Signal series · Part 1 of 5 · July 16, 2026 · 6 min read
An earlier note listed five behavioral tells that separate a real member from a cultivated synthetic. This series takes each one apart, in order. We start with the one a signup check was never built to see.
Provenance is the economic origin story of an account. Where did the money that runs through it come from, and does that origin look like a life or like a setup? It is the first signal we read because it is the earliest one that exists. It is sitting in the funding record long before the account does anything dramatic.
A signup or identity check answers a point-in-time question: is this a valid identity, and does it belong to the person presenting it? It examines a name, a Social Security number, a document, a bureau record. Every one of those is a fact a synthetic is manufactured to satisfy. When the check passes, it is not always because the applicant is real. Sometimes it is because the applicant was built to pass it. That is the whole design goal of a cultivated synthetic: to be indistinguishable from a real new member on day one.
Provenance asks a different question. Not "is this identity valid" but "does this account have an economic past, and does that past hang together." At the moment of signup, the honest answer is that it has no past yet. There is nothing to read. The signal only exists later.
Real members arrive from somewhere. Payroll lands on a cadence: every two weeks, twice a month, whatever the employer runs, and it lands at roughly the same amount each time. Over months, money arrives from more than one place. An employer, then a second job, a tax refund, a transfer from a relative, a person-to-person payment from a roommate splitting rent. None of it is coordinated. It accumulates into a funding history nobody designed, because nobody designed the life behind it.
That texture is hard to fake because it is not a single thing. It is the incidental record of an actual economic existence, and an actual existence leaves a wide, irregular, slowly-built trail.
A cultivated synthetic tends to arrive thin. Often it is funded from a single source. There is no payroll cadence, because there is no employer. And here is the tell: it reaches for credit almost immediately, before any economic history exists that would justify the request.
The tell is not that the account is new. Everyone is new once, and a real thin-file member, a first job, a recent arrival, is new and legitimate. The tell is new and already reaching for credit with nothing behind it: an appetite for exposure that shows up before any provenance does.
You cannot run provenance at signup because at signup there is no provenance. The account has no funding history to read; the only thing present is the identity, and the identity is precisely the part a fraudster invested in making clean. Provenance is visible only in the rear-view mirror, across the months of funding behavior that follow. It is a longitudinal signal, which is a polite way of saying you have to look backward at what actually happened.
This matters because the losses are not marginal. McKinsey estimates that synthetic identity fraud accounts for 10 to 15 percent of charge-offs in a typical unsecured lending portfolio, losses that book as ordinary credit risk because, at the moment they land, that is exactly what they look like. The origin story that would have flagged them was written months earlier, in the funding record.
As with every signal in this series, provenance is judged against the account's own history, not against a population average. A real thin-file member and a synthetic look the same on a population cut, because both are thin. They look different when you ask a narrower question of each individual account: did a plausible economic origin ever show up, and did the reach for credit wait for it or run ahead of it?
Provenance is where the series starts because it is where the account starts. The notes that follow walk the same account forward: how its spending fails to cohere, how its appetite outruns its income, how it breaks from its own pattern near the end, and how it sits inside a cluster of accounts doing the same thing.
This is a conceptual, operator-facing explanation of one behavioral signal. It makes no factual claims about any specific institution, portfolio, or case, and describes no Delegate engagement or result. You can see the signal families run on a simulated book in the Portfolio Explorer.