Entity network fraud exposes the limits of point-in-time KYB

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Trulioo's blog post: Entity network fraud uses clusters of registered businesses, shared infrastructure and timing patterns to bypass KYB checks that inspect each company separately.

Why it matters: Practitioners need network-aware KYB because isolated verification can validate each business record while still missing the fraud ring that links them all.

By the numbers:

• Federal authorities identified 89 companies at one address in the California hospice crisis.
• Authorities charged 15 people across nine interconnected investigations.

Context

Business fraud becomes harder to catch when verification is built around a single record instead of the relationships among records. In KYB, the gap is not whether a company exists, but whether the surrounding network of addresses, directors and formation patterns points to coordinated abuse.

That network lens matters because fraud rings can keep each entity superficially clean while the structure itself carries the signal. For readers who need the identity side of the problem, business identity verification is the next useful concept: the issue is not just entity existence, but entity relationships.

Key questions

Q: How should teams detect entity network fraud in KYB programmes?

A: Teams should look for shared directors, reused addresses, clustered formation dates and repeated billing relationships across supposedly separate entities. The key is to score connections, not just records, because fraud rings often keep each company individually plausible while the network as a whole reveals coordination.

Q: Why does point-in-time business verification miss coordinated fraud rings?

A: Point-in-time business verification misses coordinated fraud rings because each company can look legitimate on its own while sharing directors, addresses, phone numbers, bank accounts, devices, or filing agents. Effective detection needs network analysis, adverse-link screening, and ongoing monitoring of entity changes, not a one-off registry check at onboarding.

Q: What is the best way to monitor business registrations for fraud patterns?

A: The best way is continuous monitoring of registrations with network and pattern analysis across directors, addresses, incorporation agents, domains, and bank details. Compare new filings against known entity clusters, watch for repeated attributes, and trigger case reviews when multiple businesses show the same control points or rapid filing bursts.

Q: What controls reduce fraud risk when onboarding businesses at scale?

A: Use layered controls: registry and document checks, sanctions and adverse-media screening, beneficial ownership checks, director and address linkage analysis, device and IP risk signals, and post-onboarding monitoring. Add step-up review for high-risk sectors, unusual filing patterns, and shared control attributes so fraud rings are caught after initial approval.

Technical breakdown

How entity network fraud bypasses standard KYB checks

Standard KYB usually validates registration data, beneficial ownership and sanctions status at the entity level. That is enough to confirm that a business record exists, but not enough to reveal whether many entities are being used together as a fraud structure. When multiple companies share an address, directors or formation timing, the meaningful signal is in the graph between records, not in any single record. This is why a pass/fail model can be correct on every row and still miss the organised abuse pattern. See the KYB and Business Identity Verification Guide.

Practical implication: Shift review logic from entity validation alone to relationship analysis across addresses, directors and formation windows.

Why registration spikes matter more than static registry data

Static registry checks freeze a business at one moment in time. Fraud networks exploit that by forming entities in bursts, then moving directors, addresses or billing relationships after the initial check has passed. Registration velocity exposes those bursts because abnormal clustering in a postcode or time window is often a stronger fraud indicator than the content of one filing. The core problem is lifecycle, not existence: a clean record today can become a network risk tomorrow.

Practical implication: Add formation-velocity monitoring so onboarding does not become the only moment when KYB risk is assessed.

Entity graph analysis turns KYB into continuous due diligence

Graph-based KYB changes the unit of analysis from the company to the network. By linking beneficial owners, shared directors, common addresses and repeated filing patterns, it becomes possible to spot hubs and clusters that are invisible in a lookup workflow. This does not replace verification of the entity itself. It adds a second layer that asks whether the entity belongs to a structure that matches known abuse patterns.

Practical implication: Use continuous graph analysis to reassess business risk after onboarding, not only at account creation.

Threat narrative

Attacker objective: The objective is to use a web of registered entities to extract funds and legitimacy while staying below the threshold of single-entity verification.

1. Entry begins when attackers form apparently legitimate businesses that pass standard KYB checks because each record looks clean in isolation.
2. Credentialed trust is then built through shared directors, reused addresses and related billing infrastructure that make the network look operational.
3. Escalation follows as the network scales registrations across multiple entities, turning point-in-time verification into a blind spot.
4. Impact is large-scale Medicare and regulatory fraud that persists until network-level analysis exposes the cluster.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

KYB that stops at entity validity is structurally incomplete. The fraud pattern here is not a bad filing, but a network of filings that each look plausible on their own. That means the failure mode is not weak data quality alone, but the assumption that an entity can be risk-scored in isolation. Practitioners should treat relationship analysis as a core KYB control, not an optional enhancement.

Entity network fraud is the right named concept for this problem. It captures the shift from single-entity abuse to coordinated use of addresses, directors and registration timing to defeat point-in-time checks. The term matters because it tells risk teams where to look: not at one merchant or provider, but at the structure that connects many of them. That is the unit of detection practitioners need to govern.

Continuous monitoring is now a KYB requirement, not a nice-to-have. Once entities can be created, re-assigned and re-clustered after onboarding, a one-time pass no longer closes the risk. The governing question becomes whether the business relationship changed after approval, and whether the verification stack can see that change. Teams should build lifecycle monitoring around the network, not the application form.

Healthcare fraud is only the visible edge of a broader business identity problem. The same pattern can appear anywhere high-volume business onboarding meets weak relationship scrutiny, including marketplaces, financial services and public programmes. The lesson for identity and governance teams is that the control failure is portable even when the industry is not. KYB programmes must be designed for networks, not for isolated records.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Network-aware KYB will become the differentiator. Once fraud rings learn to distribute risk across many clean-looking entities, programmes that still rely on isolated record checks will keep approving the wrong businesses. Teams should expect the next generation of review workflows to shift from record validation toward graph-based risk scoring.

Continuous due diligence is the control shift this pattern demands. Approval can no longer be treated as the end of verification when owners, addresses and registrations can be rearranged after onboarding. That changes the operating model for business onboarding, merchant risk and public-programme integrity alike.

For practitioners

• Add relationship scoring to KYB review Score shared directors, common addresses and repeated formation patterns alongside entity-level checks so network links can influence approval decisions.
• Monitor registration velocity by postcode Flag sudden entity-formation spikes within a postal code or region and route them for manual review before the cluster grows.
• Reassess approved entities on a schedule Move beyond point-in-time onboarding by rechecking beneficial ownership, address reuse and director overlap after approval.
• Build escalation rules for network hubs Escalate cases where one person or address sits at the centre of multiple active businesses, especially when the businesses share sector or billing characteristics.

Key takeaways

• Entity network fraud defeats KYB by exploiting the relationships among businesses rather than the legitimacy of any single record.
• The hospice case shows that large-scale fraud can hide behind clean-looking registrations, shared infrastructure and clustered formation patterns.
• KYB programmes need continuous graph-based monitoring if they are meant to detect coordinated business abuse at scale.

Related NHI Mgmt Group resources: KYB and Business Identity Verification Guide · Merchant Fraud and Bust-Out · Identity Proofing and KYC Guide

Key terms

• Know Your Business: Know Your Business is the process of verifying that a company is legitimate, properly owned, and suitable for onboarding or continued trust. It goes beyond registration checks by testing beneficial ownership, sanctions exposure, and ongoing risk so organisations can defend why they accepted the relationship.
• Director Overlap: Director overlap is when the same person serves as a director for more than one company. In fraud and due diligence work, repeated director names across many entities can indicate common control, nominee arrangements, or a broader network that needs deeper screening.
• Beneficial Ownership: Beneficial ownership identifies the person or entity that ultimately controls or benefits from an account, company, or asset. In EDD, it matters because nominal ownership can hide the real decision-maker, which is often the entity regulators and investigators need to understand.
• Entity Graph: An entity graph is a structured model of identities, devices, applications, and relationships across a security environment. It lets teams resolve different identifiers to the same actor, preserving continuity across systems so investigations can follow activity without manual field matching.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It is designed for practitioners who need to connect identity controls to wider governance and risk programmes.