KYC abuse is getting cheaper: what should defenders change now?

TL;DR: Automated fraud inputs became cheaper in Q3 2026 as criminal marketplaces rebounded, AI reduced the cost of attack stages, and identity verification products, including KYC inputs, were openly traded, according to Kasada. The defensive shift is from document-centric checks to continuous fraud control across signup, login and recovery.

Editorial analysis by NHI Mgmt Group, based on content published by Kasada: “The Inputs to Automated Fraud Got Cheaper in Q3 2026”.

By the numbers:

• Listings rose 52% as sellers re-emerged on other platforms within weeks after a cluster of criminal marketplaces collapsed in August.
• KasadaIQ tracked 40+ identity exposures covering 344M+ records in Q3.
• Half of the displaced sellers were trading on a new platform within 18 days, and 90% within seven weeks.

Key questions

Q: What breaks when KYC is treated as the only trust control?

A: The control breaks because KYC only verifies that a presented identity package can pass a check.

Q: Why do cheap fraud inputs increase risk even when marketplaces are taken down?

A: Because a takedown usually removes a venue, not the seller network, stolen inventory or underlying demand.

Q: What are the signs that automated fraud is getting harder to stop?

A: Watch for faster script iteration, more reverse engineering discussion, higher-volume bot activity and account patterns that reuse the same devices or recovery paths.

Practitioner guidance

• Implement continuous fraud scoring across the full journey Carry risk from signup into login, recovery and checkout so a passing KYC check does not create automatic trust everywhere else.
• Correlate identity, device and behavior signals Use linked signals to spot the same fraud actor reusing documents, sessions or devices across multiple accounts and marketplaces.
• Raise controls on recovery and OTP paths Treat OTP bypass services and account recovery abuse as first-class fraud vectors, then tighten step-up checks where the loss is highest.

Bottom line: Automated fraud now behaves like a supply chain, with identity artefacts, bypass services and monetisation routes sold together.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →