Attack-as-a-service and identity fraud: what should IAM teams do?

NHI Mgmt Group · 2026-06-11T00:12:47+00:00

TL;DR: Attack-as-a-Service is commoditising identity fraud by packaging verification bypass, deepfakes, and account farming into purchasable services, while iProov reports 31 new threat actor groups in 2024 and 34,965 tracked users across the ecosystem. Static identity checks are losing value as attack methods become faster, cheaper, and easier to buy. Editorial analysis by NHI Mgmt Group, based on content published by iProov: “Understanding Attack-as-a-Service: The Dark Ecosystem Fueling Identity Fraud”. By the numbers: 31 new online threat actor groups were identified in 2024 alone, according to iProov. 45% of these groups develop and sell their own attack tools, according to iProov. 68% of users are attracted to tool sellers, serving 23,698 individuals, according to iProov. Key questions Q: What breaks when banks rely on static PII for identity verification? A: Static PII breaks when the same personal data can be stolen, bought, or assembled from breaches and used to pass checks that were designed to prove uniqueness. Q: Why does attack-as-a-service increase fraud risk so quickly? A: It lowers the skill barrier and turns fraud methods into reusable products, which expands the pool of attackers and shortens the time between a weakness being found and exploited. Q: What do teams get wrong about identity-based fraud detection? A: Teams often assume identity verification at onboarding is the main trust decision. Practitioner guidance Review verification assumptions Inventory which onboarding and recovery paths still trust static proofs of life, single-document checks, or one-time selfie capture as sufficient identity evidence. Test for deepfake bypass resilience Run adversarial validation against face swap, virtual camera and image-to-video attack paths on the highest-risk identity journeys. Build fraud ecosystem monitoring Track dark web marketplace themes, tool categories and target lists so control changes reflect current attacker services rather than last quarter’s incidents. Bottom line: Identity fraud is being industrialised through purchasable attack services, which makes attacker capability easier to scale than many defender workflows. Explore furtherView Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →

Topic starter 12/06/2026 6:08 am

Attack-as-a-service is turning identity fraud into a governed supply chain. The key shift is not just automation but commercial packaging, where bypass techniques, deepfakes and onboarding services are sold as repeatable units. That creates a fraud market with specialised roles, support and feedback loops, which makes the attacker side more resilient than point-in-time controls. Practitioners should treat identity fraud as a supply chain problem, not a single fraud event problem.

A few things that frame the scale:

Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.

A question worth separating out:

Q: Should organisations prioritise dynamic liveness over static verification?

A: Yes, where remote onboarding or recovery is a high-value target. Dynamic liveness raises attacker cost because it is harder to replay or precompute, while static verification can be bypassed with increasingly accessible synthetic media tooling.

👉 Read our full editorial: Attack-as-a-service is lowering the bar for identity fraud

Attack-as-a-service and identity fraud: what should IAM teams do?

Deepen Your Knowledge

Subscribe to the NHI & AI Identity Journal

Subscribe to the NHI & AI Identity Journal