TL;DR: Fraudsters are using AI, deepfakes, voice cloning, phishing kits, and fake documents to bypass KYC and fuel account takeovers, APP fraud, and cash-out schemes across crypto, remittance, and precious metals, according to Riskified and Deloitte. Identity data and transaction-pattern analysis now matter more than static screening because trust signals are easier to fabricate than behaviour.
At a glance
What this is: Riskified argues that AI-powered KYC fraud is making static onboarding checks less reliable in alt finance, with fraudsters using synthetic and assisted techniques to bypass identity controls.
Why it matters: This matters because IAM and fraud teams need governance that can evaluate identity evidence and transaction behaviour together, not rely on documents and one-time verification alone.
By the numbers:
- Deloitte estimated that crypto scams alone accounted for $4.6 billion in losses in 2024.
Context
KYC is meant to establish whether a customer is who they claim to be before money or accounts are put at risk. In alt finance, that control is under pressure because onboarding now faces machine-assisted deception, not only manual fraud.
The identity governance problem is no longer limited to document validity. Platforms that move money in real time need stronger evidence that ties identity claims to behaviour, device signals and transaction context, especially where account opening is the first and often only checkpoint.
Key questions
Q: What fails when AI-generated identities can pass KYC checks?
A: The failure is assuming onboarding verification proves continuing legitimacy. When documents, voices and faces can be fabricated convincingly, KYC becomes a weak gate unless it is paired with behavioural and transaction signals. The practical issue is not just fraud detection, but trust persistence across the customer lifecycle.
Q: Why are alt-finance platforms especially attractive to AI fraudsters?
A: They convert identity approval into direct financial value very quickly. Crypto, remittance and precious-metals businesses let a successful fake identity move toward cash-out with fewer obstacles than physical goods businesses, so the window between onboarding and loss is much shorter.
Q: Why do AI and machine learning improve fraud detection in KYC workflows?
A: AI and machine learning improve fraud detection because they can analyze large volumes of transactional and behavioral data faster than manual review. In KYC, that matters when fraud patterns are subtle, evolving, or distributed across many accounts. These systems help teams spot anomalies early, prioritize suspicious cases, and reduce reliance on static rules that attackers can learn to evade.
Q: Should KYC be treated as enough on its own for fraud prevention?
A: No. KYC should be treated as an entry control, not a full fraud control. In AI-heavy fraud environments, the stronger model combines identity assurance, behavioural monitoring and transaction analysis so that suspicious activity can override a passing onboarding result.
Technical breakdown
How AI-powered fraud defeats KYC screening
Traditional KYC assumes identity evidence can be assessed once at onboarding and then trusted. AI-powered fraud breaks that assumption by generating believable documents, synthetic faces, cloned voices and scripted interactions that resemble legitimate customers closely enough to pass superficial checks. The weak point is not only image or audio quality, but the control design: a process optimised for static verification can be overwhelmed by dynamic, iterative deception. In alt finance, where speed and conversion pressure are high, attackers exploit that gap by making fraudulent identities look operationally normal.
Practical implication: move from document-only verification to layered evidence that includes behavioural and device-based validation.
Why alt-finance platforms are attractive fraud targets
Alt-finance businesses process direct money movement with limited friction between onboarding and monetisation. That makes them ideal for fraudsters because a successful fake identity can be converted into transfers, purchases or cash-out activity without needing a physical asset to resell. The article’s point is that the product itself is money, so the attacker’s route from enrollment to profit is short. That compresses the defender’s response window and makes the quality of the identity decision at onboarding materially more important than in slower, inventory-based businesses.
Practical implication: treat onboarding decisions as high-impact financial controls, not administrative customer setup.
Identity data and transaction patterns as a fraud control layer
Riskified’s analysis points to identity data as the corrective layer when eyes, ears and documents are no longer reliable. The useful signals are not just names or IDs, but inconsistencies in language, proxy usage, behavioural repetition and transaction patterns across platforms. This is a governance problem as much as a detection problem, because the platform must decide which signals count, how they are weighted and when they override a successful KYC step. In practice, the best control is one that links verification to ongoing fraud risk, not a single onboarding result.
Practical implication: build an identity decision model that can override pass-through KYC when behavioural evidence suggests fabrication.
Threat narrative
Attacker objective: The attacker wants to establish fraudulent customer access that can be converted quickly into illicit transfers, account control or cash-out.
- Entry occurs when fraudsters use AI-generated deepfakes, voice cloning, phishing kits and phony documents to impersonate legitimate applicants during onboarding.
- Credential and identity abuse follows when the fabricated persona passes KYC checks and is granted access to financial services that assume the customer is real.
- Impact appears as account takeovers, APP fraud and cash-out schemes that move money through crypto, remittance and precious-metal platforms.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Static KYC is now a brittle control when identity evidence can be manufactured at scale. The article shows that document checks, voice checks and visual checks are all exposed to AI-assisted imitation. That means the control failure is not the existence of KYC, but the assumption that a pass at onboarding proves real-world trust. Practitioners should treat KYC as one signal in a broader identity assurance model, not as a complete trust decision.
Alternative finance needs a stronger link between identity assurance and transaction governance. These platforms are attractive because they convert a fake onboarding win into financial value very quickly. That creates a governance gap between identity verification and fraud prevention, especially where the business optimises for speed and acceptance. NHI Mgmt Group’s view is that the control boundary now sits across both onboarding and behavioural monitoring, not inside KYC alone.
Identity evidence must be evaluated as a living risk signal, not a one-time gate. Fraudsters can recreate surface-level identity artefacts, but they struggle to sustain coherent behaviour across devices, sessions and transactions. The practical shift is toward continuous evaluation of proxy use, language anomalies and cross-platform patterns. For fraud and IAM teams, the key issue is trust persistence: who or what is still trustworthy after the initial check passes?
Behavioural identity signals are becoming the decisive differentiator in fraud governance. This article reinforces a named concept we should use more often: verification trust gap. That is the distance between a successful identity check and actual confidence that the actor is legitimate over time. Once AI can mimic static identity evidence, platforms need controls that observe consistency after onboarding, not just authenticity at the point of entry. Practitioners should design for the trust gap, not assume it closes at verification.
What this signals
Verification trust gap: The main governance issue here is the gap between successful onboarding verification and sustained trust in the customer record. AI makes that gap wider because the attacker can imitate the evidence KYC expects while behaving differently once access is granted. Teams should design controls that test identity continuity after approval, not only identity plausibility at the gate.
The operational shift is toward combining fraud analytics with identity governance, especially where money movement is immediate and losses are hard to reverse. That is where transaction patterns, proxy indicators and behavioural anomalies become more valuable than static document review alone.
For practitioners
- Strengthen multi-signal onboarding decisions Blend document verification with device reputation, behavioural signals and transaction context before granting access to money movement features.
- Monitor for proxy and obfuscation patterns Flag repeated proxy server usage, language anomalies and cross-session inconsistencies that suggest a manufactured identity rather than a real customer.
- Tie KYC outcomes to ongoing fraud review Use post-onboarding monitoring to revisit approval decisions when behaviour diverges from the original identity claim or risk profile.
- Calibrate acceptance rates against fraud exposure Measure whether aggressive approval targets are increasing exposure to account takeover, APP fraud and fast cash-out attempts.
Key takeaways
- AI-assisted fraud is eroding the reliability of onboarding controls that depend on documents, voice or face checks.
- The scale of the problem is amplified in alt finance because successful identity deception can be converted quickly into direct financial loss.
- Platforms need verification models that connect identity evidence to behaviour and transactions, not just to a one-time KYC pass.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article is fundamentally about weak customer proofing at onboarding. |
| Recommendation — Apply enrollment proofing controls that resist synthetic identities and AI-assisted impersonation. | ||
| GDPR | Art.32 — Security of Processing | Fraud controls process personal data and must be secured against identity abuse. |
| Recommendation — Protect identity processing with controls that preserve confidentiality, integrity and resilience against fraud. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article links identity acceptance to downstream financial access and misuse. |
| ID.RA-01 — Asset Vulnerabilities Are Identified and Documented | Fraud patterns create observable risk indicators that need structured identification. | |
| Recommendation — Align access and authorisation decisions with verified identity confidence and ongoing fraud risk. Document fraud vulnerabilities and update risk assessments when AI-assisted onboarding abuse appears. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centers on account creation abuse and fraudulent account lifecycle handling. |
| Recommendation — Tighten account management controls so fraudulent onboarding cannot become active platform access. | ||
Key terms
- Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.
- Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
- APP Fraud: Authorised push payment fraud happens when a victim is manipulated into approving a payment to a criminal account. Because the payment is user-authorised in form, reimbursement and accountability rules often shift the burden onto banks, making identity assurance at the point of approval financially critical.
- Behavioural Identity Signal: A behavioural identity signal is evidence from login patterns, device changes, action sequence, location, or privilege use that helps distinguish legitimate use from abuse. It is strongest when multiple signals are evaluated together, because a single event can look normal while the overall pattern does not.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle and secrets management. It is relevant for practitioners who need to connect identity assurance to broader security and fraud decisions.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org