Marketplace risk in 2026 is becoming an identity problem

At a glance

What this is: This article argues that marketplace risk in 2026 is increasingly an identity governance problem, not just a fraud tooling problem.

Why it matters: It matters because trust and safety teams cannot connect onboarding, transaction, and investigation signals without identity context, which leaves them reacting after abuse has already spread.

Context

Marketplace risk covers the controls, signals, and operating model a platform uses to decide who can join, transact, and continue participating safely. The gap in many programmes is not a lack of fraud detection tools, but a lack of a unifying identity layer that ties those tools together across the user lifecycle.

That problem becomes sharper as platforms scale and product surfaces multiply. When onboarding, account creation, payments, messaging, and post-incident review all run on separate control planes, trust and safety teams lose the ability to govern identity consistently, and the result is weaker decisioning across the entire marketplace.

Key questions

Q: What breaks when marketplace risk tools do not share an identity layer?

A: When marketplace risk tools do not share an identity layer, teams can see behaviour but not reliably connect it to the same actor across onboarding, recovery, transactions, and investigations. That fragmentation increases false positives, weakens evidence, and lets repeat abuse re-enter through different signals. Identity correlation is what turns isolated checks into enforceable trust decisions.

Q: Why do layered fraud controls still leave marketplaces exposed?

A: Because layered controls often answer different questions without establishing who the user is. Device, payment, and behavioural checks can reduce noise, but they do not create a single identity record that carries through the user lifecycle.

Q: What are the signs that a trust and safety programme is too tool-driven?

A: The clearest signs are duplicated signals, manual stitching between systems, inconsistent decisions across teams, and investigations that start from fragmented evidence. Those symptoms usually mean the platform has controls, but not a coherent identity model.

Q: How should marketplaces balance product growth with stronger identity controls?

A: They should treat identity review as part of release governance, not as a post-launch fix. When new features create new abuse surfaces, the identity controls, escalation paths, and ownership model need to be updated before exposure increases.

Technical breakdown

Why layered fraud tools still miss the identity layer

Many marketplace control stacks are assembled one use case at a time. Device fingerprinting, behavioural analytics, payment checks, bot detection, and moderation each answer a narrow question, but none of them alone establishes who the user actually is. That creates a governance gap: the platform can observe activity without being able to unify it into a durable identity picture. In identity terms, the organisation has signals, not assurance. The problem is structural, because each point control can be bypassed, fragmented, or interpreted differently by separate teams.

Practical implication: treat identity resolution as a core control layer, not a downstream enrichment step.

How identity context changes trust and safety operations

Identity context lets platforms connect events across onboarding, account creation, transactions, and investigations. Without that linkage, teams see isolated anomalies instead of a complete abuse pattern. With it, they can distinguish a legitimate user from a reused device, a synthetic profile, or a coordinated fraud cluster. This is why identity becomes the organising principle for trust and safety architecture: it makes detection, escalation, and response operate on the same subject rather than on disconnected signals.

Practical implication: build lifecycle correlation into your risk architecture so investigations do not start from zero each time.

Why product velocity widens the fraud gap

The article shows that new product surfaces create new abuse opportunities faster than safety controls are updated. When messaging, AI-driven content, or new onboarding flows ship before risk controls are redesigned, attackers get a window to experiment. That is not just a tooling issue. It is a lifecycle issue, where identity review, control design, and product release processes are not tightly coupled. In practice, this means abuse prevention lags feature development.

Practical implication: move trust and safety reviews earlier in the product lifecycle so identity controls change with the platform.

NHI Mgmt Group analysis

Marketplace risk is becoming an identity governance problem, not a fraud tooling problem. The article describes a familiar pattern: platforms accumulate many detection tools but still cannot answer basic questions about who is behind activity. That is an identity governance failure because the organisation can monitor behaviour without being able to establish or maintain trustworthy identity context. Practitioners should treat identity resolution as the foundation for trust and safety decisions, not as an optional enhancement.

Identity resolution debt: disconnected risk tools create an evidence pile, not a governed view of the user. Device, payment, behavioural, and moderation signals each add value, but they do not become dependable until the platform can correlate them across the lifecycle. This is the same control problem that appears in other identity programmes when ownership, linkage, and lifecycle state are unclear. The conclusion is simple: if identity cannot be carried across systems, the control stack will stay reactive.

Product velocity is now a trust and safety risk multiplier. New features expand the attack surface before controls are recalibrated, which means abuse is often discovered after a launch rather than designed out beforehand. That puts pressure on product, risk, and identity teams to operate from the same control model. Platforms that cannot embed identity review into release governance will keep paying for speed with higher fraud exposure.

AI-driven scams make identity assurance more valuable, not less. As synthetic identities and generated abuse content become easier to produce, behavioural signals alone become less reliable. The practical lesson for the field is that fraud prevention increasingly depends on verified identity context at the point of onboarding and transaction, not just on downstream detection. Teams should anchor trust and safety on identity assurance that can survive automation.

The market is moving toward identity-led platform governance. Trust and safety teams that can influence identity architecture, product design, and investigation workflows will be better placed to reduce abuse without slowing growth. That aligns with broader NIST-CSF thinking around access and governance, but the marketplace context demands tighter linkage between identity proofing and operational risk decisions. Practitioners should re-centre control design on the identity layer.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Identity resolution debt: marketplaces that keep adding controls without unifying identity context will continue to see the same abuse patterns surface through different channels. The operational fix is not more dashboards, but a governed identity model that connects the full lifecycle.

Trust and safety programmes now depend on whether product, risk, and identity teams can work from the same release and investigation logic. If those functions stay disconnected, attackers will keep benefiting from the gap between feature velocity and control readiness.

For practitioners

• Define a marketplace identity layer Map the identity data needed to connect onboarding, account creation, transactions, and investigations into one governed view.
• Break down tool silos Inventory fraud, moderation, payment, and device signals, then specify where each signal enters the decisioning path and who owns it.
• Move trust and safety earlier in release governance Require identity and abuse reviews before new product surfaces, messaging features, or onboarding flows go live.
• Strengthen identity assurance at onboarding Use verified identity context to reduce synthetic profiles and make later transaction and investigation signals more trustworthy.

Key takeaways

• Marketplace risk is increasingly governed by whether a platform can establish identity context across the full user lifecycle.
• A pile of fraud tools does not equal a coherent trust model when signals cannot be correlated around the same subject.
• The most effective change is to embed identity review into release governance so controls move with product velocity.

Key terms

• Identity Resolution: Identity resolution is the correlation step that determines whether multiple accounts belong to the same person or accountable role. It combines identifiers, context, and system-specific attributes to reduce false splits and missed matches, which is what makes governance outputs dependable rather than approximate.
• Trust And Safety: Trust and safety is the combined discipline of preventing abuse, reducing harm, and preserving legitimate participation in a digital community. In identity programmes, it links verification, moderation, and lifecycle governance so account confidence and user experience are managed together.
• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• Identity Assurance: The confidence an organisation has that a person or system is truly who it claims to be before access or action is granted. In modern IAM, assurance depends on evidence quality, channel trust, and the strength of verification around high-risk decisions.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps practitioners connect identity control thinking to the broader security and risk programmes they run.