Attack-as-a-service is lowering the bar for identity fraud

At a glance

What this is: This is an analysis of how attack-as-a-service is industrialising identity fraud through marketplaces for verification bypass, deepfakes and pre-verified accounts.

Why it matters: It matters because IAM, fraud and identity verification teams now face faster, lower-skill attack paths that outpace static controls and periodic review cycles.

By the numbers:

• 31 new online threat actor groups were identified in 2024 alone, according to iProov.
• 45% of these groups develop and sell their own attack tools, according to iProov.
• 68% of users are attracted to tool sellers, serving 23,698 individuals, according to iProov.

Context

Attack-as-a-service is the packaging of identity fraud capabilities into services that can be bought, subscribed to, or handed off to specialists. In practice, that means verification bypass, face swaps, virtual cameras, synthetic identities and operational tutorials are being sold as repeatable products rather than improvised fraud.

For IAM and identity verification programmes, the issue is not simply that attacks exist. The problem is that the attacker capability has become modular, fast to acquire, and easy to refresh, which weakens the value of controls that depend on one-time checks or slow remediation cycles.

The article’s core point is that identity fraud is no longer limited to highly skilled operators. That changes the defensive baseline for organisations that still rely on static proofs, periodic updates, or narrow assumptions about attacker expertise.

Key questions

Q: What breaks when banks rely on static PII for identity verification?

A: Static PII breaks when the same personal data can be stolen, bought, or assembled from breaches and used to pass checks that were designed to prove uniqueness. It also fails when fraud models score risk using the same compromised attributes. Banks need layered verification that includes behavioural signals, device intelligence, and document authenticity.

Q: Why does attack-as-a-service increase fraud risk so quickly?

A: It lowers the skill barrier and turns fraud methods into reusable products, which expands the pool of attackers and shortens the time between a weakness being found and exploited. The result is more attempts, broader targeting and faster commoditisation of new bypass techniques.

Q: What do teams get wrong about identity-based fraud detection?

A: Teams often assume identity verification at onboarding is the main trust decision. In practice, the trust posture has to be reassessed during the session or transaction because fraud can emerge after the first check passes. The mistake is treating identity as a gate instead of a continuously scored signal that changes with context.

Q: Should organisations prioritise dynamic liveness over static verification?

A: Yes, where remote onboarding or recovery is a high-value target. Dynamic liveness raises attacker cost because it is harder to replay or precompute, while static verification can be bypassed with increasingly accessible synthetic media tooling.

Technical breakdown

How attack-as-a-service packages verification bypass

Attack-as-a-service turns fraud techniques into a delivery model. Instead of one actor building everything from scratch, a marketplace seller may provide face swaps, deepfake generation, mobile emulation, metadata manipulation or even step-by-step bypass instructions. The buyer then applies those components against remote identity verification flows. That changes the threat from isolated abuse into a repeatable service chain. The important mechanism is modularisation: each step, from synthetic media creation to account onboarding, can be outsourced and recombined. Practical implication: treat verification bypass as an ecosystem problem, not a single-tool problem.

Practical implication: Map the end-to-end fraud path, not just the visible challenge step, so you can break the service chain at multiple points.

Why static liveness checks lose ground

Static liveness checks look for a one-time proof of presence, such as a fixed selfie or a simple motion response. The article argues that attackers increasingly target those checks with deepfakes, image-to-video conversion and virtual camera tooling. That creates an arms race where the fraud service can be updated faster than a static control can be re-validated. Dynamic liveness changes the attack cost because it forces interactive, context-aware responses that are harder to precompute or replay. Practical implication: a static proof of life is now an exposed assumption, not a durable control.

Practical implication: Prioritise dynamic liveness and adversarial testing where identity verification is a high-value entry point.

How criminal marketplaces scale identity fraud

The article describes a Crime-as-a-Service ecosystem where sellers maintain reputations, provide support and refine products based on customer feedback. That is operationally important because it means fraud methods are no longer improvised and brittle. They are becoming supported, documented and iterated like ordinary software services. The same market can also combine credential theft, document forgery, synthetic identity creation and target-specific bypass recipes into multi-stage operations. Practical implication: defenders need threat intelligence on the ecosystem, not just alerts on the final fraud event.

Practical implication: Track fraud marketplaces and trend shifts so control updates follow attacker productization rather than lag behind it.

Threat narrative

Attacker objective: The objective is to bypass identity verification at scale, create fraudulent accounts or access paths, and monetise the resulting fraud chain.

1. Entry occurs when a buyer purchases verification-bypass services, deepfake tooling, or pre-verified identities from a dark web marketplace.
2. Credential or identity artefacts are then assembled through face swaps, synthetic media, mobile emulation, or KYC bypass recipes.
3. The attacker escalates by combining multiple services into a multi-stage fraud chain that targets remote identity verification and onboarding flows.
4. Impact is account creation, onboarding abuse, and wider fraud at scale, with the ecosystem continuously refining the attack methods for resale.

Breaches seen in the wild

• JetBrains Marketplace AI Plugin Campaign: 15 malicious JetBrains Marketplace plugins steal AI API keys from 70,000+ developers via supply chain attack.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Attack-as-a-service is turning identity fraud into a governed supply chain. The key shift is not just automation but commercial packaging, where bypass techniques, deepfakes and onboarding services are sold as repeatable units. That creates a fraud market with specialised roles, support and feedback loops, which makes the attacker side more resilient than point-in-time controls. Practitioners should treat identity fraud as a supply chain problem, not a single fraud event problem.

Static identity assurance is now a weak assumption, not a stable baseline. Identity programmes that depend on one-time verification or periodic review assume the attacker must build capability on the spot. That assumption fails when the capability is purchased from a marketplace and refreshed continuously. The implication is that assurance now has to be evaluated as an ongoing adversarial process, not a checkpoint.

Identity fraud detection must follow attacker productisation, not just attacker volume. The article shows that threat actors are specialising, collaborating and iterating their offerings in the open market. That means the defender’s blind spot is often the service model itself, not the final fraudulent transaction. Practitioners should anchor controls to evolving fraud methods and ecosystem intelligence, not only to historical fraud cases.

Multi-step fraud is the real category change, not isolated credential abuse. The article describes buyers combining bypass tools, synthetic identities and supporting services into chained operations. That widens the blast radius because one compromised verification flow can feed onboarding abuse, account farming and downstream financial crime. The practitioner takeaway is that controls need to be designed around chained abuse paths, not single-step detection.

From our research library:

• Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.

What this signals

Attack-as-a-service changes the defender’s unit of analysis. The relevant question is no longer whether a single check can be spoofed, but whether the full identity journey can be assembled from commodity fraud services. When attackers can buy capabilities in pieces, the control boundary has to move from isolated verification steps to the whole onboarding and recovery workflow.

Identity fraud resilience now depends on adversarial adaptability. Static controls age poorly when attack recipes are being sold, reviewed and refined in criminal marketplaces. Practitioners should expect the strongest pressure on remote verification, account recovery and other journeys that can be chained into broader fraud operations.

Multi-step fraud is the named risk pattern worth tracking. The article describes buyers combining technical tools, bypass methods and pre-verified identities into operational fraud chains. That means detection, investigation and governance all need to look for joined-up abuse, not just individual failed checks.

For practitioners

• Review verification assumptions Inventory which onboarding and recovery paths still trust static proofs of life, single-document checks, or one-time selfie capture as sufficient identity evidence.
• Test for deepfake bypass resilience Run adversarial validation against face swap, virtual camera and image-to-video attack paths on the highest-risk identity journeys.
• Build fraud ecosystem monitoring Track dark web marketplace themes, tool categories and target lists so control changes reflect current attacker services rather than last quarter’s incidents.
• Separate high-risk journeys from routine verification Apply stronger checks where account creation, recovery, or high-value transaction access can be chained into broader fraud operations.

Key takeaways

• Identity fraud is being industrialised through purchasable attack services, which makes attacker capability easier to scale than many defender workflows.
• The article reports 31 new threat actor groups in 2024 and 34,965 tracked users, showing that the ecosystem is already large and active.
• Defenders need adaptive verification and ecosystem monitoring because static proofs and periodic updates do not keep pace with commoditised bypass methods.

Key terms

• Attack-as-a-Service: A criminal delivery model that packages attack capability for purchase, subscription, or on-demand use. In identity fraud, it turns verification bypass into a repeatable service with tooling, instructions, and operational support, which lowers the skill threshold and increases the speed of abuse.
• Dynamic Liveness: A verification method that checks for active, changing human presence rather than a static image or recorded artefact. It is designed to resist replay, deepfake, and virtual-camera attacks by requiring real-time interaction and freshness across the verification step.
• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• Identity Journey: An Identity Journey is the full sequence of authentication and authorization steps a person or machine follows to gain access to a service. It can include signup, login, MFA, recovery, step-up verification, and policy checks, all of which should be designed and governed as one control flow.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.