Because the behavior is designed to resemble legitimate account use. Activity is often gradual, payments are made, and usage patterns avoid the spikes that typically trigger fraud alerts.
👉 https://www.cardozalawcorp.com/library/how-synthetic-identity-theft-works.cfm
