, and the reputational damage that follows a public payment fraud incident.

What This Looks Like in Practise

Closing this gap does not require replacing an existing fraud prevention or AML stack. Instead, finance teams should validate address data at key points throughout the customer lifecycle:

• When a customer or account is created
• Whenever payment or remittance details change
• Periodically for dormant or high-risk accounts

In each case, the same questions should be asked:

• Does the address exist?
• Is it correctly formatted using authoritative postal reference data?
• Is it consistent with the other identity or payment information on file?

Address validation is a fast, low-friction control compared with document review or biometric verification, making it one of the most cost-effective additions to an organisation’s fraud prevention strategy. It is particularly valuable for detecting synthetic identities, which often establish a seemingly legitimate credit history over months before being used for fraudulent withdrawals or defaults. Periodic address verification helps identify these risks before they become financial losses.

Address verification solutions such as Melissa’s help organisations validate addresses in real time during onboarding and whenever payment details change. By ensuring address data is accurate, standardised, and deliverable, finance, fraud, and compliance teams gain greater confidence in the customer information used to support payment and identity decisions.

As fraud becomes more sophisticated and more expensive, trusted address data is no longer just an operational requirement. It is an increasingly important financial control.

Learn more about Melissa UK Address Verification.