TL;DR: Agentic AI breaks the identity verification assumptions behind human-centric fraud controls, while banks are already blocking 300 to 500 deepfake attempts per day and human reviewers perform roughly 8x worse than machine learning models in IDV, according to Incode. The operational gap is no longer theoretical: identity programmes built around people, documents, and review queues now face sessions with no stable human subject to verify.
At a glance
What this is: This is Incode's analysis of deepfake fraud and agentic AI, with the core finding that human-centric identity verification assumptions break when the subject is an agent rather than a person.
Why it matters: IAM and fraud teams need to redesign verification, recovery, and scope controls for agent ownership and runtime behaviour, not just human identity proofing.
Context
The security gap is not simply that deepfakes are getting better. The deeper problem is that many identity verification stacks still assume a human subject somewhere in the flow, with a face, a document, or a reviewable session to validate against. That model works for people and fails when the identity acting in the workflow is an agent or synthetic actor.
Incode's analysis links that assumption failure to two operational pressures at once: fraud teams are trying to contain deepfake abuse, while identity teams still need to preserve conversion and customer experience. When those controls are tuned only for human onboarding, account recovery and authentication paths become the easiest place for adversaries to re-enter.
For IAM practitioners, the question is no longer whether biometric or document checks are strong enough in isolation. The question is how identity assurance behaves when the actor is non-human, the session can be continuously re-scoped, and the old review queue has no stable person to review.
Key questions
Q: What breaks when identity verification assumes there is always a human behind the session?
A: The model breaks when the subject is an AI agent or a synthetic identity that cannot be verified through conventional human attributes. In that case, document checks, facial matching, and personal knowledge stop being reliable anchors for trust. Governance has to shift toward ownership, scope, and session-level authorisation.
Q: Why do AI deepfakes increase fraud risk even when people are trained to spot them?
A: Training helps, but it cannot reliably overcome synthetic voice, video, and writing that mimic familiar people under pressure. Deepfakes exploit urgency and authority, which are stronger than visual or verbal cues in many business settings. The risk rises when organisations let a convincing message trigger an irreversible outcome without a second verification step.
Q: How do teams know their identity controls are keeping up?
A: Look for evidence that the programme can explain who owns each identity, when access is reviewed, and how quickly dormant access is removed. If those answers are unclear for service accounts or third-party connections, the control model is lagging behind the environment.
Q: What should security teams do first when their verification model is built for people?
A: Start by mapping every control that still presumes a face, a document, or a manual reviewer, then test those flows against non-human and synthetic cases. Recovery, step-up, and exception handling usually reveal the biggest gaps first. The goal is to identify where authority is being inferred from human proxies that no longer hold.
Technical breakdown
Why human-centric identity verification breaks under agentic AI
Traditional identity verification assumes the subject can be mapped to a person, a government document, and a persistent session. Agentic AI breaks that model because the actor may be authorised through ownership or delegation rather than physical identity. That shifts the control problem from proving who a person is to proving what an agent may do, under whose authority, and within what runtime scope. Once the subject is non-human, document binding and selfie matching stop being the primary trust anchor. The architecture has to govern action, not appearance.
Practical implication: stop treating human proofing controls as sufficient evidence of agent legitimacy.
How layered deepfake defence reduces fraud exposure
The article points to layered defence as the only scalable pattern because each control fails independently. Device integrity, session behaviour, document authenticity, biometric liveness, network signals, and cross-customer intelligence each cover a different failure mode, so an attacker must defeat multiple checks rather than one model. This is materially different from a single decision point, where one evasion path can collapse the whole stack. The value of layering is not perfection, but compartmentalisation of failure. That architecture also makes it easier to tune thresholds without letting one weak signal dominate the decision.
Practical implication: design verification so no single signal can override the rest of the trust chain.
Why account recovery remains a high-risk re-entry path
The article identifies recovery as the place where synthetic identities can re-enter hardened systems. That happens because many programmes strengthen onboarding while leaving recovery dependent on weaker factors such as SMS codes or knowledge-based questions. If an attacker has already established a synthetic identity, recovery becomes a route back into the account lifecycle rather than a safeguard around it. This is a lifecycle problem, not just an authentication problem. The control weakness is the asymmetry between front-door assurance and back-door re-entry.
Practical implication: review recovery as a privileged access path, not a convenience feature.
NHI Mgmt Group analysis
Agentic AI creates an assumption collapse in identity verification: human verification stacks were designed for actors that can be tied to a face, a document, and a stable review window. That assumption fails when the actor is autonomous or agentic because the runtime subject is an agent acting under delegated authority, not a person being observed in the moment. The implication is that identity programmes must rethink what they are certifying, not just add more checks.
Deepfake defence is a control architecture problem, not a model-selection problem: the article's layered approach matters because no single detector can absorb all fraud modes. Separate signals for device, session, document, biometric, and network behaviour give the programme independent failure domains instead of one brittle decision point. That is the right operating model for high-volume identity assurance.
Recovery is the neglected governance boundary in identity stacks: most organisations harden onboarding and then let recovery act as a secondary authentication path with weaker controls. That creates a lifecycle mismatch where the safest front door is undermined by the easiest back door. Practitioners should treat recovery as a governed identity stage, not an afterthought.
Fraud and conversion must be governed together: the article correctly surfaces that over-blocking can destroy legitimate conversion even when fraud controls are working. Identity security teams need a common decision model for risk, friction, and customer impact, otherwise every threshold adjustment becomes a guess. The practical conclusion is that performance metrics have to include both abuse prevention and legitimate-user fallout.
Regulation is lagging the operational reality of agentic fraud: current identity and fraud frameworks still centre on humans, documents, and signatures, while attackers are moving toward agent-driven interaction patterns. That creates a governance gap that cannot be closed by waiting for policy catch-up. Teams should treat the present threat model as ahead of the regulatory model.
From our research library:
- Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
What this signals
Identity programmes built for people now need to distinguish between proof of personhood and governance of delegated action. When an agent can act without a stable human subject, the old review loop becomes structurally misaligned with the control it is meant to enforce.
Runtime scope becomes the new trust boundary: the decisive question is not just who was enrolled, but what the actor is allowed to do during the session and when that scope expires. Practitioners should expect recovery, step-up, and exception handling to carry more risk than frontline onboarding if they are left human-centric.
For practitioners
- Recast identity assurance around actor type Map where your current verification stack assumes a human subject and where it should instead govern agent ownership, delegated authority, and runtime scope.
- Treat account recovery as a high-risk lifecycle stage Test recovery paths separately from onboarding, then remove weak re-entry factors such as SMS-only resets and knowledge-based questions where they still exist.
- Layer independent fraud signals Combine device integrity, session behaviour, document authenticity, biometric liveness, and network intelligence so one evasion path does not collapse the full decision.
- Measure conversion loss alongside fraud loss Track blocked-legitimate-user rates next to confirmed fraud so threshold tuning reflects both sides of the identity risk ledger.
Key takeaways
- Human-centric identity verification fails when the actor is an agent or synthetic identity rather than a person with documents and a reviewable session.
- Layered fraud controls are stronger than single-point detection because each signal can fail independently without collapsing the whole decision path.
- Recovery, not onboarding, is often the weakest lifecycle stage and should be governed as a high-risk re-entry point.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic actors in this article are judged through ownership and runtime scope, not human face or document proof. |
| Recommendation — Bind agent authority to explicit scope controls and verify every delegated action against current privilege. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on authentication flows that no longer fit non-human or synthetic actors. |
| NHI-10 — Human Use of NHI | Identity recovery and review processes still depend on people making decisions about non-human actors. | |
| Recommendation — Replace human-centric verification assumptions with authentication controls that account for non-human subjects. Prevent human-operated fallback paths from becoming the weakest control around non-human access. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The fraud pattern uses re-entry and session abuse patterns that map to credential use and expansion of access. |
| Recommendation — Track recovery abuse and deepfake-enabled access attempts as credential-access precursors to wider account misuse. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article's core issue is whether runtime access matches the subject and scope actually authorised. |
| Recommendation — Review permissions and authorisations so identity scope reflects the current actor and session state. | ||
Key terms
- Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
- Deepfake-Enabled Fraud: Deepfake-enabled fraud uses synthetic media, voice, or face manipulation to impersonate real people and bypass weak verification steps. It raises the bar for identity and fraud teams because traditional checks may not reliably detect fabricated presence, especially in high-volume digital onboarding and support channels.
- Identity Verification Stack: The set of controls used to establish trust in a person or account, including document checks, biometrics, device signals, session behaviour, and review workflows. Strong stacks layer signals so one failure does not collapse the entire decision.
- Account Recovery: Account recovery is the process used to restore access when a user cannot authenticate normally. In mature IAM programmes, recovery is treated as part of the trust chain because a weak reset path can bypass stronger login controls and become the easiest route to account takeover.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org