Synthetic Identity Theft: How It Works and the CPN Scam Targeting Kids' SSNs
Independently fact-checked against primary sources (last audited August 13, 2026). · 3 primary sources cited on this page. How we verify our legal content
Synthetic identity fraud is different from ordinary identity theft. Instead of taking over an existing person's accounts, a fraudster builds a new identity from scratch: a real Social Security number, usually one belonging to someone unlikely to be watching it, paired with a fabricated name, date of birth, and address. Because no real person named on the new identity exists to notice the fraud, a synthetic identity can quietly build a credit history for months or years before a lender discovers the Social Security number it's attached to actually belongs to someone else entirely.
Information last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer.
This page covers what makes synthetic identity fraud different from ordinary identity theft, why children's and seniors' Social Security numbers are common building blocks, the Credit Privacy Number scam sold as a workaround, and the legal consequences of using one. For general identity theft warning signs and recovery rights, see Identity Theft Laws and How to Report Identity Theft.
How Synthetic Identity Fraud Works
Ordinary identity theft takes over a real person's existing identity: an existing account, an existing credit file, an existing name a victim will eventually recognize as their own. Synthetic identity fraud instead builds something new by combining a genuine Social Security number with a name, date of birth, and address that don't belong to the real person that number was issued to. Because the resulting identity doesn't match any single real person's full profile, there's no one actively watching for the fraud the way a victim of classic identity theft would be.
The financial scale is large and growing. A June 2026 industry report puts a number on it directly:
"Financial impact continues to grow significantly, with U.S. unsecured credit losses reaching ~$2.94 billion in 2025, up from $1.8 billion in 2020." Source: Mitek Systems, citing Datos Insights research (verified 2026-08-13)
That figure reflects unsecured credit losses specifically; it comes from a financial-technology industry report, not a government source, so treat it as a scale-setting estimate rather than an official statistic.
Why Children's and Seniors' Social Security Numbers Are Common Targets
A synthetic identity needs a Social Security number that isn't actively generating credit activity of its own, so the fraud doesn't collide with a real person's existing file. Experian, one of the three national credit bureaus, describes exactly that pattern in the numbers sold as Credit Privacy Numbers:
"CPNs are often SSNs that scam artists have stolen, typically from children, people who are incarcerated or senior citizens." Source: Experian, What Is a CPN or Credit Privacy Number? (verified 2026-08-13)
Each group shares the same underlying weakness: a child's Social Security number typically sits unused for well over a decade with no credit file to flag activity against, an incarcerated person is not actively applying for credit or monitoring their own file, and an elderly person's number may go unmonitored if no one else is checking it on their behalf. See Child Identity Theft for how to check whether a child's Social Security number has already been used to open a file.
The "Credit Privacy Number" (CPN) Scam
A Credit Privacy Number is a nine-digit number formatted to look like a Social Security number. It is not issued by the Social Security Administration or any other government agency, and no government program creates or authorizes one. It is typically marketed by "credit repair" operators as a way to leave a damaged credit history behind and start over with a clean file, sometimes described to a buyer as a legal privacy tool.
It is neither legal nor a privacy tool. Consumer-reporting companies describe most CPNs in circulation as stolen Social Security numbers rather than numbers generated from nothing, drawn disproportionately from the same three groups described above. Entering a CPN in place of your own Social Security number on a credit, loan, or rental application is providing false information to the lender, and the national credit bureaus treat it exactly that way.
The Legal Consequences
Federal law makes the underlying conduct a serious crime independent of any state identity-theft statute. The provision that reaches a CPN directly is 18 U.S.C. §1028(a)(7), which makes it an offense to knowingly transfer, possess, or use, without lawful authority, a "means of identification of another person" with the intent to commit, aid, or abet any federal crime or any state or local felony. Section 1028(d)(7) defines "means of identification" to include a Social Security number by name, which is what a CPN sold as a recycled SSN actually is. Under §1028(b)(2)(B) that offense carries up to 5 years in prison, and under §1028(b)(1)(D) the maximum rises to 15 years where the person committing the offense "obtains anything of value aggregating $1,000 or more during any 1-year period," a threshold a CPN seller running a volume operation, or a buyer who uses one to obtain a loan, can cross without difficulty.
The document-based paragraphs of §1028 are a poor fit for a bare number. Section 1028(d)(3) and (d)(4) define an "identification document" and a "false identification document" as documents that are or appear to be issued by or under the authority of a government, so a nine-digit number sold on a slip of paper or emailed to a buyer generally is not one. Those paragraphs matter when a CPN operation also manufactures counterfeit credentials to go with the number: §1028(b)(1)(A) sets a 15-year maximum for producing or transferring a document that is or appears to be a birth certificate, driver's license, or personal identification card, with no quantity threshold at all, and §1028(b)(1)(B) sets the same 15-year maximum for producing or transferring more than five such documents. Possessing five or more identification documents with intent to use or transfer them unlawfully is a separate offense under §1028(a)(3), punishable by up to 5 years. A single buyer using one CPN can also face identity-theft or false-statement charges depending on the specific facts.
IdentityTheft.gov, the FTC's own consumer site, carries a standing warning that applies here too:
"It is illegal to knowingly file a false identity theft report with the Federal Trade Commission. Filing a false report may result in a fine, imprisonment, or both." Source: IdentityTheft.gov (verified 2026-08-13)
A Related, Verified FTC Warning: "Credit Sweep" False Reports
CPN schemes aren't the only "credit repair" trick the FTC has flagged recently. In January 2026, the agency issued a dated consumer alert about a different but related scam circulating on social media:
"Some online influencers are telling people they have a fix: file a false identity theft report about a debt they owe. That's advice not to take. Filing a false identity theft report may leave you worse off, and it's a crime that could get you a fine, imprisonment, or both." Source: FTC Consumer Alert, "Influencers are pushing an illegal trick to 'fix' your credit report," Jan. 5, 2026 (verified 2026-08-13)
The FTC is explicit about why this doesn't work even when it isn't caught: "The truth is, credit repair companies can't legally remove information from your credit report if it's accurate and current." Both schemes sell the same underlying promise, a clean credit file without the years it normally takes to earn one, and both are illegal rather than merely risky.
Related Resources
- Identity Theft Laws covers victim rights, warning signs, and the federal identity theft statute generally.
- How to Report Identity Theft covers filing an FTC Identity Theft Report and the FCRA blocking process.
- Credit Freeze vs. Fraud Alert covers the free federal tool that can stop a new account, synthetic or otherwise, from being opened against your own Social Security number.
- Child Identity Theft covers how to check whether a child's Social Security number, a common synthetic-identity building block, has already been misused.
- Medical Identity Theft covers a related misuse of a stolen identity in a health care setting.
- What To Do After a Data Breach covers the response checklist if a breach exposed the Social Security number a synthetic identity could be built from.
Disclaimer
This article provides general information about synthetic identity fraud and the Credit Privacy Number scam. It is not legal advice and does not create an attorney-client relationship. Industry loss estimates and scheme details change over time; confirm current figures with the cited sources before relying on anything here.
Last updated: 2026-08-13.
Frequently Asked Questions
What is synthetic identity theft?
Fraud that combines a real Social Security number, often one belonging to someone unlikely to be monitoring it, with a fabricated name, date of birth, and address to build an entirely new credit identity, rather than taking over an existing person's accounts.
Is a Credit Privacy Number (CPN) legal?
No. A CPN is not issued by any government agency, and using one in place of your Social Security number on a credit or loan application is providing false information, which the national credit bureaus treat as fraud. Most CPNs in circulation are stolen Social Security numbers.
Why do identity thieves target children's Social Security numbers?
A child's Social Security number typically goes unused for well over a decade, with no credit file to flag suspicious activity against, making misuse far less likely to be caught quickly than fraud on an adult's active file.
How much does synthetic identity fraud cost in the US?
Industry research from Datos Insights, cited by Mitek Systems, put US unsecured credit losses tied to synthetic identity fraud at roughly $2.94 billion in 2025, up from $1.8 billion in 2020. This is an industry estimate, not an official government figure.
Is filing a false identity theft report a crime?
Yes. IdentityTheft.gov states directly that knowingly filing a false report can result in a fine, imprisonment, or both. The FTC issued a January 2026 consumer alert specifically warning about social-media influencers pushing this as a fake 'fix' for real debt.
How can I tell if my child's Social Security number has been used to build a synthetic identity?
Contact Equifax, Experian, and TransUnion to check whether a credit file exists under your child's Social Security number. A child's file should normally be blank; any file at all is worth investigating. See Child Identity Theft for the full process.
Updates
Corrected the federal-law section to identify 18 U.S.C. 1028(a)(7), the means-of-identification provision that actually covers Credit Privacy Number schemes, and to state its 5-year and 15-year penalty tiers accurately.
Independently fact-checked against the cited primary sources
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
United States Code Title 18
§ 1028Fraud and related activity in connection with identification documents, authentication features, and informationIn forcecited in 17 of our articles
Whoever, in a circumstance described in subsection (c) of this section— knowingly and without lawful authority produces an identification document, authentication feature, or a false identification document; knowingly transfers an identification document, authentication feature, or a false identification document knowing that such document or feature was stolen or produced without lawful authority; knowingly possesses with intent to use unlawfully or transfer unlawfully five or more identification documents (other than those issued lawfully for the use of the possessor), authentication features, or false identification documents; knowingly possesses an identification document (other than one issued lawfully for the use of the possessor), authentication feature, or a false identification document, with the intent such document or feature be used to defraud the United States; knowingly produces, transfers, or possesses a document-making implement or authentication feature with the intent such document-making implement or authentication feature will be used in the production of a false identification document or another document-making implement or authentication feature which will…
Official text (excerpt) · last checked 2026-09-02 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 1,360 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):United States v. Christensen (2016) affirmed Section 1028(a)(7) identity-theft convictions after the CFAA predicates were set aside, holding intent to violate California Penal Code 502 was a valid alternative predicate. United States v. Campa (2008) upheld a 1028(a)(3) conviction on constructive possession of counterfeit documents.
Opinions citing this section in our collection:
- Flores-Figueroa v. United States (Supreme Court of the United States 2009, 556 U.S. 646)“…tion documents, authentica tion features, and information.” 18 U. S. C. §1028. The title of another provision (the pro…”
- United States v. George Lloyd Pregent (Court of Appeals for the Fourth Circuit 1999, 190 F.3d 279)“…zed United States identification documents in violation of 18 U.S.C.A. § 1028 (a)(1) (West Supp.1999), knowingly prod…”
- United States v. Lesmarge Valnor (Court of Appeals for the Eleventh Circuit 2006, 451 F.3d 744)✓Valnor charged $400 to $500 a head to have a Florida DMV examiner issue fraudulent driver's licenses; the Eleventh Circuit affirmed a sentence above the advisory range for his Section 1028(f) conspiracy, noting it fell far below Section 1028(b)(1)(A)'s 15-year maximum.
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Indiana Identity Theft Laws, Identity Theft Laws: Federal Rules and State Penalties, Alabama Identity Theft Laws: Statute, Reporting, and Your Rights
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- FTC Consumer Alert, Influencers are pushing an illegal trick to 'fix' your credit report (Jan. 5, 2026)(consumer.ftc.gov).gov
- 18 U.S.C. §1028, Fraud and related activity in connection with identification documents(law.cornell.edu)
- IdentityTheft.gov, homepage (false identity theft report warning)(identitytheft.gov).gov
- Experian, What Is a CPN or Credit Privacy Number?(experian.com)
- Mitek Systems, Mitek and Datos Insights Report Finds Synthetic Identity Fraud Is Emerging as the Defining Fraud Threat of 2026(miteksystems.com)
- FTC, How To Protect Your Child's Identity(consumer.ftc.gov).gov
- 18 U.S.C. §1028, Fraud and related activity in connection with identification documents (official U.S. Code text, govinfo)(govinfo.gov)