TL;DR: new account fraud in 2026
- Three shapes: synthetic identity (fabricated), stolen identity (real victim), and bonus or trial abuse (disposable email).
- The detection stack: device fingerprint continuity, email and phone reputation, behavioral velocity, cross-account correlation.
- Catching it at signup is far cheaper than remediating it later. Post-signup you are paying in chargebacks and reputation.
What is new account fraud?
New account fraud (NAF) occurs when a fraudster opens a new account using a fabricated, stolen, or disposable identity rather than compromising an existing one. It is distinct from account takeover (ATO): ATO attacks an established account after the fact, while NAF attacks the registration itself. The detection window is different, which means the signals that matter are in the registration interaction, not in post-login behavior.
The term is used by fraud analysts, financial institutions, and payments companies as the umbrella category for three distinct attack patterns.
The three types of new account fraud
| Type | Identity used | Primary targets | Primary goal |
|---|---|---|---|
| Synthetic identity fraud | Fabricated or real+fabricated blend | Banks, lenders, fintech | Build credit, then bust out |
| Genuine identity manipulation | Real stolen identity | Any financial product requiring KYC | Extract value under victim's name |
| Fake account creation | Disposable or generated contact details | SaaS, gaming, e-commerce, fintech | Bonus abuse, trial access, multi-accounting |
Synthetic identity fraud
Synthetic identity fraud constructs a new identity rather than stealing an existing one. A common method pairs a real Social Security number, often belonging to a child or a person with limited credit history, with a fabricated name, date of birth, and address. The resulting identity can pass many standard verification checks because one element is real.
After opening an account, synthetic identity fraudsters typically build a payment history over months, steadily increasing credit limits. At the point of maximum available credit, they execute a "bust-out": withdrawing all available credit and abandoning the account. The Federal Reserve Bank of New York identified synthetic identity fraud as one of the fastest-growing forms of financial crime in the US payment system in research that has become the standard reference for the lending industry. Losses are concentrated in unsecured consumer credit, but the attack has spread to any financial product that relies on identity verification at onboarding.
Genuine identity manipulation
Genuine identity manipulation uses a complete, real identity, obtained through a data breach, phishing campaign, or the dark web, to open new accounts under the victim's name without their knowledge. The victim discovers the fraud when a statement arrives, when a credit check flags new accounts, or when collections activity begins on debt they did not incur.
The detection challenge here is that the identity itself is legitimate. Standard verification controls, credit bureau checks, knowledge-based authentication questions, may pass because the fraudster presents accurate information about the real person. Detection must come from signals outside the identity data: device behavior, registration interaction patterns, and email infrastructure signals that do not match the history of the real person whose identity is being used.
Fake account creation
Fake account creation uses disposable or generated contact details, throwaway email addresses, temporary phone numbers, synthetic personal information, to open accounts for the sole purpose of extracting platform value. The goals vary: sign-up bonuses, free trial periods, referral rewards, or multi-account advantages in gaming. The account is not built to look like a real user over time; it is created and used within a short window.
Organized fake account creation operates at scale. A single operator can create hundreds of fake accounts in hours by combining automation frameworks, anti-detect browsers, and residential proxy networks. Each tool in the stack defeats a specific detection layer: the anti-detect browser rotates device fingerprints so each registration appears to come from a different device; the residential proxy rotates IP addresses so each registration appears to come from a different household connection; the automation framework injects mouse and keyboard behavior patterns so the interaction appears human at the form level.
Where traditional registration controls fall short
Standard registration security relies on three signal categories: email verification, phone verification, and IP reputation. Each covers one vector of the attack.
Email verification confirms that a mailbox can receive messages. It does not confirm the registrant is human, that the domain belongs to a real business, or that the mailbox is not temporary. Novel disposable email infrastructure, domains registered within the past week, provisioned for a fraud campaign, passes domain blocklist checks because blocklists cover known providers, not new ones.
Phone verification via SMS OTP confirms that a SIM can receive messages. It does not confirm the SIM belongs to the registrant. Temporary phone number APIs that provision a number, receive a verification code, and discard the number afterward are commercially available and defeat SMS OTP at the account-creation layer.
IP reputation checks flag known VPN endpoints and data center ranges. Residential proxy networks route traffic through legitimate residential connections, so registrations from a residential proxy look indistinguishable from a real consumer on a home broadband connection.
The gap is the browser itself. None of these three controls see what is happening in the browser at the moment of registration. An attacker who uses a novel disposable email domain, routes through a residential proxy, and presents a clean device fingerprint from an anti-detect browser passes all three signal categories simultaneously. The registration looks clean.
What browser-layer detection adds
Browser-layer detection runs in the registration interaction itself, before the identity signals are submitted. It observes the browser execution environment, where anti-detect tooling and automation frameworks operate, rather than the identity data those tools are presenting.
The signals available at this layer exist independently of the identifiers fraudsters rotate:
- Execution context signals: anti-detect browser tooling leaves traces in the JavaScript execution environment that are detectable even when its spoofing of individual fingerprinting APIs succeeds. The tool occupies the execution environment in ways genuine browsers do not.
- Behavioral signals: interaction timing, mouse trajectory patterns, and form-fill cadence distinguish scripted behavior from genuine human interaction, even when scripting has been tuned to mimic human patterns.
- Cross-session device consistency: correlating device signals across registration sessions from the same infrastructure identifies coordinated campaigns even when each individual registration appears independent.
Signup Shield deploys as a single first-party JavaScript snippet at registration. No proxy, no DNS changes, it runs in the live registration page in real visitors' browsers. It produces a session-level trust verdict before account creation completes, giving fraud and growth teams the option to block, flag, or step up on a suspicious registration before the account exists.
For a deeper look at the specific techniques attackers use and the controls that stop fake account creation at each layer, see how to prevent fake account creation. For multi-account fraud specifically in fintech and SaaS, including device fingerprinting and email domain intelligence applied to existing account populations, see multi-account fraud detection.
