Who is accountable when compromised devices are used to bypass KYC or KYE?

Why This Matters for Security Teams

When compromised devices are used to bypass KYC or KYE, the issue is not only fraud detection. It is a trust failure across identity proofing, endpoint assurance, and downstream access decisions. Device compromise can let an attacker present convincing synthetic evidence, hijack a session, or replay enrollment steps that look legitimate to a human reviewer. Guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls supports strong provenance, monitoring, and access control, but operational ownership still has to be explicit.

NHI Management Group’s Ultimate Guide to NHIs shows why this matters at scale: 97% of NHIs carry excessive privileges, and 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage. That pattern is relevant here because the same governance gap that leaves non-human access over-privileged also leaves verification workflows too trusting. In practice, many security teams encounter this only after synthetic onboarding, account takeover, or mule activity has already passed through an otherwise “approved” process.

How It Works in Practice

Accountability should be assigned to the identity programme owner and fraud operations, with clear supporting obligations for endpoint security, IAM, and verification engineering. The reason is simple: KYC and KYE controls depend on multiple trust signals, and compromised devices can distort all of them. If a device is rooted, remotely controlled, or running malware, it may still produce valid-looking biometric, document, or session artifacts. That means the control objective is not just “was an ID checked,” but “was the evidence trustworthy at the time of decision.”

Practically, mature programmes break the problem into three layers:

• device trust and posture checks before sensitive actions
• step-up verification when risk signals change mid-flow
• post-event review for exceptions, overrides, and suspicious clusters

This is where policy and identity governance intersect. Current best practice is evolving toward continuous, context-aware decisions rather than one-time approval. That aligns with FATF Recommendations for risk-based controls and with 52 NHI Breaches Analysis, which reinforces that identity compromise usually persists because ownership and revocation responsibilities are fragmented. The operational question is not who clicked approve, but who owned the policy that allowed a compromised endpoint to be treated as reliable evidence. These controls tend to break down in high-volume remote onboarding flows because reviewers optimise for speed and attackers optimise for believable frictionless completion.

Common Variations and Edge Cases

Tighter verification often increases operational friction, requiring organisations to balance conversion rate against abuse resistance. That tradeoff becomes sharp in low-latency customer onboarding, contractor provisioning, and employee self-service recovery, where repeated challenges can degrade user experience and increase support load. There is no universal standard for this yet, but current guidance suggests that high-risk actions should be gated by stronger device assurance, not just stronger identity proofing.

One common edge case is delegated verification, where a third party or outsourced team performs KYC or KYE checks. Accountability still remains with the programme owner unless contracts, logging, and escalation paths clearly transfer specific duties. Another edge case is “known-good” devices that later become compromised: trust decisions made before compromise do not protect later transactions. A final issue is evidence reuse, where document images, liveness results, or employee attestations are replayed from a previous session. That is why browser/session binding, device attestation, and anomaly review should be treated as part of the control set, not optional hardening. The Ultimate Guide to NHIs remains relevant here because the same lifecycle discipline used for secrets and service accounts applies to trust signals: if they are not continuously validated, they eventually become stale.

Related resources from NHI Mgmt Group

• How should organisations govern mobile devices used for remote work?
• Who is accountable when a compromised card reaches customers before containment?
• Who is accountable when a cracked service account is used for lateral movement?
• Who is accountable when a compromised certificate affects clinical systems?