Fraud and Cybercrime Risk

Fraud and cybercrime risk in onboarding refers to the chance that a bad actor uses stolen, synthetic, or manipulated identity data to gain access or complete a transaction. Teams manage this risk by combining identity proofing, monitoring, and escalation rules that detect suspicious patterns before account abuse occurs.

Expanded Definition

Fraud and cybercrime risk is the operational exposure created when an attacker uses stolen, synthetic, or manipulated identity data to bypass onboarding checks, open accounts, or authorize transactions. In NHI and IAM contexts, the term extends beyond classic account takeover to include impersonation of service accounts, abuse of API keys, and identity laundering through compromised workflows. Definitions vary across vendors on how much of this risk belongs to identity proofing versus downstream transaction monitoring, so NHI Management Group treats it as a lifecycle control problem rather than a single detection rule. That means joining identity evidence, device or session signals, privilege context, and escalation logic into one reviewable decision path. The standards view is consistent with risk-based identity assurance in NIST Cybersecurity Framework 2.0, while NHI-specific abuse patterns are documented in Ultimate Guide to NHIs – Why NHI Security Matters Now. The most common misapplication is treating fraud only as a payments issue, which occurs when onboarding teams ignore identity compromise signals that later enable account abuse.

Examples and Use Cases

Implementing fraud and cybercrime risk controls rigorously often introduces friction at onboarding and step-up review points, requiring organisations to weigh conversion speed against attack resistance.

• A fintech rejects a new business account because identity documents match a real person, but device and network signals indicate a synthetic identity cluster tied to prior abuse.
• A platform flags repeated API key creation from one tenant because the pattern aligns with service-account abuse described in The 52 NHI breaches Report.
• An e-commerce team routes suspicious high-value purchases into manual review after onboarding succeeded but transaction velocity exceeds the profile established by NIST SP 800-53 Rev 5 Security and Privacy Controls.
• A B2B SaaS provider requires extra verification when a newly issued service account requests privileged scopes that do not match the declared integration use case.
• A payments operation links onboarding alerts with fraud case management so that manipulated identity data cannot be reused across channels or subsidiaries.

These scenarios show why the control objective is not merely to block bad applications, but to detect whether the identity story remains coherent as the relationship progresses.

Why It Matters in NHI Security

Fraud and cybercrime risk becomes a governance issue when identity evidence, secrets, and access decisions drift out of sync. NHI environments are especially exposed because NHIs outnumber human identities by 25x to 50x in modern enterprises, and the same weak proofing logic used for customers can also be exploited to register abusive service identities or steal automation credentials. NHI Management Group research shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which makes fraud and cybercrime risk inseparable from secret handling and privilege design. The broader NHI problem is also persistent: 96% of organisations store secrets outside of secrets managers in vulnerable locations, and 97% of NHIs carry excessive privileges, amplifying the downstream cost of a single fraudulent onboarding event. This is why NHI-focused guidance in Top 10 NHI Issues and the CISA cyber threat advisories should be read together: fraud prevention is only durable when identity proofing, monitoring, and revocation are operationally linked. Organisations typically encounter the business impact only after fraudulent accounts begin moving laterally or monetizing access, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do conflicting access rights increase fraud risk more than broad access alone?
• Why do rooted or jailbroken devices not always mean higher fraud risk?
• Why does role overlap create fraud risk in accounts receivable?
• Why does weak segregation of duties increase fraud and compliance risk?