Digital identity fraud is shifting to deepfakes and fraud-as-a-service

At a glance

What this is: SumSub’s 2024 Identity Fraud Report shows that identity fraud is increasingly driven by deepfakes, ongoing-account abuse, and fraud-as-a-service economics.

Why it matters: IAM, fraud, and identity teams need controls that verify users continuously after onboarding, because the attack surface now shifts into the session, not just the enrollment flow.

By the numbers:

• Three-quarters, or 76%, of fraud occurs during ongoing account use.
• The global average identity fraud rate grew from 1.1% of all verifications in 2021 to 2.6% in 2024.
• Account takeover attacks surged by 250% year over year.

Context

Identity fraud is no longer concentrated at onboarding. In SumSub’s 2024 report, the strongest signal is that abuse now shows up during ongoing account use, where static KYC checks have already finished and the fraudster can operate inside a trusted session.

Deepfakes and fraud-as-a-service change the economics of identity attack. Fraudsters can buy capability, scale impersonation across channels, and blend synthetic media with account takeover, which means identity governance has to extend beyond enrollment into continuous verification and response.

Key questions

Q: What breaks when fraud controls only cover onboarding and not the rest of the user journey?

A: Stage-limited controls let fraudsters pass a clean entry point and then shift abuse into payments, payouts, or cash-out where governance is weaker. The result is a false sense of safety at onboarding and a late, expensive response later in the lifecycle. Teams need controls that carry identity risk forward, not reset it after approval.

Q: Why do deepfakes create more risk than ordinary identity fraud?

A: Deepfakes compress the time needed to impersonate a real person and make the attack look legitimate at the exact moment trust is granted. That means controls built for post-event review or manual judgment often react too late, especially in onboarding, recovery, and high-risk approvals.

Q: How should organisations detect fraud during ongoing account use?

A: Use session-level monitoring that looks for device drift, abnormal payment behaviour, recovery abuse, and unusual transaction sequencing. The goal is to catch when a legitimate account begins behaving like an impersonated or hijacked identity after the initial login has already succeeded.

Q: When should teams prioritise continuous checks over stronger onboarding controls?

A: When fraud is concentrated after authentication, continuous checks should take priority because they address the stage where the attacker actually monetises access. Stronger onboarding still matters, but it cannot compensate for a post-login control gap that lets a compromised or impersonated user operate undetected.

Technical breakdown

Why deepfakes now bypass enrollment controls

Deepfakes combine manipulated images, video, and voice to impersonate a real person well enough to pass weak identity checks. The issue is not just visual deception. Once synthetic media is cheap to produce and easy to iterate, the attacker can test against remote proofing, liveness prompts, support channels, and recovery workflows until one path succeeds. That makes the control problem broader than document fraud. It becomes a challenge of binding the presenting user to a trustworthy signal set across time, channels, and device context.

Practical implication: Treat deepfake resistance as a multi-signal verification problem, not a single document or selfie check.

Why ongoing-account fraud is now the main control gap

If 76% of fraud happens during ongoing account use, the weak point is no longer just identity proofing at signup. The control boundary has shifted to the authenticated session, where the attacker may already hold valid credentials or a recovered account and can act without re-entering the onboarding flow. This is why continuous checks matter: they look for anomalous behaviour, device drift, payment changes, or recovery abuse after trust has been granted. In identity terms, the issue is session integrity, not only identity creation.

Practical implication: Extend fraud detection into post-authentication monitoring and session-level risk scoring.

How fraud-as-a-service industrialises identity abuse

Fraud-as-a-service turns identity crime into a supply chain. One actor may sell synthetic identities, another may provide document templates, a third may run account takeover tooling, and a fourth may monetise stolen access. That division of labour lowers skill barriers and makes fraud more resilient to point fixes because one blocked tactic does not collapse the whole operation. Defenders need to think in ecosystems, not isolated events. The attack is organised around reuse, automation, and rapid substitution of tools and identities.

Practical implication: Map fraud detections to the broader enablement chain, not just the final account event.

Threat narrative

Attacker objective: The attacker aims to turn trusted identity access into repeatable financial gain by scaling impersonation, account takeover, and monetisation.

1. Entry occurs through deepfake impersonation, synthetic documents, or compromised credentials that let the fraudster reach trusted identity workflows.
2. Credential or account access is then abused during ongoing use, where the attacker operates after initial verification has already passed.
3. Escalation happens through account takeover, payment manipulation, or fraud-network coordination that amplifies the value of each compromised identity.
4. Impact is financial loss, account abuse, and at-scale fraud operations that can be repeated with low upfront cost.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ongoing-account fraud is the new centre of gravity in identity risk. SumSub’s finding that 76% of fraud happens during ongoing account use shows that enrollment-only governance is now structurally incomplete. The control assumption that identity risk peaks at onboarding no longer holds, because attackers increasingly wait until trust has already been granted. Practitioners should re-centre fraud governance on the authenticated session and the actions that follow it.

Fraud-as-a-service is a governance problem, not only a detection problem. When fraud capability is outsourced, the threat becomes modular and replaceable, which weakens the value of one-off blocking rules. This is where identity teams need to think in operational chains: impersonation, account takeover, recovery abuse, monetisation. The implication is that controls must measure how quickly an attack path is reconstituted after disruption, not only whether one tactic was stopped.

Deepfake fraud breaks the assumption that presentation equals person. A proofing programme designed for static signals assumes the presenting face, voice, or document is a reliable proxy for identity. That assumption fails when synthetic media can be generated cheaply and iterated rapidly. The implication is that practitioners must rethink trust binding across device, behaviour, and transaction context rather than treating a single biometric or image check as decisive.

Identity fraud is now a lifecycle issue across human IAM and NHI operations. The same governance weakness appears when organisations trust an identity too long after issuance, whether the subject is a customer, employee, or machine credential. The cross-domain lesson is that standing trust becomes exploitable once it is detached from continuous verification. Practitioners should align fraud controls with lifecycle events, not just initial authentication.

Fraud economics have crossed a threshold where scale defeats manual review. SumSub’s report describes losses that can dwarf the initial outlay for a fraudster group, which means defenders are facing an industrial model, not opportunistic abuse. That changes the security calculus for identity programmes: narrow review queues and ad hoc investigation will always trail a cheaply scaled attack market. Practitioners should treat identity fraud as a high-throughput adversary problem.

From our research library:

• Sophisticated multi-step fraud rose 180%, according to Sumsub's Identity Fraud Report 2025-2026.

What this signals

Ongoing-account fraud is becoming the decisive programme issue. Identity teams that still frame fraud as an enrolment problem will keep missing the point of compromise. The governance shift is from proving identity once to validating trust continuously, which means fraud operations, IAM, and customer security now overlap in the same control plane.

Deepfake resistance needs an identity proofing model that assumes signal substitution. Once voice, image, and video can be faked cheaply, the programme has to treat any single signal as insufficient evidence. The practical implication is a layered model that compares behaviour, device posture, and transaction context before granting durable trust.

For practitioners

• Instrument continuous verification after onboarding Add risk checks during account use, not only at signup, so changes in device, behaviour, recovery, and payment patterns can trigger step-up review or containment.
• Harden recovery and support pathways Review password reset, helpdesk, and account recovery flows for abuse paths that let impersonators bypass earlier proofing controls and seize a live account.
• Treat deepfakes as a multi-signal risk Combine document checks, liveness, behavioural data, and device context instead of relying on a single biometric or image test to confirm identity.
• Model fraud as a chain of capabilities Map how synthetic identity, account takeover tooling, and monetisation steps connect so detections can break the workflow rather than only one tactic.
• Tune fraud operations to rapid reconstitution Measure how quickly blocked actors switch tactics, identities, or channels, then adapt thresholds and case-handling rules to the attacker’s reuse speed.

Key takeaways

• Fraud is moving into the post-login phase, where static onboarding controls have the least visibility and the attacker has the most room to operate.
• SumSub’s report links that shift to a 4x rise in deepfakes, 76% of fraud occurring during ongoing account use, and a 250% surge in account takeover attacks.
• Identity programmes need continuous verification, stronger recovery governance, and fraud detection that follows the account through its lifecycle instead of stopping at enrolment.

Key terms

• Deepfake-Enabled Fraud: Deepfake-enabled fraud uses synthetic media, voice, or face manipulation to impersonate real people and bypass weak verification steps. It raises the bar for identity and fraud teams because traditional checks may not reliably detect fabricated presence, especially in high-volume digital onboarding and support channels.
• Fraud-As-A-Service: Fraud-as-a-service is the outsourcing of scam operations through rented tools, stolen data, and ready-made attack services. It lowers the skill needed to commit fraud and lets bad actors scale quickly across industries. For defenders, it means attacks are faster, cheaper, and more operationally organized than traditional one-off fraud attempts.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.