Every one of these is judged against the account's own history, not against a
population average. That distinction matters, because a real thin-file member
and a synthetic look the same on a population cut. They look different when you
compare each account to its own past.
1. It arrives from nowhere
Real members show up with provenance. Payroll lands on a cadence. Money comes
from more than one place over time. A synthetic tends to arrive funded from a
single source, with no payroll pattern, and reaches for credit almost
immediately, before any economic history exists to justify it. The tell is not
"new." Everyone is new once. The tell is new and already asking for
credit, with nothing behind it.
2. Its spending has no texture
Real life is messy. People buy groceries and fuel and coffee, pay a few bills
that recur, and rack up small, odd-dollar transactions across dozens of
merchants. A cultivated synthetic's spending is thin and optimized: few
categories, almost nothing that recurs like a real obligation, and a
suspicious share of clean round-dollar amounts. It looks like activity staged
to look like life, because it is.
3. Its appetite outruns its income
This is the one that separates a synthetic from your best growing member, and
it is subtle. A real member who is growing borrows more as real
inflows grow. A synthetic's credit appetite climbs far faster than any genuine
money coming in, especially once you set aside funds that just cycle straight
back out to the same place. When exposure sought keeps outrunning real
provenance, that gap is the tell.
4. It breaks from its own pattern, all at once
For most of its life a cultivated account is calm and unremarkable. Then, near
the end, it changes character sharply: utilization jumps to the limit, cash
and cash-equivalent use spikes, payments flip toward the minimum right before
a draw. Measured against the account's own prior months, that is a regime
break. It is the loudest moment in the lifecycle and also the latest. If it is
the first thing you notice, the decision that mattered already happened.
5. It rarely works alone
Synthetics are cheap to make in bulk, so they tend to travel in clusters that
share plumbing: the same funding counterparty, the same payee, openings bunched
in time, applications bunched in time. One flagged account is a question. A
cluster of accounts that share plumbing and independently show the tells above
is a different kind of answer.
Reading them together
No single tell is proof. A real member can trip one. The pattern that should
make an operator look twice is sequence: an account that arrives from
nowhere, spends without texture, lets its appetite outrun its income, and then
breaks from its own pattern, in that order, and sits inside a cluster doing the
same thing. That sequence is not something a stolen identity produces. It is
the signature of an identity that was built.
The good news for anyone reading their own book is that all five of these live
in data an institution already has. They do not require a bureau, a
consortium, or a subpoena. They require looking backward at your own history
and comparing each account to itself.
Sources & notes
This is a conceptual, operator-
facing explanation of behavioral patterns. It makes no factual claims about
any specific institution, portfolio, or case. The five tells correspond to
the signal families DoubleCheck evaluates; you can see them run on a
simulated book in the Portfolio Explorer.
Field notes
New teardowns and notes on how synthetic losses hide, sent occasionally.
Occasional field notes on synthetic fraud, plus Delegate product updates. Unsubscribe anytime.