AI fraud is exposing the limits of legacy verification systems

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Trulioo's report: AI-enabled fraud is outpacing legacy verification, and the evidence points to rising synthetic identity abuse, onboarding friction, and revenue loss.

Why it matters: IAM, fraud, and identity verification teams need to treat onboarding as a continuous trust decision, because static checkpoint models no longer separate legitimate users from machine-speed fraud.

By the numbers:

• 96% of firms feel confident in detecting harmful bots, yet 59% struggle with synthetic identity fraud and generative AI fraud.
• 52.3% of companies are seeing increased bot traffic.
• The report links these frictions to an average 3.1% revenue loss.

Context

Verification frameworks were designed for an older fraud model, one where signals changed slowly and human analysts could still review borderline cases. AI-enabled fraud breaks that assumption by scaling deepfakes, synthetic identities and automated agent attacks faster than manual processes can react.

The governance problem is not only better detection, but better decisioning across onboarding, compliance and downstream trust flows. Where identity checks stop at a single checkpoint, fraud adapts across the full lifecycle and turns friction into both a security gap and a commercial drag.

Key questions

Q: Why do traditional identity verification controls fail against AI enabled synthetic identities?

A: Traditional controls fail when they rely on document checks, database lookups, and risk scores that estimate identity instead of proving it. AI can combine stolen personal data, altered documents, and matching biometrics to satisfy each check. Once attackers can reuse real data at scale, the verification stack can validate the wrong person with high confidence.

Q: Why do manual review queues fail against AI-enabled fraud?

A: Manual review queues fail when fraud volume is high, evidence is synthetic, and reviewers must make fast decisions with limited context. AI-enabled fraud can automate document forgery, face spoofing, deepfake voice, and repeated attempts at scale, so queues become a bottleneck unless they are backed by risk scoring, step-up checks, device signals, and automation for low-risk cases.

Q: How should firms apply intelligent friction in identity verification?

A: Firms should apply intelligent friction by escalating checks only when risk signals warrant it, such as device reputation, behavioural anomalies, document mismatch, or repeated attempts. Use risk-based step-up verification, progressive challenges, and queue routing so low-risk users move quickly while suspicious cases face more scrutiny.

Q: What should teams do first when AI fraud spikes during onboarding?

A: First, contain the spike by tightening onboarding thresholds and moving suspicious cases into step-up verification or manual review. Then correlate fraud signals across device, document, biometrics, and behavioural data, because AI fraud spikes usually mean one control failed and the intake path needs immediate risk-based gating.

Technical breakdown

Why static verification fails against AI-speed fraud

Static verification assumes the risk picture is stable long enough for rules, thresholds and manual review to work. AI-enabled fraud changes that by producing convincing synthetic identities, deepfakes and automated interactions at machine speed, often before a human can intervene. The result is not just more fraud volume, but a shorter decision window and less reliable evidence. Once attackers can iterate faster than review queues clear, the control plane has to move from a one-time gate to continuous assessment.

Practical implication: Move identity decisions from point-in-time checks to ongoing risk evaluation across the customer journey.

Why bots, synthetic identities and agent attacks collapse the same trust model

Bots, synthetic identities and automated agent attacks exploit different layers of the same weakness: systems that trust a single signal too much. A bot can flood a form, a synthetic identity can pass initial checks, and an agent can execute actions on behalf of a user after authorization is assumed. The common failure is overreliance on one verification moment instead of correlating behaviour, device context, transaction patterns and authorization history. That is why fraud controls and identity governance now overlap. See the Identity Proofing and KYC Guide.

Practical implication: Correlate behavioural, device and transaction signals so one successful check cannot confer lasting trust.

How intelligent friction changes the economics of identity verification

Intelligent friction means applying more scrutiny only where risk is elevated, rather than forcing every user through the same experience. In practice, this combines layered signals, contextual risk scoring and adaptive challenges so low-risk users move faster while suspicious sessions face stronger checks. That matters because excessive friction drives drop-off, while too little friction leaves fraud untouched. The model is valuable precisely because it aligns security with conversion instead of treating them as competing goals.

Practical implication: Tune step-up verification to risk tier so fraud resistance does not become a blanket conversion penalty.

NHI Mgmt Group analysis

Legacy verification fails because it was built around a stable fraud timeline. Static review assumes analysts can inspect a case before the threat changes shape, but AI-enabled fraud can generate plausible identity evidence, adapt its presentation and move on before a queue clears. That means the decisive failure is not a lack of effort, but a control model that depends on time the attacker no longer gives it. Practitioners should treat verification as a lifecycle function, not a checkpoint.

Identity verification now has to govern behaviour, not just claims. When bots, synthetic identities and agent-driven actions all reach the same onboarding surface, the question is no longer whether a user passed a gate. The real issue is whether the system can keep re-evaluating trust as context changes. This is where identity and fraud operations converge, and identity proofing and KYC becomes a continuous governance discipline rather than a one-off eligibility test.

Intelligent friction is a governance design choice, not just a customer-experience tweak. The article’s core implication is that friction has to be selective if organisations want both fraud reduction and conversion preservation. Over-challenging every user destroys growth, while under-challenging high-risk traffic invites losses. The practical conclusion is that verification policy, not only tooling, now determines whether digital trust supports revenue or consumes it.

Know Your Agent is the next identity boundary firms will have to govern. Once software can act with delegated authority, existing human-centred identity assumptions stop covering the full decision path. That creates a new class of identity risk where the builder, the runtime code and the authorisation context all matter. Practitioners should treat agent identity as part of the same trust fabric as customer identity, rather than as a separate automation problem.

From our research library:

• Deepfake scams now account for nearly $12 billion in fraud losses globally.

What this signals

Adaptive verification is becoming a control-plane issue. Once fraud patterns change faster than onboarding rules, the question is no longer whether a user can pass a form. It is whether the identity stack can keep re-evaluating trust after the first decision, which pushes fraud and IAM teams toward shared operating models.

Agent identity will force identity programmes to expand their scope. As software acts on behalf of users, the trust question shifts from person-only verification to delegated authority, runtime scope and authorisation governance. Programmes that still assume the human is the only meaningful identity will miss the next wave of abuse.

For practitioners

• Build continuous verification into onboarding flows Replace single-point approval logic with risk checks that continue after account creation, especially where synthetic identity and automated agent abuse are plausible.
• Separate low-risk and high-risk user journeys Apply intelligent friction so routine users move quickly while suspicious sessions trigger step-up checks, enhanced evidence review or manual intervention.
• Correlate behavioural and transactional signals Combine device context, interaction patterns and transaction history so one successful credential or document check does not create durable trust.
• Define governance for agent-authorised actions Record who built the agent, what it can do and which user granted the authority before letting software act on financial or identity-sensitive workflows.
• Measure fraud friction against revenue impact Track drop-off, false positives and fraud outcomes together so verification changes can be judged on both security and conversion performance.

Key takeaways

• AI-enabled fraud breaks verification models that depend on static signals and manual judgment.
• The report links bot growth, onboarding drop-off and synthetic identity abuse to measurable revenue loss.
• Practitioners need continuous decisioning, selective friction and governance for delegated agent actions.

Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Generative AI Fraud Guide · Top 10 Agent Identity Controls

Key terms

• Synthetic Identity Fraud: Synthetic identity fraud is the creation of a fake identity from a mix of real and fabricated personal data. Fraudsters use it to open accounts, build credit, and evade standard checks. Defenders look for thin-file identities, inconsistent identity attributes, repeated reuse of contact details, and unusual account-age patterns across applications.
• Deepfake: Synthetic or altered media created with AI or machine learning so that a person appears to say or do something they never did. In security terms, deepfakes are trust attacks that can distort identity verification, approval workflows, and fraud detection.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Know Your Agent: A governance pattern for verifying that an AI agent is the intended actor, not a hijacked or impersonating one. It extends identity assurance beyond login by focusing on runtime behaviour, delegated authority, and the integrity of the agent's actions across connected systems.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security. It helps security and identity practitioners build controls for delegated access, lifecycle governance and runtime trust.