Systemic identity verification failures are enabling banking fraud

At a glance

What this is: This article argues that static identity verification and siloed account monitoring are failing to stop banking fraud that uses U.S. deposit accounts as laundering infrastructure.

Why it matters: It matters because fraud, AML and identity teams need controls that keep validating identity after onboarding, not just at the point of account creation.

Context

The core problem is not simply fraud volume, but the weakness of the identity controls that sit in front of bank account opening and account usage. When static personal data can be harvested, reused or synthesised, traditional verification loses discriminatory power and downstream monitoring inherits a bad trust decision.

In banking, that trust gap becomes an identity governance problem as much as a fraud problem. Once an account is opened with poor assurance, mule activity, laundering and victim fund movement can proceed through ordinary financial rails unless institutions combine behavioural signals, device intelligence and network-level visibility.

The article frames the U.S. banking system as a conduit for transnational crime, which is a typical pattern whenever onboarding checks are treated as a one-time event rather than a lifecycle control.

Key questions

Q: How should financial institutions reduce fraud when static identity data is widely exposed?

A: They should stop treating static PII as sufficient proof and instead combine documentary, behavioural and device-based signals with risk-based review. The goal is not to eliminate verification, but to make it harder for stolen or synthetic identity data to pass as durable trust evidence across onboarding and later account activity.

Q: Why do mule accounts make transnational fraud harder to stop?

A: Mule accounts distribute stolen funds across many legitimate-looking endpoints, which makes thresholds, alerts, and single-account review much less effective. The fraud pattern is relational, so the useful signal is often the cluster, not the individual account. Institutions need graph-based analytics and shared intelligence to see the network.

Q: What signals indicate that identity verification is too weak for fraud prevention?

A: Frequent overrides, low-friction approvals for resets, repeated exceptions for known callers, and no transaction-bound verification are all warning signs. If staff can complete a high-risk action using only conversational context, the control design is failing. Strong programmes measure whether the verification step actually blocks synthetic requests, not just whether it is completed.

Q: Should banks prioritise continuous identity assurance or stronger onboarding checks?

A: They should do both, but continuous assurance usually provides more value once onboarding controls are already in place. Strong onboarding reduces bad entries, while continuous assurance catches identity drift, mule behaviour and post-opening exploitation that point-in-time verification will miss.

Technical breakdown

Why static PII verification fails against modern fraud

Static personally identifiable information such as name, date of birth, SSN and address is no longer a strong proofing signal because it is widely exposed through breaches and data brokers. That makes identity verification vulnerable to replay, fabrication and synthetic layering. Fraudsters can combine stolen data with AI-generated narratives, deepfake media and spoofed behavioural cues to pass point-in-time checks. The technical flaw is not just weak data quality. It is that the assurance model assumes the data remains exclusive to the legitimate person when it often does not.

Practical implication: Treat PII as an input signal, not an assurance endpoint, and combine it with stronger identity proofing and ongoing authentication controls.

How mule accounts turn identity failures into laundering infrastructure

A mule account is a legitimate-looking account used to receive and move illicit funds for someone else. In the pattern described here, false or stolen identities are used to open deposit accounts, then money is rapidly transferred onward, often through cryptocurrency or multiple intermediary accounts. Automated onboarding makes this scalable because weak checks can be repeated across many institutions. The real control failure is lifecycle visibility. If banks cannot correlate account creation, device patterns, funding flows and linked identities, each account looks isolated even when it is part of a coordinated laundering network.

Practical implication: Correlate onboarding, device and transaction data across the account lifecycle so mule patterns can be detected as networks, not isolated events.

Why account-opening controls are no longer enough

The article’s central technical claim is that fraud detection cannot stop at opening a deposit account. Account opening is only the entry point; the risk continues as the account is used to receive, fragment and export value. That means continuous identity assurance matters more than a single pass or fail at onboarding. Banks need controls that re-evaluate identity confidence when behaviour changes, when funding patterns become unusual, or when related accounts share infrastructure. This is the same governance shift seen in other identity domains: assurance must follow the identity through its lifecycle, not just certify the initial event.

Practical implication: Move from one-time verification to continuous assurance that re-checks identity confidence when behaviour, device or transaction patterns change.

Threat narrative

Attacker objective: The attacker objective is to create trusted-looking U.S. deposit accounts that can receive, layer and export illicit funds at scale.

1. Entry occurs when criminals use stolen, synthetic or AI-assisted identity evidence to pass account-opening checks at a bank or fintech.
2. Credential or identity abuse follows when the newly opened deposit account is controlled by the fraud network rather than the named account holder.
3. Lateral movement and laundering happen as funds are dispersed across linked accounts, converted to cryptocurrency or moved offshore to obscure the trail.
4. Impact is the conversion of the banking system into infrastructure for fraud proceeds, mule operations and transnational money laundering.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static PII verification is now a trust failure, not a proofing strategy. Once name, date of birth, SSN and address are broadly available, they stop being durable identity evidence and become reusable inputs for fraud. The governance problem is that many banking controls still treat those fields as if they meaningfully establish uniqueness. Practitioners should redesign assurance around layered, confidence-based identity decisions.

Deposit accounts have become laundering infrastructure when lifecycle visibility is missing. The article correctly identifies the critical choke point: criminals need accounts that can receive and move money. That makes account monitoring, identity linkage and network analytics part of identity governance, not just fraud monitoring. A bank that sees only single accounts will miss the syndicate pattern that connects them.

Continuous identity assurance is the named concept this article surfaces. The key failure is the assumption that identity can be validated once and then trusted indefinitely. In banking, that assumption collapses when AI-assisted fraud, device reuse and cross-institution account proliferation are in play. The practical conclusion is that identity verification and transaction monitoring must be designed as linked controls across the full customer lifecycle.

Cross-institution coordination is becoming a control requirement, not an optional enhancement. Fraud rings exploit the gaps between institutions, where one bank cannot see what another bank has already validated or rejected. That means industry visibility, lawful data sharing and shared typology development matter to fraud defence in the same way common logging matters to cyber defence. Teams should treat isolation between institutions as an adversary advantage.

Behavioural and device signals are now part of identity governance. In this threat model, the person, the device and the transaction pattern all contribute to assurance. A strong identity programme must therefore govern not only who the customer claims to be, but whether their session, device and funding behaviour match the expected trust profile. The implication for practitioners is to operationalise assurance beyond static onboarding.

What this signals

Continuous identity assurance is becoming the practical boundary between fraud control and account opening theatre. If banks only validate identity once, they are trusting data that criminals can buy, synthesise or replay. The programme implication is to move assurance into lifecycle operations, where device change, funding velocity and account linkage can trigger renewed scrutiny.

Deposit-account abuse is a governance problem as much as an AML problem. Identity teams, fraud teams and AML teams need a shared view of who is controlling an account and whether that control is consistent with the stated identity. When those functions remain siloed, mule networks can exploit the gaps between them.

Identity proofing, behavioural analytics and network visibility need to operate as one control plane. The point is not to collect more data indiscriminately. It is to use the right signals at the right moment so banks can distinguish genuine customers from coordinated fraud operations before funds are moved beyond recovery.

For practitioners

• Implement continuous identity assurance Extend verification beyond onboarding so customer risk is re-evaluated when device, behavioural or funding patterns change. Use this to catch synthetic identities and mule activity that would pass a one-time check.
• Add device and behavioural signals to fraud decisions Fuse behavioural biometrics, device intelligence and transaction context into fraud scoring so the same PII cannot be reused as the sole trust basis across accounts.
• Build network analytics for linked accounts Use graph analysis to connect accounts that share devices, IPs, phone numbers or funding sources, then investigate clusters rather than isolated alerts.
• Create cross-institution fraud escalation paths Establish lawful information-sharing workflows with peers and relevant authorities so repeated onboarding patterns and mule indicators can be correlated across the industry.
• Separate customer confidence from account lifecycle events Treat account opening, funding, large-value movement and rapid cash-out as distinct trust checkpoints instead of one approval decision that carries the account forever.

Key takeaways

• Static identity data is no longer a reliable trust anchor for banking, because it can be reused by fraud groups and synthetic identity operations.
• The article shows how deposit accounts become laundering infrastructure when institutions cannot see linked devices, linked identities and repeated onboarding patterns.
• The most effective response is to shift from one-time verification to continuous identity assurance supported by behavioural, device and network-level controls.

Key terms

• Static Identity Verification: Static identity verification is the use of fixed personal data, such as name, date of birth, address and government identifiers, to decide whether a person is who they claim to be. It is weak when that data is already exposed, reused or synthesized, because the signal proves data possession rather than genuine identity control.
• Mule Account: A mule account is an identity or account used to receive, move, or obscure illicit funds on behalf of another party. In financial crime operations, it is the bridge between the initial deception and the laundering phase, often appearing legitimate until behavior reveals coordination.
• Continuous Identity Assessment: An approach that evaluates trust after onboarding, not only at account creation. It is especially relevant in marketplaces because risk shifts during recovery, payout changes, and high-value transactions, where a once-trusted identity may no longer deserve the same confidence.
• Network Traffic Analytics: Network traffic analytics is the process of turning communication data into security decisions. It helps teams identify expected and unusual flows, detect policy gaps, and validate whether segmentation controls are working. In practice, it combines flow data, behavioural patterns, and context so analysts can act quickly instead of reviewing raw logs by hand.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, identity lifecycle and secrets management. It helps practitioners connect identity control design to the wider security programme they are responsible for.