Sleeper fraud

Accounts opened with a fake or stolen identity and then left quiet before they are used for fraud.

The fraudster does not rush. The account sits mostly idle, which helps it escape attention, and it is activated later.

A pattern in which fraudulent accounts are created and held dormant, or with minimal normal-looking activity, for a period before being used to commit fraud or move money. Dormant means the account shows little or no use.

A sleeper account typically follows this path:

1. A fraudster opens an account using a stolen, synthetic, or fabricated identity.
2. The account passes onboarding, then sits quiet or shows light, ordinary activity.
3. After weeks or months, the fraudster activates it.
4. The account is used for a bust-out, for moving illicit money, or for other fraud.

Fraudsters use sleeper accounts for a few reasons:

• To outlast scrutiny, since new accounts often get closer monitoring that fades with time.
• To build credibility, since age and light history make an account look established.
• To stockpile access, by opening many accounts at once and using them as needed.

Detection focuses on the moment of activation and on links between accounts:

• Sudden reactivation, such as a long-quiet account that suddenly moves large sums.
• Behavior and device changes, such as a new device or location at activation.
• Linked accounts, such as many dormant accounts that share devices or contact details.

Sleeper fraud sits next to terms that are easy to mix up:

• Bust-out fraud is the extraction stage that often ends a sleeper account's life.
• Synthetic identity fraud often supplies the identities behind sleeper accounts.
• Account opening fraud is the creation of the account, which sleeper fraud then delays using.