Identity fraud is what happens when someone gets an account, a transaction or a benefit by pretending to be someone else, or someone who does not exist. It spans the whole customer lifecycle: synthetic and stolen identities at account opening, credential stuffing and phishing to take over existing accounts, bots that create fake accounts at scale, and mule accounts that move the proceeds. Fraud teams and identity teams often work separately, with different tools and data, and attackers exploit the gap between them. This guide explains the main types of identity fraud, the signals that reveal it, and how to combine identity, device and behavioural controls across onboarding, sign-in, recovery and transactions.
Key takeaways
- Identity fraud happens at four points: account opening, sign-in, account recovery and high-risk actions. Controls are needed at each.
- Synthetic identities have no real victim to complain, so they are found by links between applications, not by checking one at a time.
- Account takeover is mostly an authentication problem. Phishing-resistant MFA, breached-password screening and bot defence solve most of it.
- Device and behavioural signals add context that identity data alone cannot, but must be used proportionately and lawfully.
- Fraud, identity and security teams need shared signals and shared ownership.
Types of identity fraud
| Type | What happens | Where to stop it |
|---|---|---|
| Stolen identity (third-party) fraud | A real person's details are used to open an account in their name | Identity proofing with document, chip and liveness checks |
| Synthetic identity fraud | Real and invented attributes are combined into a new identity, often built up over months | Resolution, linked-attribute analysis, consortium data |
| First-party fraud | A genuine customer lies, for example about income or a claimed non-receipt | Fraud analytics and policy, less so identity controls |
| Account takeover (ATO) | An attacker gains control of an existing account | Authentication, recovery controls, session protection |
| Fake account creation | Bots register accounts at scale for abuse, promotions or spam | Bot defence, rate limits, device intelligence |
| Mule accounts | Genuine people open or lend accounts to move stolen funds | Behavioural monitoring after onboarding |
| Impersonation fraud | An attacker pretends to be an executive, supplier or bank to trigger a payment | Payment verification and out-of-band checks. See the Deepfake and AI Impersonation Guide |
Controls across the lifecycle
Account opening
- Proof identity to a level that matches the product's risk. See the Identity Proofing and KYC Guide.
- Look for linked attributes across applications: the same device, phone, email pattern, address or document image appearing under different names.
- Check the age and history of the email address and phone number supplied.
- Use bot defence and rate limits on registration.
- For businesses, verify the entity and its beneficial owners. See the KYB Guide.
Sign-in
- Offer and encourage passkeys; use MFA and step-up based on risk. See the MFA Guide.
- Screen passwords against breached lists and throttle credential stuffing. See the Password Security Guide. The 23andMe breach showed how stuffing into a small number of accounts can expose millions of people through linked features.
- Detect impossible travel, new devices and anonymising infrastructure.
Recovery and profile changes
- Treat changes to email, phone, password, MFA and payout details as high risk, with step-up and cooling-off periods.
- Do not let support staff or chatbots change recovery details without verification. See the Account Recovery and Help Desk Security Guide and the Meta AI support assistant takeover.
Transactions and high-risk actions
- Use transaction signing or dynamic linking for payments, so approval is tied to the amount and payee.
- Score behaviour during the session, not just at sign-in.
- Watch for mule patterns: dormant accounts that suddenly receive and forward funds.
Signals that reveal fraud
| Signal type | Examples | Caution |
|---|---|---|
| Identity data | Mismatch between name, date of birth and address; thin file; recently created email or phone | Thin files also describe young people and new arrivals |
| Linkage | Shared device, phone, address or document across different claimed identities | Households and shared devices create innocent links |
| Device intelligence | Emulators, rooted devices, virtual cameras, device reputation, browser fingerprint inconsistencies | Fingerprinting has privacy implications and may need consent |
| Network | Hosting providers, residential proxies, anonymisers, IP reputation | Legitimate users use VPNs too |
| Behaviour | Typing and navigation patterns, copy-and-paste of personal data, unusual speed | Behavioural data is personal data |
| Outcomes | Early-life losses, chargebacks, consortium fraud reports | Arrives late, but is the most reliable ground truth |
Bots and automation
Automated attacks drive credential stuffing, fake account creation, card testing and scraping. Defences work in layers: rate limits by account, IP range and device; bot detection that looks at browser integrity and behaviour; challenges that are proportionate and accessible; and monitoring of success rates, because a successful bot looks like a surge of normal traffic. As AI agents start acting for real customers, bot defences also need to distinguish legitimate, declared agents from abusive automation. See the Agentic Commerce Identity Guide.
Bringing fraud and identity together
- Share signals in both directions: identity events such as MFA changes feed fraud scoring, and fraud decisions feed step-up and account restrictions.
- Agree who owns account takeover: identity, fraud or security. Unowned problems persist.
- Use common case management so an analyst can see sign-in, device and transaction history together.
- Feed confirmed fraud back into onboarding rules and models.
- The Customer IAM (CIAM) Guide covers the identity platform side.
Measuring fraud controls
- Fraud losses and confirmed cases by lifecycle stage.
- Account takeover rate per thousand active accounts.
- Early-life fraud rate for new accounts.
- Genuine customer friction: step-up rates, abandonment and false declines.
- Time from first signal to action.
Practitioner checklist
- Map fraud types to the lifecycle stage where each can be stopped.
- Proof identity by risk at onboarding and look for linked attributes across applications.
- Offer passkeys, enforce MFA for sensitive actions and screen breached passwords.
- Protect recovery and profile changes with step-up and cooling-off periods.
- Layer bot defence, device intelligence and rate limiting, with a documented privacy basis.
- Monitor accounts after opening for mule and early-life fraud patterns.
- Share signals and case data between fraud, identity and security teams.
- Measure both fraud outcomes and genuine customer friction.
Standards and references
- NIST SP 800-63A-4: Identity Proofing and Enrollment (2025), including fraud management requirements
- Federal Reserve: Synthetic Identity Fraud resources
- OWASP Automated Threats to Web Applications
- OWASP Credential Stuffing Prevention Cheat Sheet
Related NHI Mgmt Group resources: Customer IAM (CIAM) Guide · Identity Proofing and KYC Guide · Biometrics Guide · Financial Services Identity Security Guide
