TL;DR: Identity fraud is becoming easier to execute at scale, with the report pointing to rising tactics, vulnerable industries, forged documents, deepfakes, and the growing regulatory response, according to SumSub. The practical challenge is that trust, verification, and fraud controls now have to keep pace with rapidly changing attack methods.
At a glance
What this is: This is SumSub's annual identity fraud report, which argues that fraud is becoming easier to execute and harder for existing verification controls to absorb.
Why it matters: It matters because IAM, fraud, and onboarding teams need to reassess how they verify people, detect manipulated identity evidence, and respond to rising fraud pressure across digital channels.
Context
Identity fraud is a governance problem, not just a detection problem. When false identities, forged documents, and manipulated media can pass early trust gates, the downstream impact shows up in account opening, payment flows, access decisions, and regulatory exposure.
This report frames identity fraud as a moving target across regions and industries, with 2024 used as the baseline for the trends it expects to intensify in 2025. For IAM and fraud teams, the key question is whether current verification and review models can still distinguish legitimate users from increasingly convincing false ones.
Key questions
Q: How should security teams prevent identity fraud during hiring and onboarding?
A: Security teams should place verification controls before account creation, not after. The best approach is to require stronger identity evidence for remote candidates, make high-risk approvals conditional on live or independently verifiable checks, and block entitlement assignment until assurance is sufficient. That keeps onboarding from turning a weak candidate identity into durable access.
Q: Why do deepfakes change identity verification requirements?
A: Deepfakes change requirements because they let attackers create believable but false evidence that can pass weak visual checks. Identity verification must therefore move from judging what looks real to verifying whether the entire evidence chain is trustworthy. That includes media authenticity, capture integrity, and stronger assurance criteria for higher-risk transactions.
Q: What are the signs that identity fraud controls are failing in a high-volume digital service?
A: Common signs include a surge in new accounts tied to weak proofing, unusual benefit or loan claims, repeated authentication exceptions, and growing disputes after disbursement. If fraud losses rise when speed controls increase, the programme is likely over-optimised for convenience. Teams should look for attack patterns that exploit rushed onboarding, account creation, and payment release.
Q: Should IAM and fraud teams share responsibility for session trust controls?
A: Yes. Once fraud detection relies on browser and device identity, IAM owns signal governance while fraud owns decision logic and case handling. Splitting those responsibilities too cleanly creates blind spots, because the quality of the fraud decision depends on the quality of the identity signal it consumes.
Technical breakdown
Forged identity evidence now targets the trust layer
Identity fraud increasingly exploits the point where systems decide whether a user, document, or credentialed claim should be trusted. That trust layer spans document checks, liveness signals, manual review, and risk scoring. When attackers can present convincing but false evidence, the failure is not just a weak document check but an overreliance on a single signal to establish identity. Fraud programs have to treat the trust decision as a layered control surface rather than a binary verification step.
Practical implication: teams should evaluate where one successful signal still unlocks too much downstream trust.
Deepfakes change the economics of verification
Deepfakes matter because they lower the cost of creating convincing identity artifacts while increasing the cost of certainty for defenders. Verification processes that once relied on static visual inspection or isolated video checks become less reliable when synthetic media can imitate real people and documents. The technical issue is not only media generation, but the way adversaries can chain synthetic evidence into onboarding, social engineering, and account recovery workflows.
Practical implication: teams should assume that media authenticity is no longer self-evident and needs layered validation.
Fraud controls fail when they stay disconnected from compliance
The report points to a rising regulatory response, which means fraud detection cannot sit apart from governance, auditability, and jurisdiction-specific obligations. Controls need to explain not only whether a user looks suspicious, but how the organisation would evidence its decision, escalation, and retention logic after the fact. That becomes especially important when fraud patterns differ by region and industry, because the same workflow may not satisfy both operational risk and compliance expectations.
Practical implication: align fraud review, case management, and evidence retention so decisions are defensible as well as accurate.
Threat narrative
Attacker objective: The objective is to obtain accepted identity trust and turn that trust into account access, financial gain, or downstream abuse.
- Entry begins when an attacker presents forged documents, manipulated media, or another false identity signal to a verification workflow.
- Credential or account access follows when the identity proofing step accepts the false claim and issues trust that should have been withheld.
- Escalation occurs as the fraudulent identity is used to open accounts, pass review, or move into higher-trust customer or administrative flows.
- Impact is realised through fraud, chargebacks, compliance exposure, and contamination of identity records that legitimate teams later have to unwind.
Breaches seen in the wild
- iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity fraud is now a trust-layer problem, not a single-control problem. When forged identity evidence can pass one check, the failure is usually in the way trust is accumulated across onboarding, manual review, and downstream access decisions. The issue is not simply more fraud attempts. The issue is that current trust models often assume one strong signal can safely stand in for a governed identity decision, which is no longer a safe assumption for IAM and fraud programmes.
Deepfake pressure changes what identity assurance has to prove. The presence of synthetic media means assurance can no longer depend on a snapshot view of authenticity. Verification now needs to prove consistency across signals, channels, and time rather than validating a single artefact in isolation. For practitioners, that pushes identity proofing toward higher-friction but better-evidenced decisioning, especially where account recovery or financial onboarding is involved.
Fraud operations and IAM governance are converging. Identity fraud used to be treated as a specialised fraud team issue, while IAM owned access policy and onboarding. That separation no longer holds when fraudulent identities are the entry point to access, transactions, and regulated customer relationships. The practical implication is that identity assurance, case handling, and access governance have to share a common evidence model.
Regional fraud variation is a governance signal, not just an analytics detail. When risk differs by region or industry, a uniform verification flow can create blind spots in one market and unnecessary friction in another. The better model is risk-adaptive identity governance: same control objectives, different assurance thresholds, review paths, and escalation criteria based on the exposure profile.
Identity fraud is accelerating faster than control redesign cycles. The report's central warning is not simply that fraud is growing, but that the attacker playbook is evolving faster than many verification programmes. That means practitioners should stop treating fraud controls as static onboarding tooling and start managing them as a living trust architecture that must be revised as attack methods change.
From our research library:
- Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.
What this signals
Identity fraud is becoming a programme design issue, not just an investigation issue. The practical response is to treat verification, review, and access decisions as one trust chain rather than separate functions. When the chain is broken, attackers do not need to defeat every control, only the one that grants durable trust.
Risk-adaptive assurance is becoming the right operating model. Uniform identity checks create either too much friction or too much exposure, depending on the journey. Teams should distinguish between low-risk and high-risk identity events, then match evidence requirements to the business consequence of a false acceptance.
For practitioners
- Tighten identity proofing thresholds Reassess which onboarding paths can still rely on single-signal verification and require layered checks where fraud impact is highest.
- Harden document and media verification Add detection for forged documents and manipulated media into review queues that support high-risk onboarding, recovery, and change-of-details requests.
- Separate low-risk from high-risk workflows Use risk-based routing so routine users do not inherit the same friction or assurance burden as accounts that trigger fraud indicators.
- Align fraud evidence with compliance Preserve reviewer notes, signal outputs, and escalation records so fraud decisions remain auditable across regions and regulated sectors.
Key takeaways
- Identity fraud now targets the trust decisions that sit in front of account creation, recovery, and regulated access.
- The report points to a fraud environment shaped by forged documents, manipulated media, and changing regional exposure.
- IAM and fraud teams need a shared assurance model, or attackers will keep exploiting the handoff between verification and governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article centres on verifying identities before access or trust is granted. |
| SP 800-63C — Federation | Identity trust decisions and downstream assertions depend on how identity is accepted and reused. | |
| Recommendation — Apply SP 800-63A to strengthen proofing steps for high-risk onboarding and recovery flows. Review federation and assertion-handling paths so false identity trust is not reused downstream. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Fraudulent identity acceptance becomes an access and authorization problem once trust is granted. |
| Recommendation — Tighten entitlement decisions after verification so high-risk identity events do not gain broad access. | ||
| CIS Controls v8 | CIS-5 — Account Management | Identity fraud often ends in unauthorized account creation or misuse. |
| Recommendation — Strengthen account lifecycle controls to prevent fraudulent identities from persisting as active accounts. | ||
| GDPR | Art.32 — Security of Processing | The report touches identity processing and the need for stronger trust and verification handling. |
| Recommendation — Treat identity verification workflows as security-of-processing controls and document the protective measures used. | ||
Key terms
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Deepfake: Synthetic or altered media created with AI or machine learning so that a person appears to say or do something they never did. In security terms, deepfakes are trust attacks that can distort identity verification, approval workflows, and fraud detection.
- Risk-Based Authentication: An access model that changes verification requirements based on the estimated risk of the request. It combines identity assurance, device posture, application sensitivity, and contextual signals to decide whether to allow, block, or step up verification before access is granted.
- Fraud Review: The process of evaluating whether an order is legitimate before goods are released. In curbside settings, fraud review becomes harder because teams have fewer verification cues than in shipped orders, so they must depend more on behavioral signals, order context, and tightly managed pickup procedures.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org