Why do large identity verification programmes still see forged documents and synthetic identities slip through?

Why This Matters for Security Teams

Large identity verification programmes are attractive targets because they concentrate onboarding, authentication, and fraud decisions into a repeatable workflow. Once attackers learn which evidence is weighted most heavily, they can tune forged documents, manipulated selfies, replayed videos, or synthetic identity graphs to pass the process. The risk is not only fraudulent account creation, but also downstream exposure in payments, lending, sanctions screening, and account recovery.

Practitioners often treat identity verification as a point-in-time control, when the real problem is adversarial adaptation across the full identity lifecycle. That means evidence quality, source assurance, device integrity, and liveness checks all need to be evaluated together, not in isolation. Guidance from eIDAS 2.0 — EU Digital Identity Framework reinforces the value of higher assurance identity sources, but implementation still depends on how rigorously the programme verifies provenance and binds claims to a real person. In practice, many security teams encounter fraud tuning only after account abuse, chargebacks, or compliance exceptions have already occurred, rather than through intentional control testing.

How It Works in Practice

Forged documents and synthetic identities slip through when the verification stack has predictable blind spots. Attackers do not need perfect documents; they need inputs that satisfy threshold checks. If a programme relies too heavily on document OCR, a static selfie comparison, or a single database lookup, it can be defeated by modest image edits, fabricated metadata, or a synthetic profile assembled from real and invented attributes.

Effective programmes layer controls across evidence capture, document authentication, biometric assurance, device and network risk, and post-onboarding monitoring. Current guidance suggests that this is strongest when each signal is independently useful and collectively harder to game. For identity and AML-heavy environments, the FATF Recommendations — AML and KYC Framework are relevant because they frame customer due diligence as an ongoing risk decision, not a one-time form check.

Operationally, teams should consider:

• Document authenticity checks that validate issuer patterns, MRZ integrity, and tamper evidence.
• Evidence capture controls that reject low-quality images, replayed screens, and repeated submissions.
• Liveness and biometric assurance that are calibrated to the fraud risk of the use case.
• Identity resolution that looks for stitched profiles, shared devices, reused attributes, and velocity anomalies.
• Post-verification monitoring that rechecks risk when account behavior changes.

Where identity verification intersects with non-human workflows, the same logic applies to delegated onboarding, automated account creation, and agent-assisted fraud operations: assurance must be tied to the actor, not just the artifact. These controls tend to break down in high-volume consumer onboarding pipelines because manual review capacity is limited and fraudsters can A/B test submissions against the exact acceptance thresholds.

Common Variations and Edge Cases

Tighter verification often increases friction and review cost, requiring organisations to balance conversion against fraud loss and compliance risk. That tradeoff is especially sharp in cross-border onboarding, thin-file populations, and low-margin digital services where false rejects can create business pressure to loosen controls.

Best practice is evolving for synthetic identity detection because there is no universal standard for this yet. Some programmes emphasize graph analysis and lifecycle monitoring, while others lean more heavily on document assurance and biometric checks. The right mix depends on whether the dominant threat is document forgery, identity stitching, mule recruitment, or account takeover.

Edge cases also matter. Low-quality mobile captures, assisted sign-up flows, accessibility needs, and privacy constraints can all reduce signal quality without implying fraud. In those environments, overly rigid rules can create exclusion while still missing well-prepared attackers. Strong programmes therefore pair policy thresholds with human escalation paths, adverse-action review, and periodic rule tuning based on confirmed fraud cases. Where regulated digital identity is in scope, identity proofing should be aligned with assurance and traceability expectations rather than treated as a generic document check.

Related resources from NHI Mgmt Group

• Why do synthetic identities complicate biometric verification programmes?
• Why do non-human identities complicate identity security programmes?
• Why do workload identity programmes still need authorisation controls if SPIFFE is in place?
• Why do non-human identities complicate identity governance programmes?