Notifications
Clear all
Topic starter
06/09/2026 6:20 pm
TL;DR: Fraud prevention is moving beyond static rules as deepfakes, synthetic identities, phishing, and account takeover increasingly bypass traditional checks, according to Innov8tif. Identity verification now has to combine document authentication, liveness detection, real-time monitoring, and risk-based decisioning because trust failures are happening at onboarding and during session activity, not only after compromise.
NHIMG editorial — based on content published by Innov8tif: Insights Fraud Prevention Best Practices: Staying Ahead in the Digital Age
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 30.9% of organisations store long-term credentials directly in code.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams reduce synthetic identity fraud in customer onboarding?
A: Security teams should combine document proofing, data validation, device intelligence and reputation checks in a single onboarding policy.
Q: Why do deepfakes create a bigger risk for mobile KYC than traditional document fraud?
A: Deepfakes let an attacker keep the document authentic while fabricating the person presenting it.
Q: What are the signs that risk-based authentication is failing?
A: Common signs include repeated false positives on normal users, obvious high-risk sessions that still pass through without step-up, and fraud cases that appear after apparently successful logins.
Practitioner guidance
- Harden identity proofing at enrolment Require layered eKYC controls that combine document authentication, liveness detection, and facial verification so no single signal can establish trust on its own.
- Link fraud signals to IAM policy Feed device reputation, behavioural anomalies, and failed verification patterns into step-up rules and recovery decisions so authentication changes when risk changes.
- Review account recovery as an attack path Treat password resets, SIM swaps, and help-desk resets as privileged trust events and apply stronger review to high-risk recovery scenarios.
What's in the full article
Innov8tif's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step eKYC workflow design for document capture, liveness detection, and facial verification
- Operational scoring and decisioning logic for pass, fail, and step-up outcomes
- Examples of how the EMAS eKYC suite handles watchlists, sanctions, and PEP screening
- Implementation detail on passive liveness detection and OCR validation in onboarding flows
👉 Read Innov8tif's analysis of fraud prevention best practices and eKYC controls →
Deepfakes, synthetic identities, and eKYC: what teams need now?
Explore further
06/09/2026 6:21 pm
Synthetic identity fraud is now a lifecycle problem, not just an onboarding problem. Fraud teams often focus on first-touch verification, but synthetic identities gain credibility over time through repeated low-risk interactions. That means identity proofing, transaction monitoring, and account recovery must be governed as one control surface, not separate functions. Organisations that only harden onboarding will still leave a long-tail trust exposure in the account lifecycle.
A question worth separating out:
Q: Should fraud and IAM teams manage authentication policy together?
A: Yes. Fraud controls and IAM controls intersect at enrollment, recovery, and step-up decisions, so split ownership creates blind spots. Shared policy governance helps teams tune friction, monitor trust signals, and respond faster when identity abuse moves from one workflow to another.
👉 Read our full editorial: Fraud prevention now depends on identity verification that adapts
