Topic starter
12/06/2026 9:47 pm
TL;DR: Identity fraud more than doubled from 1.1% of verifications in 2021 to 2.6% in 2024, deepfakes rose 4x, and account takeover attacks surged 250% year over year, according to Sumsub’s 2024 Identity Fraud Report. The operative lesson is that static onboarding controls no longer match fraud that now concentrates during ongoing account use.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Democratization of Fraud Tech: $1,000 Can Cause $2.5M in Monthly Business Losses, Sumsub Report Reveals”.
By the numbers:
- Three-quarters, or 76%, of fraud occurs during ongoing account use.
- The global average identity fraud rate grew from 1.1% of all verifications in 2021 to 2.6% in 2024.
- Account takeover attacks surged by 250% year over year.
Key questions
Q: What breaks when fraud controls only cover onboarding and not the rest of the user journey?
A: Stage-limited controls let fraudsters pass a clean entry point and then shift abuse into payments, payouts, or cash-out where governance is weaker.
Q: Why do deepfakes create more risk than ordinary identity fraud?
A: Deepfakes compress the time needed to impersonate a real person and make the attack look legitimate at the exact moment trust is granted.
Q: How should organisations detect fraud during ongoing account use?
A: Use session-level monitoring that looks for device drift, abnormal payment behaviour, recovery abuse, and unusual transaction sequencing.
Practitioner guidance
- Instrument continuous verification after onboarding Add risk checks during account use, not only at signup, so changes in device, behaviour, recovery, and payment patterns can trigger step-up review or containment.
- Harden recovery and support pathways Review password reset, helpdesk, and account recovery flows for abuse paths that let impersonators bypass earlier proofing controls and seize a live account.
- Treat deepfakes as a multi-signal risk Combine document checks, liveness, behavioural data, and device context instead of relying on a single biometric or image test to confirm identity.
Bottom line: Fraud is moving into the post-login phase, where static onboarding controls have the least visibility and the attacker has the most room to operate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
13/06/2026 12:06 am
Ongoing-account fraud is the new centre of gravity in identity risk. SumSub’s finding that 76% of fraud happens during ongoing account use shows that enrollment-only governance is now structurally incomplete. The control assumption that identity risk peaks at onboarding no longer holds, because attackers increasingly wait until trust has already been granted. Practitioners should re-centre fraud governance on the authenticated session and the actions that follow it.
A few things that frame the scale:
- Sophisticated multi-step fraud rose 180%, according to Sumsub's Identity Fraud Report 2025-2026.
A question worth separating out:
Q: When should teams prioritise continuous checks over stronger onboarding controls?
A: When fraud is concentrated after authentication, continuous checks should take priority because they address the stage where the attacker actually monetises access. Stronger onboarding still matters, but it cannot compensate for a post-login control gap that lets a compromised or impersonated user operate undetected.
👉 Read our full editorial: Digital identity fraud is shifting to deepfakes and fraud-as-a-service
This post was modified 3 days ago by NHI Mgmt Group