# Synthetic Identity Fraud Leaves US Lenders with $2.4B Exposure; Account Login and Transaction Fraud Dominates (TransUnion)

> TransUnion's 'Fraud in the Age of Continuous Trust' report estimates US lender exposure to synthetic identity fraud at $2.4 billion as of June 30, 2026, with $1.5 billion in auto lending. 81% of suspected digital fraud in H1 2026 targeted existing customer relationships, with account logins and financial transactions the dominant stages.

- **Published:** 2026-10-26T05:13:05Z
- **Last reviewed:** 2026-10-26T05:13:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4429
- **ID:** TL-2026-4429
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 2 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a trend-level fraud intelligence record derived from TransUnion's 'Fraud in the Age of Continuous Trust' report (released 2026-10-22) and secondary coverage. It is not a vulnerability or a named intrusion campaign: the sources state no CVEs, malware families, network indicators or named actors.

The report finds that 81% of suspected digital fraud globally in H1 2026 targeted existing customer relationships. Account logins made up 53% of suspected digital fraud, financial transactions 27.9% and account creations 13.1%, according to secondary coverage of the report. Help Net Security reports that 81% of suspected digital fraud occurred during account logins and financial transactions. Europe saw 88% of suspected digital fraud after account creation, and 94.3% of suspected digital fraud in Africa involved account access.

Synthetic identity fraud blends real and fabricated personal data (including stolen data and AI-generated documents) to create identities that evade traditional checks. US lender exposure is estimated at $2.4 billion at end of June 2026, of which $1.5 billion is in auto lending. 67% of US business leaders expect synthetic identity fraud to increase over the next two years and 53% cite it as the threat they are least prepared to address. A September 2025 TransUnion analysis put 2024 exposure from newly opened accounts at $3.3 billion; the two figures use different measurement bases and should not be compared directly.

Other reported patterns: account takeover that targets secondary authentication; credential theft, phishing and social engineering; impersonation scams posing as banks, insurers and healthcare providers over phone and messaging; and spoofing of trusted channels (nearly 1 in 5 outbound B2C calls with US mobile carriers were spoofed in H1 2026, and 6 in 10 business leaders reported customers victimized by text spoofing). Regional patterns: Canada (stolen credentials and phishing), Europe (post-creation fraud), Latin America (mobile commerce and instant payments), Asia (account compromise and manipulated transfers), and the Philippines and India (scams and authorized fraud). Sectors cited include auto lending, credit cards, buy-now-pay-later, mobile phone accounts, online betting, retail (promotion abuse) and gaming (bonus abuse). Severity is an analyst assignment, not stated in the sources.

## MITRE ATT&CK

- T1589.001 Credentials
- T1598 Phishing for Information
- T1566 Phishing
- T1566.004 Spearphishing Voice
- T1660 Phishing
- T1078 Valid Accounts
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1657 Financial Theft

## Sources

- [Synthetic identities leave US lenders with $2.4 billion in fraud exposure](https://www.helpnetsecurity.com/2026/10/26/transunion-synthetic-identity-fraud-risks-report/)
- [81% of Suspected Digital Fraud Attacks Target Existing Customer Relationships, TransUnion Finds](https://newsroom.transunion.com/81-of-suspected-digital-fraud-attacks-target-existing-customer-relationships-transunion-finds/)
- [TransUnion adds synthetic identity fraud, credit washing risk scores](https://www.biometricupdate.com/202610/transunion-adds-synthetic-identity-fraud-credit-washing-risk-scores)
- [81% of Suspected Digital Fraud Attacks Target Existing Customer Relationships (Yahoo Finance syndication)](https://finance.yahoo.com/technology/ai/articles/81-suspected-digital-fraud-attacks-121700626.html)
- [Synthetic identity fraud exposes US lenders to $3.3B in losses, TransUnion warns](https://cyberinsider.com/synthetic-identity-fraud-exposes-us-lenders-to-3-3b-in-losses-transunion-warns/)
- [TransUnion Synthetic Fraud Model announcement](https://www.transunion.com/blog/synthetic-fraud-model-identifies-instances-of-fraud-before-they-)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4429