Notifications
Clear all
Topic starter
12/06/2026 9:47 pm
TL;DR: Identity fraud more than doubled from 1.1% of verifications in 2021 to 2.6% in 2024, deepfakes rose 4x, and account takeover attacks surged 250% year over year, according to Sumsub’s 2024 Identity Fraud Report. The operative lesson is that static onboarding controls no longer match fraud that now concentrates during ongoing account use.
NHIMG editorial — based on content published by Sumsub: Rise of Fraud-as-a-Service, deepfakes surging 4x and more 2024 digital fraud trends uncovered in 4th annual Identity Fraud Report
By the numbers:
- Three-quarters (76%) of fraud occurs during ongoing account use, highlighting the need for continuous checks apart from KYC.
- The global average identity fraud rate more than doubled over three years, growing from 1.1% of all verifications in 2021 to 2.6% in 2024.
- Account takeover (ATO) attacks have become one of the most damaging forms of fraud, and ATO cases surged by 250% YoY.
Questions worth separating out
Q: How should security teams handle identity fraud after onboarding is complete?
A: They should treat onboarding as only the first control point and move fraud detection into the active account lifecycle.
Q: Why do deepfakes make identity verification less reliable?
A: Deepfakes weaken the assumption that visual or voice-based cues reliably prove who is on the other side of the screen.
Q: When should organisations move from KYC to continuous identity monitoring?
A: They should do it whenever the business depends on account activity after sign-up, especially in financial services, marketplaces, gaming, and digital media.
Practitioner guidance
- Extend fraud controls beyond onboarding Treat verification as the first gate, then add monitoring for login behaviour, recovery events, payment changes, and high-risk account actions.
- Add provenance checks for synthetic media Require stronger liveness and source validation where documents, selfie checks, voice, or video materially affect trust decisions.
- Tune step-up controls to active sessions Trigger re-authentication or additional verification when account behaviour changes, especially during transfers, profile edits, and recovery flows.
What's in the full report
Sumsub's full report covers the operational detail this post intentionally leaves for the source:
- The full breakdown of fraud types by sector and region, useful if you need to benchmark exposure by business line.
- The underlying survey methodology and respondent mix, which matters if you are validating the strength of the findings.
- The fraudster-economy analysis showing how low up-front cost can generate high downstream losses, useful for risk conversations.
- The 2025 prediction set on AI-enabled fraud techniques, which helps teams plan for next-year control gaps.
👉 Read Sumsub’s 2024 Identity Fraud Report on deepfakes and fraud-as-a-service →
Deepfakes and fraud-as-a-service: what should IAM teams do now?
Explore further
13/06/2026 12:06 am
Continuous identity trust is now the real control boundary. The report shows that 76% of fraud occurs during ongoing account use, which means the decisive failure is not just weak onboarding but weak post-verification governance. KYC can prove a person or account existed at one moment, but it does not preserve trust across sessions, recovery paths, or account actions. Practitioners should treat fraud as a lifecycle problem, not a sign-in problem.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable when account takeover and synthetic identity fraud occur?
A: Accountability usually sits across fraud, IAM, security, and product teams because the failure spans onboarding, session trust, and action-level controls. In practice, the owner should be the team that can change the decision point where abuse becomes possible. Shared risk does not mean shared inaction.
👉 Read our full editorial: Digital identity fraud is shifting to deepfakes and fraud-as-a-service
