Second-party fraud exposes the gap between KYC and account use

At a glance

What this is: This article argues that KYC can clear a real person at onboarding while missing the later handover of that verified account to someone else.

Why it matters: It matters because fraud, AML, and identity teams need controls that keep validating account use after approval, not just the person who first passed the check.

Context

Second-party fraud is a governance gap, not just a fraud pattern: the identity on file is real, but the person operating the account may change after verification. That split matters because onboarding checks answer one question, while account-use controls answer another, and most programmes still treat them as the same problem.

In crypto, this gap shows up when accounts that passed KYC later move scam proceeds under a verified name. The article’s core point is that identity assurance has to extend beyond the first approval gate, because a clean onboarding event does not prove ongoing account legitimacy.

Key questions

Q: What breaks when KYC clears the wrong risk?

A: KYC breaks when it is treated as proof of ongoing account legitimacy rather than proof that a real person existed at onboarding. The failure is temporal: the account can later be rented, coerced, or handed over while still looking valid on paper. Teams need controls that detect operator drift after approval, not just stronger document checks at signup.

Q: Why do verified accounts still become money mule accounts?

A: Verified accounts become mule accounts because legitimacy at enrollment does not prevent later handover. A real person can open the account, pass checks, and then rent, sell, or surrender it to someone else who uses it for illicit transfers. The risk increases when monitoring stops at approval instead of tracking whether account use still matches the verified owner.

Q: What are the signs that a verified identity has been handed over?

A: The most common signs are a new device or emulator, a sudden geography change, clustered password or recovery updates, and behavioural patterns that diverge from the account's earlier history. None of these signals proves intent on its own, but together they indicate that the operator may no longer be the verified person.

Q: How should fraud teams govern post-KYC account trust?

A: Fraud teams should govern trust as a lifecycle state, not a one-time approval. That means combining onboarding evidence with runtime signals, setting re-verification triggers for material behaviour changes, and coordinating fraud, AML, and identity functions so each sees the same operator-drift risk. The goal is to stop treating a verified account as permanently trustworthy.

Technical breakdown

Why KYC verification does not prove ongoing account legitimacy

KYC is an identity proofing control, not a perpetual operating licence. It establishes that a person was real and eligible at the moment of onboarding, but it does not answer whether that same person still controls the account later. That distinction matters in second-party fraud, where a verified account can be rented, sold, coerced or handed over after initial approval. The security problem is temporal: verification is a snapshot, while misuse happens across the account lifecycle. Effective governance therefore depends on linking enrollment evidence to later authentication, device, and behaviour signals rather than assuming the initial proof remains valid indefinitely. See the Identity Proofing and KYC Guide.

Practical implication: Treat onboarding success as the start of monitoring, not the end of assurance.

Why account handovers are hard to distinguish from legitimate use

A verified account can change hands without changing the underlying identity record, which makes the fraud difficult to classify from registration data alone. Synthetic fraud tries to beat verification with forged or stolen identity evidence, while second-party fraud uses a real, verified identity and then transfers account operation later. That creates an evidentiary blind spot: the account may still look valid while the operator has changed. From a control design perspective, this means institutions need post-onboarding signals such as device continuity, login geography, behavioural drift, and recovery event clustering to detect the handover pattern. See the Identity Fraud Prevention Guide.

Practical implication: Build detection logic around operator-change signals, not just identity-document quality.

Why continuous adaptive trust matters more than a one-time verdict

The article’s strongest technical point is that trust cannot be treated as binary once an account is opened. Continuous adaptive trust means risk is recalculated as context changes, including device changes, unusual recovery events, and transactional patterns that diverge from the account’s baseline. That is a better fit for second-party fraud because the abuse often starts after a legitimate approval. In practice, this shifts security from proving who someone was at signup to testing whether the account is still operating within the conditions that justified trust in the first place.

Practical implication: Move trust decisions into the lifecycle, where new signals can change the risk score.

Threat narrative

Attacker objective: The attacker seeks to move illicit funds through a trusted account while avoiding the detection that would follow a failed verification or obvious account takeover.

1. Entry occurs when a verified account is opened by a real person, then later rented, sold, coerced, or handed over to a different operator.
2. Credential access is not always stolen in the classic sense; the fraudster inherits a trusted identity and its approved access path.
3. Escalation happens when the new operator uses the cleared account to move scam proceeds while preserving the account's legitimate appearance.
4. Impact is the laundering of illicit funds through accounts that already passed KYC, which obscures who actually controlled the account at the time of abuse.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Second-party fraud is the failure mode most IAM and fraud programmes still under-model. The industry knows how to detect first-party deception and third-party account takeover, but it often lacks a governance model for a real identity that later becomes a rented or coerced operating surface. That gap matters because the account is not fake, and the operator may not be the verified owner. Practitioners should treat this as a distinct control category, not a variant of generic fraud.

Identity proofing and operating authority are separate security facts. The article shows that many controls still assume the person who passed KYC is the person who continues to use the account. That assumption fails once account rental, coercion, or delegated use enters the lifecycle. The implication is that fraud, AML, and identity governance teams need a shared model for operator drift, not isolated decision points.

Verified identity reuse is the real asset being monetised. The article describes a market where scammers do not merely buy access, they buy a clean history that has already passed scrutiny. That is a different threat from credential theft because the account can remain compliant on paper while its use changes underneath the control surface. Practitioners should watch for any programme that measures onboarding quality but not post-onboarding legitimacy.

Account lifecycle controls need to be tuned for evidentiary ambiguity. The article makes clear that an investigator often cannot tell from the account alone whether the operator was paid, duped, or coerced. That means governance cannot depend on clean intent classification before action. The practical implication is to design controls that react to behavioural and lifecycle signals even when motive remains uncertain.

Money mule detection and identity fraud prevention now overlap operationally. The same infrastructure that catches fraudulent account creation also needs to detect later account handover and monetisation. That convergence is why a identity fraud prevention guide lens is relevant here: identity fraud is no longer confined to signup abuse. Security teams should align fraud, AML, and identity telemetry around the same account lifecycle.

What this signals

Trust has to become a lifecycle decision: the article shows why account approval cannot be the final trust event. Institutions that only measure verification quality will miss the far more important question of whether the current operator still matches the verified identity, and that gap is where mule activity persists.

The operational shift is toward continuous post-onboarding validation, especially where verified identities can be rented, coerced, or transferred. That makes device continuity, recovery-event clustering, and behaviour drift core governance signals rather than secondary fraud features.

Fraud, AML, and identity teams should converge on one operating model for operator drift. If the account can change hands without changing the record, then the programme has to watch the lifecycle, not just the door.

For practitioners

• Define second-party fraud as a separate control class Create an explicit taxonomy for verified identities that later become rented, coerced, or delegated accounts so analysts do not force every case into first-party or third-party fraud.
• Monitor post-onboarding operator drift Correlate login device changes, geography shifts, recovery event bursts, and behavioural drift after approval because those are the earliest signs that a verified account changed hands.
• Separate proofing evidence from ongoing legitimacy evidence Keep the onboarding artefacts that proved a person was real distinct from the runtime signals that show whether the current operator still matches the approved risk model.
• Tune fraud and AML thresholds for handover patterns Raise review priority when a previously clean account suddenly starts moving funds in ways that match mule activity, even if the original identity checks were strong.
• Reverify high-risk accounts after meaningful change Trigger fresh checks when usage, device, or transaction behaviour changes enough to suggest the verified identity and the active operator may no longer be the same.

Key takeaways

• Second-party fraud fills the gap between genuine onboarding and later account misuse, which is why KYC alone cannot prove who is operating an account.
• The article ties the problem to large-scale illicit flows through accounts that already passed verification, showing that the exposure is operational, not theoretical.
• Controls that watch for post-approval drift, handover signals, and re-verification triggers are the ones most likely to reduce this failure mode.

Related NHI Mgmt Group resources: Identity Fraud Prevention Guide · NHI Lifecycle Management Guide · Money Mule Detection Guide · Identity Data Privacy and Consent Guide

Key terms

• Third-Party Fraud: Third-party fraud is fraud committed by an external attacker who steals, impersonates, or hijacks someone else’s identity. Common forms include account takeover, identity theft, and bot-driven abuse. The main control challenge is distinguishing legitimate user behaviour from an attacker operating inside a trusted account or session.
• Money mule: A money mule is an account holder or intermediary used to receive and move fraudulent funds on behalf of a criminal. Mule activity is part of the execution layer of many scams because it helps obscure the final destination and complicates recovery, tracing, and reversal.
• Runtime Drift: Runtime drift is the gap between an AI agent’s approved authority and its actual behaviour as conditions change. It appears when the agent adapts to new context, new integrations, or new instructions and begins acting outside the scope that governance originally defined.
• Continuous Adaptive Trust: Continuous adaptive trust is a runtime access model that adjusts permissions as an agent behaves. Access is time-bound, purpose-bound, and context-aware, then reduced or revoked when actions drift from expected intent. It is a stronger fit for agents than static entitlements alone.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.