Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn't exist. Since no real victim monitors misuse, a fake identity can silently accumulate permissions and credibility over time before it's ever detected. This same principle has a largely unexplored parallel with Non-Human Identities (NHIs).
Security teams are spending significant effort to protect NHIs from being stolen. Still, the machine-side equivalent of synthetic identity fraud is rarely discussed: identities that were never legitimately provisioned from the start. Following this approach, an attacker doesn't hijack an existing service account but instead fabricates one, blending real environmental attributes with fake ones so it appears to belong. As enterprises accumulate NHIs faster than they can track them, a fabricated one may slip into the mix with ease if governance is weak and there's no human ownership.
What synthetic identity fraud looks like for machine identities
