Topic starter
10/06/2026 10:39 pm
TL;DR: Fraud attempts are dropping while success rates are rising because AI, deepfakes, and poor data sharing make impersonation easier and detection harder, according to SumSub episode with counter fraud expert Alex Wood. The identity lesson is that trust signals, collaboration, and verification controls now matter as much as user behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “An Ex-Fraudster's Guide to Staying Safe”.
Key questions
Q: How should organisations verify requests when deepfakes can imitate trusted people?
A: Organisations should require a second, authenticated channel for any high-impact request.
Q: Why do fraud schemes last longer when organisations do not share data effectively?
A: Fraud lasts longer because the organisation that spots the warning may not be the organisation that can stop the transaction.
Q: What are the signs that identity trust controls are failing in fraud programmes?
A: Common signs include repeated urgent requests, inconsistent identity details across channels, staff overriding process because a message feels legitimate, and slow escalation when a request crosses team boundaries.
Practitioner guidance
- Harden identity challenge workflows Require multi-signal confirmation for high-risk requests, especially when the interaction depends on voice, video, or urgent business context.
- Define cross-organisation fraud-sharing rules Document which indicators can be shared, with whom, and at what speed during suspected impersonation or account takeover events.
- Test controls against synthetic identity input Red-team customer service, finance, and privileged support processes using AI-generated messages and deepfake-style social cues.
Bottom line: AI-assisted fraud is weakening the reliability of common identity cues, especially when voice, video, and messages can be convincingly synthesised.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/06/2026 2:47 am
Fraud has become an identity assurance problem, not just a user-awareness problem. The episode shows how modern scams exploit the gap between what a person can convincingly present and what a verifier can reliably prove. Once AI can generate believable context on demand, the control question shifts from 'is the user suspicious?' to 'can the workflow still establish trust under synthetic pressure?' Practitioners should treat fraud operations and IAM as overlapping assurance disciplines.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often defenders are operating without a complete identity picture.
A question worth separating out:
Q: What should organisations do about quantum risk in identity and secrets management?
A: Organisations should inventory secrets and cryptographic dependencies that must remain trustworthy for years, then prioritise the systems with the longest confidentiality horizon. The goal is not panic planning. It is reducing exposure where today’s encryption assumptions would create future identity and data loss if they weaken.
👉 Read our full editorial: AI-driven fraud is exploiting trust gaps in identity and data sharing
12/06/2026 4:21 am
AI-driven fraud is now a trust-infrastructure problem, not a victim-behaviour problem. The article’s most important shift is that success increasingly depends on the quality of the attacker’s identity signals, not on the target being careless. That moves fraud governance away from blaming end users and toward proving whether an organisation can validate identity claims under adversarial pressure. The practitioner conclusion is that trust controls have to be designed as operational infrastructure, not soft policy.
A question worth separating out:
Q: Should teams prioritise deepfake detection or stronger verification workflows?
A: Teams should prioritise stronger verification workflows first, because detection only helps after a suspicious signal is already visible. Workflow design, challenge steps, and authority to pause action reduce the chance that a convincing fake succeeds before any detection tool or analyst review can intervene.
👉 Read our full editorial: AI-driven fraud is exploiting trust gaps in identity and data sharing
This post was modified 1 day ago by NHI Mgmt Group