Fraud is becoming an identity and transaction security problem

At a glance

What this is: Chainalysis argues that fraud has become an identity and transaction security problem, driven by AI-enabled scams, overseas criminal infrastructure, and crypto-linked monetisation.

Why it matters: This matters because fraud prevention now depends on identity verification, payment controls, and access governance working together before funds or credentials are lost.

By the numbers:

• At least $14 billion in cryptocurrency was transferred to addresses associated with scams and fraud in 2025.

Context

Fraud is no longer just an investigation problem after money has moved. In crypto and broader digital payments, the attack path now starts with identity manipulation, continues through transaction abuse, and ends with rapid monetisation across borders.

That shift matters for IAM, fraud, and payment-security teams because the control boundary has moved upstream. Identity verification, access governance, and transaction monitoring now have to stop the fraud before a victim authorises payment or a mule account is funded.

Key questions

Q: What breaks when payment fraud controls rely only on the transaction itself?

A: Controls fail when they treat the payment as isolated from the actor behind it. Fraudsters can reuse stolen, synthetic, or hijacked identities, making a transaction look normal while the surrounding identity context remains adversarial. Strong programmes connect device, behaviour, and account history so approval decisions reflect continuity, not just a momentary score.

Q: Why do AI scams increase fraud risk for identity and trust programs?

A: AI raises fraud risk because it makes deception cheaper, faster, and more convincing. Attackers can generate fake content, automate phishing, create deepfakes, and personalize social engineering at scale. That combination reduces the value of traditional pattern-based defenses and increases the chance of account takeover, fake account creation, policy abuse, and financial loss across customer-facing systems.

Q: What signals show that transaction monitoring is missing fraud networks?

A: A common signal is repeated reuse of the same wallet addresses, mule accounts, or scam-linked infrastructure across many cases. Another is when reports appear isolated even though the underlying cash-out path is shared. If the monitoring team cannot connect those patterns quickly, the organisation is seeing incidents but not the network behind them.

Q: How should firms balance fraud prevention duties across banks, crypto businesses, and platforms?

A: They should treat fraud prevention as a shared accountability problem that spans onboarding, authorisation, reporting, and cross-border disruption. The practical standard is that each firm owns the control points it can see, but no single institution can solve transnational fraud alone. That is why coordination, data-sharing, and escalation paths matter as much as detection tooling.

Technical breakdown

Identity manipulation is now part of the fraud kill chain

Modern fraud operations do not rely only on stolen cards or simple phishing. They use synthetic personas, social engineering, and AI-generated content to establish trust, influence victims, and defeat manual review. In that model, the identity layer is not a back-office concern. It is the first security control the attacker tries to weaken. Once a fraudster can create believable identities or impersonate trusted counterparties, downstream transaction controls are forced to make a decision with degraded context. That is why fraud, identity verification, and account-security decisions now sit on the same attack path rather than separate ones.

Practical implication: strengthen proofing and counterparty verification before transaction approval, not after suspicious activity is reported.

Crypto tracing turns transaction monitoring into network detection

Blockchain analytics changes fraud detection because a transaction is not an isolated event. Every wallet interaction can reveal links to scam infrastructure, laundering services, and cash-out points. That gives investigators and compliance teams a network view that conventional case-by-case review often misses. The operational value is not just tracing funds after loss. It is pattern recognition across many reports, where a single address or cluster can connect victims, mule activity, and repeat offenders. For security teams, the question becomes whether controls can correlate these patterns fast enough to block repeat abuse at scale.

Practical implication: integrate address intelligence and cluster analysis into transaction monitoring so repeated fraud patterns are blocked centrally.

Prevention must move to the point of authorisation

Reactive fraud handling assumes the loss has already happened and recovery is possible. That assumption fails in crypto and instant-payment environments, where funds can move too quickly for manual intervention. Prevention therefore has to happen at the authorisation boundary, where transaction risk, identity confidence, and behavioural signals are evaluated together. This is especially important when fraud is routed through legitimate customer accounts, because traditional perimeter controls do not see the deception. The governance challenge is to make fraud controls part of the decision to release value, not a separate investigation workflow.

Practical implication: treat authorisation-time risk scoring as a control requirement for high-risk payments and wallet transfers.

Threat narrative

Attacker objective: The attacker’s objective is to obtain and launder victim funds at scale while preserving the ability to reuse the same scam infrastructure across jurisdictions.

1. Entry begins with AI-assisted social engineering, impersonation, or other identity manipulation that convinces a victim or intermediary to trust the fraudster.
2. Credentialed access or authorisation is then abused when the victim approves a transfer, opens an account, or provides a route to move funds.
3. Funds are rapidly moved through mule accounts, mixers, or exchanges, making recovery and containment harder once the transaction completes.
4. The impact is financial loss, distributed laundering, and a wider criminal network that can reuse the same infrastructure against additional victims.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Fraud is now an identity security problem, not only a payments problem. The article shows that scams succeed when identity confidence is weakened at the point of trust, whether through impersonation, synthetic personas, or manipulated approval flows. That means fraud governance has to sit alongside IAM, verification, and transaction controls rather than being isolated in a back-office fraud queue. Practitioners should treat identity assurance as a fraud-prevention control surface.

Transaction monitoring is becoming a network problem. A single wallet address or account can now expose an entire fraud ecosystem when it is correlated across reports and blockchain traces. That changes the operating model from case handling to pattern disruption, where the goal is to recognise reuse, laundering paths, and infrastructure clusters early. The practitioner conclusion is clear: if monitoring cannot correlate across entities, it will miss the fraud ring.

Point-of-authorisation prevention is the decisive control shift. The article’s central governance lesson is that fraud controls lose value when they are only invoked after value has left the account. The important shift is to evaluate identity confidence, transaction behaviour, and counterparty risk before approval, especially where instant settlement limits recovery. Security teams should align fraud policy with the release of funds, not the review of losses.

Overseas fraud infrastructure exposes a jurisdiction gap in control design. The article makes clear that many of the highest-harm operations are transnational, which means domestic response alone is structurally insufficient. That creates a governance problem for firms as well as regulators: detection, reporting, sanctions, and mutual assistance all have to work across borders. Practitioners should assume fraud response will fail if it depends on a single jurisdictional control plane.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Fraud prevention is converging with identity governance. When scams succeed through believable personas and manipulated approvals, the real issue is whether the organisation can trust the actor at the moment of authorisation. That makes verification strength, account change controls, and transaction policy part of the same governance layer.

Cross-border fraud demands shared control points. The article’s main operational signal is that domestic detection is too slow when funds can move through international cash-out paths in minutes. Teams should prepare for response models that combine customer risk, entity resolution, and escalation workflows across legal and operational boundaries.

For practitioners

• Strengthen identity proofing before payment approval Require higher-assurance checks for new beneficiaries, account changes, and first-time transfers where fraud risk is elevated.
• Correlate wallet and account intelligence in monitoring Feed scam-linked addresses, mule indicators, and behavioural signals into transaction monitoring so recurring fraud patterns are recognised early.
• Move controls to the authorisation boundary Apply risk scoring and step-up review before funds leave the customer account, especially for instant payments and crypto transfers.
• Tighten fraud-response coordination across teams Ensure fraud, IAM, compliance, and investigations share case data quickly enough to block repeat abuse across channels and jurisdictions.

Key takeaways

• Fraud now exploits weaknesses in identity confidence and transaction approval, so the attack surface extends well beyond traditional case investigation.
• The article points to at least $14 billion in crypto-linked losses in 2025, which shows how quickly scam infrastructure can scale across jurisdictions.
• Security teams should move controls upstream, using stronger proofing and authorisation-time risk checks to reduce loss before funds leave the account.

Key terms

• Authorisation-Time Risk Scoring: A control method that evaluates the risk of a payment, transfer, or account action before it is approved. It combines identity confidence, behavioural signals, and counterpart risk so the organisation can stop fraud before value leaves the customer or firm.
• Fraud Network Detection: Fraud network detection is the process of identifying connected suspicious users rather than reviewing each account in isolation. It looks for shared signals such as identity reuse, device overlap, behavioural similarity, and linked infrastructure. This helps teams stop serial fraud that would otherwise appear as separate incidents.
• Identity Confidence: Identity confidence is the ability to trust that a credential, token, account, or delegated identity is still valid and safe after exposure. In ransomware and recovery scenarios, it becomes a resilience measure because restored systems are only trustworthy if their access paths are clean as well.
• Mule Account: A mule account is an identity or account used to receive, move, or obscure illicit funds on behalf of another party. In financial crime operations, it is the bridge between the initial deception and the laundering phase, often appearing legitimate until behavior reveals coordination.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in the context of broader identity risk. It is designed for practitioners who need to connect identity controls to operational security decisions.