# Straw Buyers, Synthetic Identities and CPNs: Detecting Mortgage Fraud When the Borrower Is Not Who the File Says

*October 30, 2026 · 6 min read · Ramkumar Venkataraman*

> Most fraud checks ask whether the borrower told the truth. Identity fraud asks a prior question: whether the borrower on the file is the person who will own, pay for and live in the property at all. How straw-buyer schemes, synthetic identities and credit privacy numbers show up in a mortgage file, what SSA's eCBSV and the Red Flags Rule give a lender to work with, the fair-lending trap in naive identity rules, and what an AI agent can and cannot conclude.

## The Question Before the Question

A mortgage underwriter spends most of a file answering one question: is what this borrower told us true? Income, assets, debts, occupancy. Identity fraud sits underneath all of that and asks something earlier: is the borrower on this file the person who is actually buying the house? When the answer is no, every other check in the file can pass. The income can be real, the assets can be real, the documents can be authentic. They belong to someone, they are simply not the person who will own the property, make the payments or walk away from it.

There are three main shapes this takes in mortgage. A **straw buyer** is a real person, with a real identity, who lends their name and credit to a transaction on behalf of someone who could not qualify or does not want to be on the record. A **synthetic identity** is a fabricated person, usually built from a real Social Security number combined with a different name and date of birth, cultivated over months or years until it has a credit file good enough to borrow against. A **credit privacy number**, sold as a legal way to start a "new credit file," is in practice a Social Security number, often a child's, a deceased person's or one never issued, presented in place of the borrower's own. Each one leaves different signals, and none is caught by checking whether the documents add up.

## Straw Buyers: Real People in the Wrong Role

The straw buyer is the hardest of the three to see, because nothing about the person is fake. The identity verifies. The credit report is theirs. The signature is theirs. What is wrong is the economics: the borrower has no real stake in the transaction, and someone else does.

The signal is in how the money and the roles line up:

- **All of the funds come from someone else.** The down payment arrives as a gift or a transfer from a third party, closing costs are covered by seller credits, and the borrower has contributed nothing of their own.
- **The borrower's profile does not match the purchase.** A credit-thin borrower, or one much older or younger than typical buyers of the property, buying a home far from where they work and live, with no history of owning real estate.
- **Someone else keeps appearing.** A relative or associate is the gift donor, the person on the contact sheet, the person who answers the processor's calls, or the person whose phone number is on the application. A "coach" who arranges the transaction is a common feature of organised straw schemes.
- **The property is conveyed or rented soon after closing.** This is a post-closing signal, but in [servicing](/for-servicers/fraud-manager) a deed recorded from the borrower to the real buyer, or a rental listing for a home the borrower certified they would occupy, confirms what the origination file suggested.

None of these alone is suspicious. Parents help children buy homes all the time, with gifts that are exactly what they appear to be. The pattern that matters is the combination, and especially a third party who is both funding the transaction and controlling it. An agent that reads the whole file can resolve every name, address, phone number and email across the gift letter, the bank statements, the application and the contact records into one list of people, and show when the same person sits in roles that should be independent.

## Synthetic Identities: A Person Built to Pass

A synthetic identity is engineered to clear exactly the checks a lender runs. It has a Social Security number, a name, a date of birth, an address and a credit file. The credit file often has good scores, because the fraudster has spent months building it with small accounts paid on time, sometimes by being added as an authorised user on someone else's established cards. The identity is then used to borrow as much as possible and abandoned.

What gives it away is the history underneath, which is hard to fabricate retroactively:

- **The credit file is younger than the person.** A borrower who says they are forty-five with a credit file that began three years ago has a history to explain.
- **Authorised-user tradelines doing the heavy lifting.** Several authorised-user accounts added in a short window, older than any account the borrower opened themselves, are the signature of purchased credit history.
- **The Social Security number does not fit the person.** For numbers issued before June 2011, the number's structure related to when and where it was issued, so a number issued long before the borrower was born, or in a pattern inconsistent with the stated history, is a flag. After 2011 the SSA randomised issuance, so this test has to be applied only to numbers from the earlier era. Applied blindly, it flags young borrowers with legitimate newer numbers.
- **No footprint outside credit.** No address history that utilities, property records or other public records corroborate, and contact details that are new or shared with other applicants.

The authoritative answer comes from outside the file. The Social Security Administration's [electronic Consent Based SSN Verification service](https://www.ssa.gov/dataexchange/eCBSV/), with the borrower's written consent on Form SSA-89, returns whether a name, date of birth and Social Security number combination matches SSA's records. Many lenders already obtain the SSA-89 for this purpose. When the result is in the file, the agent's job is to read it, reconcile it against the identity on every other document, and treat a no-match as a hard stop rather than a footnote in an attachment.

## CPNs: A Different Number Presented as the Borrower's

Credit privacy numbers are marketed online as a legal way to build a fresh credit profile. They are not. A borrower who applies for a mortgage using a number other than their own Social Security number is making a false statement on a federal loan application, and the numbers sold as CPNs are frequently Social Security numbers belonging to someone else.

In the file, a CPN tends to show up as inconsistency between documents the borrower controls and documents they do not. The application and the credit report carry one number. The W-2s, the tax returns and the IRS transcript request carry another, because the borrower's employer and the IRS know their real number. A credit file under the application's number that is new, thin and has no employment history attached, alongside tax documents that report years of wages under a different number, is the pattern. Reconciling the Social Security number across every document in the file is the check, and it is one of the simplest in the whole fraud program.

## What the Regulations Require, and What They Do Not

Two federal frameworks put identity detection on a lender's obligation list. The [Red Flags Rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-F/part-681), with parallel rules from the banking agencies, requires creditors to run a written identity theft prevention program that identifies, detects and responds to red flags. Its guidance lists exactly the signals above: identification that appears altered, a Social Security number that has not been issued or belongs to a deceased person, information inconsistent with what the lender already knows or with outside sources. And for non-bank residential mortgage lenders and originators, FinCEN's rule at 31 CFR 1029.320 requires a suspicious activity report for transactions of $5,000 or more where the lender knows, suspects or has reason to suspect fraud. Identity fraud on a mortgage application is squarely in scope.

Neither framework asks a lender to decide fraud occurred before acting. Both ask the lender to detect, investigate and respond. That is the right division of labour for an AI agent: detect consistently, assemble the evidence, and route to the people who own the program and the SAR decision. We covered where that line sits, and why the agent never tells the borrower about a referral, in our earlier post on [fraud detection at origination](/blog/ai-mortgage-fraud-detection-origination-misrepresentation-fincen-red-flags).

## The Fair-Lending Trap in Identity Rules

Identity fraud detection is where a well-meaning rule most easily becomes a fair-lending problem. Thin credit files are more common among younger borrowers, recent immigrants and borrowers from communities that have historically had less access to credit. Individual Taxpayer Identification Numbers are a legitimate identifier for borrowers who are not eligible for a Social Security number, and some lenders offer ITIN loan programs. A rule that treats "thin file" or "ITIN" as a fraud signal on its own will flag real borrowers disproportionately along lines that track protected characteristics.

The way to avoid that is to make every identity finding about a specific inconsistency, not a profile. "The Social Security number on the credit report differs from the number on the W-2s" is a finding about documents. "Credit file opened after the stated employment history began, with three authorised-user accounts added in the same sixty days" is a finding about a history. "Thin file" is a description of a person, and it should never be a finding on its own. Testing the rule set for disparate impact before it goes live, and reporting the reason for every flag, is what keeps an identity program defensible.

## The Honest Read

Identity fraud is the one category where the file can be entirely real and still be false, because the documents are genuine and the person is not who the file says. The signals are in the history and the roles, not the documents: a credit file younger than its owner, a Social Security number that changes between documents, a third party who funds the deal and answers the phone. An agent that resolves every person and every identifier across the whole file surfaces those patterns consistently, and reads the outside verification the lender has already obtained rather than leaving it in an attachment.

It does not decide that a borrower is a straw buyer or an identity thief, and it should never flag a borrower for who they are rather than for what the documents say. The [Fraud Agent](/for-lenders/fraud-agent) raises a cited finding and the lender's underwriting, identity theft program and BSA functions take it from there. The identity signals we look for, alongside the other categories, are listed in our [mortgage fraud guide](/blog/guides/mortgage-fraud#identity).

---

_Source: [https://www.seiright.com/blog/straw-buyer-synthetic-identity-cpn-mortgage-fraud-detection](https://www.seiright.com/blog/straw-buyer-synthetic-identity-cpn-mortgage-fraud-detection) · Sei AI_