Synthetic Identity Theft: How It Works and the CPN Scam Targeting Kids' SSNs

Synthetic identity fraud is different from ordinary identity theft. Instead of taking over an existing person's accounts, a fraudster builds a new identity from scratch: a real Social Security number, usually one belonging to someone unlikely to be watching it, paired with a fabricated name, date of birth, and address. Because no real person named on the new identity exists to notice the fraud, a synthetic identity can quietly build a credit history for months or years before a lender discovers the Social Security number it's attached to actually belongs to someone else entirely.

Information last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer.

This page covers what makes synthetic identity fraud different from ordinary identity theft, why children's and seniors' Social Security numbers are common building blocks, the Credit Privacy Number scam sold as a workaround, and the legal consequences of using one. For general identity theft warning signs and recovery rights, see Identity Theft Laws and How to Report Identity Theft.

How Synthetic Identity Fraud Works

Ordinary identity theft takes over a real person's existing identity: an existing account, an existing credit file, an existing name a victim will eventually recognize as their own. Synthetic identity fraud instead builds something new by combining a genuine Social Security number with a name, date of birth, and address that don't belong to the real person that number was issued to. Because the resulting identity doesn't match any single real person's full profile, there's no one actively watching for the fraud the way a victim of classic identity theft would be.

The financial scale is large and growing. A June 2026 industry report puts a number on it directly:

"Financial impact continues to grow significantly, with U.S. unsecured credit losses reaching ~$2.94 billion in 2025, up from $1.8 billion in 2020." Source: Mitek Systems, citing Datos Insights research (verified 2026-08-13)

That figure reflects unsecured credit losses specifically; it comes from a financial-technology industry report, not a government source, so treat it as a scale-setting estimate rather than an official statistic.

Why Children's and Seniors' Social Security Numbers Are Common Targets

A synthetic identity needs a Social Security number that isn't actively generating credit activity of its own, so the fraud doesn't collide with a real person's existing file. Experian, one of the three national credit bureaus, describes exactly that pattern in the numbers sold as Credit Privacy Numbers:

"CPNs are often SSNs that scam artists have stolen, typically from children, people who are incarcerated or senior citizens." Source: Experian, What Is a CPN or Credit Privacy Number? (verified 2026-08-13)

Each group shares the same underlying weakness: a child's Social Security number typically sits unused for well over a decade with no credit file to flag activity against, an incarcerated person is not actively applying for credit or monitoring their own file, and an elderly person's number may go unmonitored if no one else is checking it on their behalf. See Child Identity Theft for how to check whether a child's Social Security number has already been used to open a file.

The "Credit Privacy Number" (CPN) Scam

A Credit Privacy Number is a nine-digit number formatted to look like a Social Security number. It is not issued by the Social Security Administration or any other government agency, and no government program creates or authorizes one. It is typically marketed by "credit repair" operators as a way to leave a damaged credit history behind and start over with a clean file, sometimes described to a buyer as a legal privacy tool.

It is neither legal nor a privacy tool. Consumer-reporting companies describe most CPNs in circulation as stolen Social Security numbers rather than numbers generated from nothing, drawn disproportionately from the same three groups described above. Entering a CPN in place of your own Social Security number on a credit, loan, or rental application is providing false information to the lender, and the national credit bureaus treat it exactly that way.

The Legal Consequences

Federal law makes the underlying conduct a serious crime independent of any state identity-theft statute. The provision that reaches a CPN directly is 18 U.S.C. §1028(a)(7), which makes it an offense to knowingly transfer, possess, or use, without lawful authority, a "means of identification of another person" with the intent to commit, aid, or abet any federal crime or any state or local felony. Section 1028(d)(7) defines "means of identification" to include a Social Security number by name, which is what a CPN sold as a recycled SSN actually is. Under §1028(b)(2)(B) that offense carries up to 5 years in prison, and under §1028(b)(1)(D) the maximum rises to 15 years where the person committing the offense "obtains anything of value aggregating $1,000 or more during any 1-year period," a threshold a CPN seller running a volume operation, or a buyer who uses one to obtain a loan, can cross without difficulty.

The document-based paragraphs of §1028 are a poor fit for a bare number. Section 1028(d)(3) and (d)(4) define an "identification document" and a "false identification document" as documents that are or appear to be issued by or under the authority of a government, so a nine-digit number sold on a slip of paper or emailed to a buyer generally is not one. Those paragraphs matter when a CPN operation also manufactures counterfeit credentials to go with the number: §1028(b)(1)(A) sets a 15-year maximum for producing or transferring a document that is or appears to be a birth certificate, driver's license, or personal identification card, with no quantity threshold at all, and §1028(b)(1)(B) sets the same 15-year maximum for producing or transferring more than five such documents. Possessing five or more identification documents with intent to use or transfer them unlawfully is a separate offense under §1028(a)(3), punishable by up to 5 years. A single buyer using one CPN can also face identity-theft or false-statement charges depending on the specific facts.

IdentityTheft.gov, the FTC's own consumer site, carries a standing warning that applies here too:

"It is illegal to knowingly file a false identity theft report with the Federal Trade Commission. Filing a false report may result in a fine, imprisonment, or both." Source: IdentityTheft.gov (verified 2026-08-13)

A Related, Verified FTC Warning: "Credit Sweep" False Reports

CPN schemes aren't the only "credit repair" trick the FTC has flagged recently. In January 2026, the agency issued a dated consumer alert about a different but related scam circulating on social media:

"Some online influencers are telling people they have a fix: file a false identity theft report about a debt they owe. That's advice not to take. Filing a false identity theft report may leave you worse off, and it's a crime that could get you a fine, imprisonment, or both." Source: FTC Consumer Alert, "Influencers are pushing an illegal trick to 'fix' your credit report," Jan. 5, 2026 (verified 2026-08-13)

The FTC is explicit about why this doesn't work even when it isn't caught: "The truth is, credit repair companies can't legally remove information from your credit report if it's accurate and current." Both schemes sell the same underlying promise, a clean credit file without the years it normally takes to earn one, and both are illegal rather than merely risky.

Related Resources

• Identity Theft Laws covers victim rights, warning signs, and the federal identity theft statute generally.
• How to Report Identity Theft covers filing an FTC Identity Theft Report and the FCRA blocking process.
• Credit Freeze vs. Fraud Alert covers the free federal tool that can stop a new account, synthetic or otherwise, from being opened against your own Social Security number.
• Child Identity Theft covers how to check whether a child's Social Security number, a common synthetic-identity building block, has already been misused.
• Medical Identity Theft covers a related misuse of a stolen identity in a health care setting.
• What To Do After a Data Breach covers the response checklist if a breach exposed the Social Security number a synthetic identity could be built from.

Disclaimer

This article provides general information about synthetic identity fraud and the Credit Privacy Number scam. It is not legal advice and does not create an attorney-client relationship. Industry loss estimates and scheme details change over time; confirm current figures with the cited sources before relying on anything here.

---

Last updated: 2026-08-13.

Frequently Asked Questions

What is synthetic identity theft?

Fraud that combines a real Social Security number, often one belonging to someone unlikely to be monitoring it, with a fabricated name, date of birth, and address to build an entirely new credit identity, rather than taking over an existing person's accounts.

Is a Credit Privacy Number (CPN) legal?

No. A CPN is not issued by any government agency, and using one in place of your Social Security number on a credit or loan application is providing false information, which the national credit bureaus treat as fraud. Most CPNs in circulation are stolen Social Security numbers.

Why do identity thieves target children's Social Security numbers?

A child's Social Security number typically goes unused for well over a decade, with no credit file to flag suspicious activity against, making misuse far less likely to be caught quickly than fraud on an adult's active file.

How much does synthetic identity fraud cost in the US?

Industry research from Datos Insights, cited by Mitek Systems, put US unsecured credit losses tied to synthetic identity fraud at roughly $2.94 billion in 2025, up from $1.8 billion in 2020. This is an industry estimate, not an official government figure.

Is filing a false identity theft report a crime?

Yes. IdentityTheft.gov states directly that knowingly filing a false report can result in a fine, imprisonment, or both. The FTC issued a January 2026 consumer alert specifically warning about social-media influencers pushing this as a fake 'fix' for real debt.

How can I tell if my child's Social Security number has been used to build a synthetic identity?

Contact Equifax, Experian, and TransUnion to check whether a credit file exists under your child's Social Security number. A child's file should normally be blank; any file at all is worth investigating. See Child Identity Theft for the full process.