Topic starter
10/06/2026 10:38 pm
TL;DR: Fraud is shifting from convincing people to manipulating systems, with attackers using camera injection, emulator farms, AI-driven tactics, and reverse-engineered onboarding flows to evade layered defences, according to SumSub. Traditional controls are increasingly brittle when the adversary studies workflows, not just users.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “When Systems Become the Target: The New Era of Fraud”.
Key questions
Q: How should teams handle onboarding flows that attackers can reverse engineer?
A: Treat the flow as a security control, not just a product journey.
Q: Why do layered fraud defences fail against machine-speed attacks?
A: Layered defences fail when the layers are predictable, correlated, or tuned too slowly for the attacker’s iteration rate.
Q: What are the first signs that fraud controls are too easy to manipulate?
A: Look for recovery requests, payment approvals, or exception decisions that are approved quickly, bypass normal review, or rely on a single person’s judgment.
Practitioner guidance
- Harden onboarding decision paths Map each verification step, fallback, and exception path to identify where manipulated inputs can be accepted as legitimate.
- Test for camera and emulator abuse Add abuse cases for camera injection, virtualised device environments, and repeated-session automation to your fraud testing.
- Separate signal dependencies Avoid letting liveness, device, and behavioural checks fail together on the same hidden assumption, because correlated signals are easier to game.
Bottom line: Fraud is increasingly aimed at the systems that verify identity, which makes workflow integrity as important as user authenticity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/06/2026 2:45 am
Fraud has become workflow abuse, not just identity spoofing. The article shows that the decisive target is now the sequence of checks, exceptions, and fallback decisions that make up onboarding and fraud detection. When attackers can reverse engineer that sequence, the control failure is structural rather than tactical. Practitioners should treat identity workflows as attack paths, not administrative plumbing.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to The 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do when fraud moves faster than manual review?
A: Organisations should move high-risk decisions toward real-time, risk-based evaluation and reserve manual review for escalation rather than first-line gating. Manual queues cannot be the primary defence when attackers operate at machine speed. The right response is to automate detection, shorten feedback loops, and route only the ambiguous cases to humans.
👉 Read our full editorial: Fraud moves at machine speed as systems become the target
12/06/2026 4:19 am
Fraud now behaves like a control-plane attack, not a persuasion attack. The article shows adversaries targeting onboarding, liveness, and workflow logic rather than human judgement alone. That changes the unit of governance from user screening to decision path integrity. Practitioners need to think in terms of how identity controls are consumed, not just how they are configured.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Should identity teams treat fraud detection and IAM governance as separate programmes?
A: No. Fraud detection and IAM governance increasingly depend on the same onboarding, proofing, and trust decisions, so gaps in one programme can be exploited through the other. Shared signals, shared exception handling, and shared ownership reduce the chance that attackers can move through the identity journey unnoticed.
👉 Read our full editorial: Fraud moves at machine speed as systems become the target
This post was modified 1 day ago by NHI Mgmt Group