Traditional fraud controls — KYC documents, credit checks, device cookies — weren't built for synthetic identities. Fraudsters assemble plausible personas from real data fragments, pass verification, and build credit history before defaulting on BNPL loans, credit cards, and bank accounts.