Topic starter
11/06/2026 10:46 pm
TL;DR: Impersonation fraud made up more than 85% of fraud attacks in 2025, AiTM attacks still bypass MFA via session cookie theft, and e-commerce hit a 19.2% net fraud rate, according to Veriff’s 2026 Identity Fraud Report, showing how AI and automation are changing verification. Conventional identity checks are no longer enough when the attack surface includes deepfakes, injected media, and real-time credential relay.
Editorial analysis by NHI Mgmt Group, based on content published by Veriff: “Six key online fraud trends to watch in 2026”.
By the numbers:
- Impersonation fraud accounted for over 85% of all fraud attacks in 2025, according to Veriff.
- Physical AiTM attacks dropped by 34% in 2025, according to Veriff.
- Digital AiTM attacks dropped by 66% in 2025, according to Veriff.
Key questions
Q: What breaks when identity verification relies on documents or MFA alone?
A: The control fails when attackers can layer AI-generated deepfakes, synthetic identities, session theft, or injected media around a single weak check.
Q: Why do AiTM attacks still matter if organisations already use MFA?
A: AiTM attacks matter because MFA can still be bypassed when an attacker relays the user’s authentication flow and steals the resulting session cookie.
Q: How can fraud teams tell whether their verification controls are too easy to spoof?
A: A control is probably too easy to spoof if it trusts one signal in isolation, such as a document image, a face scan, or a device fingerprint, without cross-checking timing and interaction behaviour.
Practitioner guidance
- Deploy multi-signal verification for high-risk onboarding Combine facial biometrics, behavioural analytics, and AI-powered document validation so one weak artefact does not decide the entire identity proofing outcome.
- Adopt phishing-resistant authentication for exposed login flows Use certificate-based authentication or other phishing-resistant MFA where attackers can intercept credentials and relay sessions through AiTM kits.
- Test mobile flows against emulator and injection abuse Validate whether device authenticity, liveness, and timing checks still hold when the interaction is replayed, spoofed, or instrumented by automation.
Bottom line: AI has changed online fraud from simple impersonation into a layered verification problem that combines synthetic identities, session theft, and injected media.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:06 am
Identity verification is becoming a multi-signal governance problem, not a single-check problem. The article shows that impersonation fraud now blends deepfakes, synthetic identity, and document manipulation, which means no single verification factor carries enough evidential weight on its own. When document, face, device, and behaviour are assessed separately, attackers can tailor each artefact to the weakest gate. For practitioners, verification policy has to be designed around signal correlation, not isolated point controls.
A few things that frame the scale:
- Global e-commerce fraud losses are projected to reach $107 billion a year by 2029.
A question worth separating out:
Q: How should compliance and fraud teams respond when AI-assisted identity fraud increases?
A: They should update risk appetite, escalation paths, and review thresholds together rather than treating fraud as a back-office exception. When AI-enabled deception becomes common, faster approvals must be balanced against loss limits, stronger monitoring, and clearer ownership for suspected synthetic identities.
👉 Read our full editorial: Online fraud trends for 2026 show AI is reshaping verification
This post was modified 1 day ago by NHI Mgmt Group