Synthetic Identity Fraud Emerges as Threat to Machine Identities

Understanding Synthetic Identity Fraud

Identity theft typically involves an attacker stealing a real person's information to impersonate them. Synthetic identity fraud differs by manufacturing a new identity, combining real data points with fabricated ones to create a non-existent person. This makes it harder to detect because no real victim monitors for misuse, allowing the fake identity to accumulate credibility over time.

Synthetic Fraud for Machine Identities

The principle of synthetic identity fraud has a parallel with Non-Human Identities (NHIs), which are machine-side identities. While security teams focus on protecting NHIs from being stolen, the concept of fabricated NHIs, which were never legitimately provisioned, is rarely discussed. Attackers do not hijack existing service accounts but instead fabricate new ones.

As enterprises accumulate NHIs rapidly, a fabricated one can easily integrate if governance is weak and human ownership is absent. This approach blends real environmental attributes with fake ones, making the fabricated NHI appear legitimate.

How Fabricated Machine Identities Operate

For machine identities, an attacker creates an identity that was never supposed to exist, rather than borrowing a real one. This could involve registering a new admin-level identity with a similar naming structure to legitimate accounts and granting it privileges. Since nothing is hijacked, there are no alerts for compromised users or suspicious behavior to flag.

These fabricated NHIs are convincing because they combine real and invented attributes. They inherit naming conventions, exist in the correct domain, carry plausible metadata, and request permissions similar to other NHIs. To an administrator reviewing a large directory of service accounts, such an identity appears as a routine workload, making it an overlooked risk.