As fraud continues to evolve (artificial intelligence also plays a role), Verification fraud platform leader, Ira Bondar-MucciHe said familiar methods still prevail. Veriff’s authentication The platform supports over 3,000 businesses including Western Union, Bumble, Blockchain, Stake, Instacart and AWS. Veriff’s 2026 Identity Fraud Report It reveals that e-commerce and financial services companies are the most affected sectors.
Injection attacks are the fastest growing problem. During verification, scammers send pre-made or edited content instead of a live selfie and ID photo to bypass the camera. Using web platforms and photo editors, they can skillfully alter identities on a large scale and apply them across industries. This is very common in fintech and BNPL.
“Looking holistically at all the fraud attacks and fraud factors we see on Veriff, it is still the majority that is run-of-the-mill fraud.” Bondar-Mucci said. “This is the cheapest scam scammers can do, so when they detect a small vulnerability in a system, they try to optimize their operations and try to use that particular vector multiple times before we stop them and they have to figure out what the next step is.”
Impersonation, multiple accounting and money mill scams revealed
Impersonation fraud occurs when a criminal alters physical or digital records to assume the identity of another person. Artificial intelligence helps with this by simplifying audio and video changes. Work that once took days now takes minutes and is done on a much larger scale. It accounts for over 85% of all scams.
Multiple accounting is often used in cryptocurrency and other industries that offer bonuses. An actor creates multiple accounts to get as many benefits as possible. These criminals often leave digital clues and pattern traces.
Bondar-Mucci said money mills can be misleading. Natural individuals are recruited by scammers to voluntarily surrender their identities. Once verified, they deliver the accounts.
Fraud is stable but changing
Overall fraud levels are consistently around 4%, but what makes up 4% varies. Physical document fraud has declined in favor of digital methods. Artificial intelligence has greatly simplified this process. By 2025, digitally delivered media was 300% more likely to have been produced or altered in some way by AI than in 2024. Although it is still a small percentage of overall fraud, AI-enabled fraud is on the rise.
Adversarial attacks, both physical and digital, are much rarer today. Physical attacks dropped by 34% last year, accounting for just 1.28% of attacks; digital attacks fell by 66%; they now account for just 0.02% of all fraud attempts. Some loans increased customer complexity for part of the fall, but Veriff suggests that AI has reduced the need for these attacks altogether.
Originally designed as software development testing tools, emulators have been favored by criminals to mimic the behavior of legitimate devices and users. This feature allows fraudsters to manipulate apps, websites, and payment systems. It is easily automated and highly scalable thanks to the ability to appear as different devices.
The best protection is a multi-layered approach that includes facial biometric identification, behavioral analysis, code inspection, vulnerability testing, machine learning algorithms, web application firewalls, IP and device fingerprinting, email analysis, and AI-driven algorithms.
E-commerce sites are popular fraud targets
The net fraud rate on e-commerce platforms in 2025 was 19.2%, almost five times the global average. E-commerce also saw authorized fraud 10 times the global average, with gig economy, mobility and ride-hailing platforms frequently targeted.
These platforms are largely unregulated and trillions of dollars are traded each year. Bondar-Mucci said the client’s need for speed and low-friction recruiting has made the industry a primary target; instant value, instant profit.
But scammers need to be careful because they often copy their strategies across platforms. Veriff’s use of a database containing behaviors identified across thousands of companies helps identify patterns.
Different fintech domains are subject to different types of attacks. Crypto sites and lenders are seeing more identity fraud. Trading and investment sites are seeing more authorized scams. Banks see plenty of both.
“On average, the total fraud attempt rate increased by over 38% year-on-year in the crypto sector and 9.6% in the payments sector, while the total document fraud attempt rate increased by over 21% in the crypto sector.” Veriff’s report states the following.
Regional differences
North America
Net fraud rates remained stable between 2024 and 2025, but 20% of all frauds were document fraud; This rate is much higher than anywhere else. Financial services departments were heavily targeted with fake residence permits; overall fraud rates for these documents were 18.6%.
The US payments industry has entered high-risk territory following an 89% increase in the fraud attempt rate, driven by increased digital media usage.
EU/UK
The average annual fraud rate increased by approximately 2.3 times. Companies face additional regulatory and compliance requirements, Bondar-Mucci said. This catches frauds that were previously undetected. ID cards have a 13% attempted fraud rate, higher than the 6% seen with dual passports.
UK platforms saw 35% more scam attempts.
Latin America
Fraud was stable from 2024 to 2025. Impersonation fraud was 86% and document fraud was 13%. Passports had an average fraud rate of 5.82% in 2025. There was an 11.8% rate of fraud attempts on ID cards on gambling sites. Payments saw a 48% increase in fraud attempts; Fintechs saw a 23.4% increase in fraud.
Bondar-Mucci said Veriff tracks global activity in part by looking for mismatched fraud data.
“For example, if someone sent a document from the United States but we see that the language or IP address installed on their mobile device comes from a different region, that is a big red flag for us.”
How to fight AI-powered fraud
Fraudsters will continue to find new ways to use AI to fool detection systems, and companies will use AI to stop them. Bondar-Mucci said a multi-layered approach is essential.
“Implement everything in your stack” he said. “This is biometric authentication, liveness verification. One of the important, important signals is device information, because (some) media will pass biometric authentication, but not device integrity checks.”
“Device signals and network signals should not be underestimated, as this will be the signal that gives us information about the behavior of the end user interacting with the system. As deepfakes become more and more realistic, we have fewer and fewer signals to work with.”
This also means that companies must protect vulnerabilities throughout the interaction lifecycle.
“We see this continued trust as being equally important, because if an account that looks good today simulates some good behavior and completes some legitimate transactions, only after they fall off the radar can they act again and request some risky transactions,” Bondar-Mucci said. “If it goes under the radar, there is a huge financial risk the company will have to bear.
“There are ways to create these optional verifications if the user is changing their data in their account, requesting a transaction from a strange place, or just generally doesn’t appear to be holistic with their account history.”
Companies should also stop treating fraud protection as a cost center and move from a mindset of catching bad actors without punishing legitimate customers. Bondar-Mucci said a risk-based orchestration approach allows companies to design flows based on their risk appetite and the regulations they must comply with.
Veriff’s consortium approach, where it accesses data from thousands of companies, helps protect customers.
“If we’ve seen them onboard 10 banks in the past, why would we vet them when we’re trying to access a new service when we already know it’s a trusted identity?” Bondar-Mucci asked. “This trust looks at fraud from a different perspective, providing faster access to good users when examining streams and making it really complicated for scammers to proceed.
“This risk-based orchestration is the future.”
