Fake accounts versus synthetic identities: choose the right checks

Explore checkers, demos and evaluation routes →

title: Fake accounts versus synthetic identities: choose the right checks author: Theo Lambert updated: 2026-10-21 primary_keyword: synthetic identity fraud

Fake-account detection asks whether an account is being created or used deceptively or in violation of a service’s rules. Synthetic-identity detection asks whether the presented identity has been constructed from invented or combined attributes. The two can overlap, but they require different evidence. Device continuity alone does not verify a civil identity, and an identity document alone does not establish account eligibility.

Name the assurance question first

A service can encounter several distinct situations: a real person claiming another trial, an automated account with invented profile details, an account using someone else’s identity, or a constructed identity built to appear established. Treating these as one “fake user” category makes the review harder and often adds the wrong friction.

Ask what the next decision requires. A forum may need to contain coordinated spam. A marketplace may need to investigate related sellers before they publish listings. A high-assurance onboarding workflow may require verified identity attributes in addition to passive technical evidence.

Those needs can coexist in one product. Specify them separately so the chosen checks return useful answers rather than a single confidence number with an unclear meaning.

Distinguish the evidence layers

Keep the source and time of each observation. A browser session, verified email, document review and analyst conclusion are not interchangeable. If an integration compresses them into one score, the surrounding record should retain enough detail for investigation and correction.

Do not confuse account linking with unique-person proof

An identifier can connect recurring technical activity. That is useful when a person changes names, inboxes or connections. It is not automatically a statement that every account in the group belongs to one individual.

Shared computers, family tablets, business equipment and managed workstations are legitimate counterexamples. The reverse also matters: one operator can use several devices. A system that only groups by identical device IDs may miss a coordinated group with separate environments.

Review the number and independence of supporting observations. Several attributes derived from the same network lookup do not necessarily create several independent pieces of evidence. Ask which observations could change the relationship assessment and which establish the prohibited action itself.

Use step-up checks for a defined purpose

Additional verification should answer a specific unresolved question. If the concern is repeated promotional eligibility, a document check for every newcomer may add cost without establishing whether the offer was already claimed. If identity assurance is required, a device score alone may leave that question unanswered.

Define what a completed check changes. Does it allow account creation, enable a seller privilege, resolve an investigation or simply add evidence? Record which response follows success, failure, abandonment or technical error. A user who cannot complete a step should have a clear route to recovery where the product permits one.

This is a workflow design distinction, not a universal recommendation to use or avoid document verification. Choose the required assurance with the team responsible for that product decision and its applicable obligations.

Compare products at the right boundary

Verisoul combines passive fake-user and duplicate-account evidence with optional verification steps. A selfie should not be described as mandatory for every passive account relationship.

Sardine explicitly covers onboarding, device relationships and fake or synthetic accounts. Its device, identity and broader risk modules should be specified in the proposed scope. A general platform demonstration does not establish which checks are included in a price.

SEON combines device context with email, phone and other enrichment. Fingerprint provides identity and event evidence that an application associates with accounts. Their outputs answer overlapping but different parts of the assurance task.

Test the distinction with known cases

Build an evaluation set that separates automation, repeat eligibility abuse and identity-assurance outcomes. A single binary label can hide a product that catches bots but misses human-operated repeated registrations, or verifies documents while leaving referral farming untouched.

Keep uncertain cases explicitly uncertain. A real purchase is not proof that an identity is genuine. A new identity with little history is not proof that it is synthetic. Review the evidence source and correction process, especially when findings affect later account privileges.

Read the false-positive guide for a review sample that does not assume the detector’s own result is the ground truth.

Where ShieldLabs fits

ShieldLabs supplies live device and network intelligence, linked identity context and risk results for visitors, users, devices and IPs. Ready-made High-Risk Events include multi-accounting, account sharing, impossible travel and account takeover. It helps investigate account abuse alongside the product’s chosen identity-assurance workflow.

The ShieldLabs review describes the result and access. The main comparison separates dedicated identity layers, enrichment, account protection and adaptive challenges.

FAQ

Sources

• OWASP Automated Threats: automated account-creation terminology.
• Sardine identity-fraud product: device, behavior and identity workflow scope.
• Verisoul account linking: passive account relationships.
• ShieldLabs platform: identity context, risk and account-abuse events.