Synthetic Identity Theft: How It Works and the CPN Scam Targeting Kids' SSNs

Synthetic identity fraud is different from ordinary identity theft. Instead of taking over an existing person's accounts, a fraudster builds a new identity from scratch: a real Social Security number, usually one belonging to someone unlikely to be watching it, paired with a fabricated name, date of birth, and address. Because no real person named on the new identity exists to notice the fraud, a synthetic identity can quietly build a credit history for months or years before a lender discovers the Social Security number it's attached to actually belongs to someone else entirely.

Information last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer.

This page covers what makes synthetic identity fraud different from ordinary identity theft, why children's and seniors' Social Security numbers are common building blocks, the Credit Privacy Number scam sold as a workaround, and the legal consequences of using one. For general identity theft warning signs and recovery rights, see Identity Theft Laws and How to Report Identity Theft.

How Synthetic Identity Fraud Works

Ordinary identity theft takes over a real person's existing identity: an existing account, an existing credit file, an existing name a victim will eventually recognize as their own. Synthetic identity fraud instead builds something new by combining a genuine Social Security number with a name, date of birth, and address that don't belong to the real person that number was issued to. Because the resulting identity doesn't match any single real person's full profile, there's no one actively watching for the fraud the way a victim of classic identity theft would be.

The financial scale is large and growing. A June 2026 industry report puts a number on it directly:

"Financial impact continues to grow significantly, with U.S. unsecured credit losses reaching ~$2.94 billion in 2025, up from $1.8 billion in 2020." Source: Mitek Systems, citing Datos Insights research (verified 2026-08-13)

That figure reflects unsecured credit losses specifically; it comes from a financial-technology industry report, not a government source, so treat it as a scale-setting estimate rather than an official statistic.

Why Children's and Seniors' Social Security Numbers Are Common Targets

A synthetic identity needs a Social Security number that isn't actively generating credit activity of its own, so the fraud doesn't collide with a real person's existing file. Experian, one of the three national credit bureaus, describes exactly that pattern in the numbers sold as Credit Privacy Numbers:

"CPNs are often SSNs that scam artists have stolen, typically from children, people who are incarcerated or senior citizens." Source: Experian, What Is a CPN or Credit Privacy Number? (verified 2026-08-13)

Each group shares the same underlying weakness: a child's Social Security number typically sits unused for well over a decade with no credit file to flag activity against, an incarcerated person is not actively applying for credit or monitoring their own file, and an elderly person's number may go unmonitored if no one else is checking it on their behalf. See Child Identity Theft for how to check whether a child's Social Security number has already been used to open a file.

The "Credit Privacy Number" (CPN) Scam

A Credit Privacy Number is a nine-digit number formatted to look like a Social Security number. It is not issued by the Social Security Administration or any other government agency, and no government program creates or authorizes one. It is typically marketed by "credit repair" operators as a way to leave a damaged credit history behind and start over with a clean file, sometimes described to a buyer as a legal privacy tool.

It is neither legal nor a privacy tool. Consumer-reporting companies describe most CPNs in circulation as stolen Social Security numbers rather than numbers generated from nothing, drawn disproportionately from the same three groups described above. Entering a CPN in place of your own Social Security number on a credit, loan, or rental application is providing false information to the lender, and the national credit bureaus treat it exactly that way.

The Legal Consequences

Federal law makes the underlying conduct a serious crime independent of any state identity-theft statute. Under 18 U.S.C. §1028(a)(3), possessing five or more identification documents or authentication features with intent to use or transfer them unlawfully is a federal offense carrying up to 5 years in prison. Producing or transferring five or more false identification documents, a closely related offense under §1028(a)(1) and (a)(2), carries a substantially higher penalty of up to 15 years, and is the charge more likely to apply to an operation manufacturing or distributing CPNs at scale rather than to someone merely possessing them. A single buyer using one CPN can also face identity-theft or false-statement charges depending on the specific facts.

IdentityTheft.gov, the FTC's own consumer site, carries a standing warning that applies here too:

"It is illegal to knowingly file a false identity theft report with the Federal Trade Commission. Filing a false report may result in a fine, imprisonment, or both." Source: IdentityTheft.gov (verified 2026-08-13)

A Related, Verified FTC Warning: "Credit Sweep" False Reports

CPN schemes aren't the only "credit repair" trick the FTC has flagged recently. In January 2026, the agency issued a dated consumer alert about a different but related scam circulating on social media:

"Some online influencers are telling people they have a fix: file a false identity theft report about a debt they owe. That's advice not to take. Filing a false identity theft report may leave you worse off, and it's a crime that could get you a fine, imprisonment, or both." Source: FTC Consumer Alert, "Influencers are pushing an illegal trick to 'fix' your credit report," Jan. 5, 2026 (verified 2026-08-13)

The FTC is explicit about why this doesn't work even when it isn't caught: "The truth is, credit repair companies can't legally remove information from your credit report if it's accurate and current." Both schemes sell the same underlying promise, a clean credit file without the years it normally takes to earn one, and both are illegal rather than merely risky.

Related Resources

• Identity Theft Laws covers victim rights, warning signs, and the federal identity theft statute generally.
• How to Report Identity Theft covers filing an FTC Identity Theft Report and the FCRA blocking process.
• Credit Freeze vs. Fraud Alert covers the free federal tool that can stop a new account, synthetic or otherwise, from being opened against your own Social Security number.
• Child Identity Theft covers how to check whether a child's Social Security number, a common synthetic-identity building block, has already been misused.
• Medical Identity Theft covers a related misuse of a stolen identity in a health care setting.
• What To Do After a Data Breach covers the response checklist if a breach exposed the Social Security number a synthetic identity could be built from.

Disclaimer

This article provides general information about synthetic identity fraud and the Credit Privacy Number scam. It is not legal advice and does not create an attorney-client relationship. Industry loss estimates and scheme details change over time; confirm current figures with the cited sources before relying on anything here.

---

Last updated: 2026-08-13.