Topic starter
23/06/2026 7:28 pm
TL;DR: Identity fraud is becoming easier to execute at scale, with the report pointing to rising tactics, vulnerable industries, forged documents, deepfakes, and the growing regulatory response, according to SumSub. The practical challenge is that trust, verification, and fraud controls now have to keep pace with rapidly changing attack methods.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Identity Fraud Report 2024-2025”.
Key questions
Q: How should security teams prevent identity fraud during hiring and onboarding?
A: Security teams should place verification controls before account creation, not after.
Q: Why do deepfakes change identity verification requirements?
A: Deepfakes change requirements because they let attackers create believable but false evidence that can pass weak visual checks.
Q: What are the signs that identity fraud controls are failing in a high-volume digital service?
A: Common signs include a surge in new accounts tied to weak proofing, unusual benefit or loan claims, repeated authentication exceptions, and growing disputes after disbursement.
Practitioner guidance
- Tighten identity proofing thresholds Reassess which onboarding paths can still rely on single-signal verification and require layered checks where fraud impact is highest.
- Harden document and media verification Add detection for forged documents and manipulated media into review queues that support high-risk onboarding, recovery, and change-of-details requests.
- Separate low-risk from high-risk workflows Use risk-based routing so routine users do not inherit the same friction or assurance burden as accounts that trigger fraud indicators.
Bottom line: Identity fraud now targets the trust decisions that sit in front of account creation, recovery, and regulated access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:29 am
Identity fraud is now a trust-layer problem, not a single-control problem. When forged identity evidence can pass one check, the failure is usually in the way trust is accumulated across onboarding, manual review, and downstream access decisions. The issue is not simply more fraud attempts. The issue is that current trust models often assume one strong signal can safely stand in for a governed identity decision, which is no longer a safe assumption for IAM and fraud programmes.
A few things that frame the scale:
- Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.
A question worth separating out:
Q: Should IAM and fraud teams share responsibility for session trust controls?
A: Yes. Once fraud detection relies on browser and device identity, IAM owns signal governance while fraud owns decision logic and case handling. Splitting those responsibilities too cleanly creates blind spots, because the quality of the fraud decision depends on the quality of the identity signal it consumes.
👉 Read our full editorial: Identity fraud in 2024-2025 is accelerating beyond current controls