The Outlier Lab

Identity Element Consistency

How well a claimed identity's name, SSN, date of birth, address, phone, email, device and location agree with each other and with authoritative and historical sources.

What it measures

An identity is a bundle of elements: name, SSN, date of birth, address, phone, email, and the device and network it shows up on. Each can individually check out while the bundle is wrong. This signal scores the bundle:

RelationshipQuestionTypical evidence
Pairwise linkageHas this phone/email/address been associated with this name or SSN before, and for how long?Identity-data providers, bureau header data, your own history
Authoritative matchDoes name + SSN + DOB match the issuing source?SSA eCBSV (with consent), bureau data
Temporal plausibilityIs the SSN's apparent issuance or first use consistent with the DOB? Do element ages make sense together (old SSN, all-new contact points)?Bureau and identity-graph data
UniquenessHow many other identities use this SSN, phone, email or address?Consortium and internal linkage
Contextual fitDo device and IP location, phone area and email locale fit the address?Geolocation and Impossible Travel, IP Reputation and Proxy Detection
Instrument fitDoes the funding bank account or card belong to the same person?Bank Account Ownership Verification, Payment Instrument Signals

Why it matters

Real data elements can still describe a person who doesn't exist. Most identity-based transaction fraud uses real data elements in combinations that don't hold together:

  • Synthetic identities combine a real SSN (often one with little credit activity, such as a child's or a recently issued one) with a fabricated name, DOB and contact points. Each element can pass a format check; the combination has no history. They fund accounts, build limits, then bust out or serve as mules. See Synthetic Identity Fraud.
  • Stolen-identity accounts pair a real victim's name, SSN and DOB with the fraudster's phone, email and device. The authoritative match passes; the contact-point linkage fails.
  • Mules and farmed accounts for resale are often opened with real identities (sometimes willingly lent), and inconsistencies appear between the identity and the device and location operating the account (Money Mules, Account Farming and Resale).
  • In funding and transfers, a brokerage ACATS-in or ACH link whose source account owner doesn't match the identity is a core indicator in ACATS Transfer Fraud and ACH Funding Fraud.
  • GenAI documents can make a document look consistent with the claimed identity while the underlying data relationships remain thin. FinCEN's 2024 alert lists identity documents inconsistent with each other or with the profile among its red flags. See Generative AI and Deepfake Fraud.

How to collect it

  • Buy identity-graph and identity-resolution services that return pairwise linkage scores (name↔phone, name↔email, name↔address, SSN↔DOB), plus bureau-based identity checks. See Credit Bureau and Consortium Signals and Vendor Landscape.
  • eCBSV. The SSA's electronic Consent Based SSN Verification lets permitted entities (financial institutions and their service providers) verify, with the number holder's written consent, whether name + SSN + DOB match SSA records. SSA's page now says it returns which elements don't match and whether a death indicator is present. Use is limited to credit transactions and other circumstances permitted under FCRA section 604.
  • Build internal identity history: every element combination you have seen, when, on which accounts, with outcomes. Your own historical linkage is often more predictive than external sources for returning customers.

How to use it

  • Score the bundle. A model or rule set that sees "SSN matched, phone new, email new, address is a mail-receiving agency, device region ≠ address" catches what element-level pass/fail checks miss.
  • Use consistency as a step-up trigger. When consistency is low, ask for stronger evidence before funding or before the first payout, instead of denying outright (Document Verification and Liveness, Bank Account Ownership Verification).
  • Re-check at transaction points. Consistency is usually computed at onboarding and then forgotten. Re-evaluate when the money path changes: new bank link, new payout destination, contact change.
  • Separate thin from inconsistent. A thin file with consistent elements (a young person, a new immigrant) is a different case from a thick file with contradictory elements.

Strengths and limitations

Strengths: goes after the structure of synthetic and stolen identities rather than any single data point; explainable to reviewers and auditors.

Limitations:

  • Identity graphs are built from commercial data, which can be wrong, stale and unevenly complete.
  • Fraudsters age synthetic identities to build linkage history. A long-nurtured synthetic can look consistent. Assume consistency checks can be degraded and keep monitoring behavior after onboarding.
  • eCBSV requires consent capture and permitted-purpose discipline, and a match proves only that the elements match, not who is present.

False positives and fairness

  • Thin-file and credit-invisible people (young adults, new immigrants, people who avoid credit), who legitimately have few linkages.
  • Name changes after marriage or divorce, and gender transitions.
  • Transliteration and naming conventions such as multiple surnames, ordering differences and diacritics. Fuzzy matching tuned on Anglo names underperforms for others.
  • Recent movers and people with unstable housing.
  • Data-broker opt-outs, which reduce linkage evidence for privacy-active consumers.

These overlap with protected-class characteristics. Test approval and step-up rates by segment and keep a non-documentary alternative path. See Friction and Customer Experience Tradeoffs.

Privacy and compliance considerations

  • Identity data is regulated in several ways: GLBA for financial institutions, FCRA when data comes from consumer reporting agencies (permissible purpose, adverse action), and the SSA's consent and permitted-entity rules for eCBSV.
  • CIP requires verifying identity "to the extent reasonable and practicable" through documentary or non-documentary methods; consistency checks are a common non-documentary method. See KYC and Customer Identification Program (CIP).
  • NIST SP 800-63A-4 prohibits knowledge-based verification for identity verification but allows it within fraud management, and requires that unsuccessful applicants not learn which self-asserted data matched authoritative sources. Keeping match results from the applicant is good practice in any verification flow.

Mechanisms it helps detect

Synthetic Identity Fraud · Money Mules · Account Farming and Resale · Bust-Out Fraud · ACH Funding Fraud · ACATS Transfer Fraud · Account Takeover (ATO) · Generative AI and Deepfake Fraud · Multi-Accounting

Sources and further reading