Shufti report finds deepfakes powering organized remote onboarding fraud

Shufti’s Identity Fraud Report 2026 says organized fraud rings are using deepfakes, forged documents and reused identities to target digital businesses across 11 sectors in the first half of 2026. Digital assets saw the highest remote onboarding fraud share at 22.49%, with cross-border network fraud and AI-enabled document attacks emerging as major risks.

Why it matters: - Remote onboarding fraud is moving from isolated attempts to coordinated criminal networks that reuse the same identities, devices and infrastructure across institutions. - The pattern raises KYC, AML and compliance risks for digital businesses, especially where customer sign-up happens at scale and across borders. - Shufti’s data shows attack pressure is highest in sectors with heavy remote onboarding volume, not necessarily in the sectors with the weakest supervision.

What happened: - Shufti published the Identity Fraud Report 2026, its annual analysis of identity fraud during remote onboarding. - The report is based on production verification data from January through June 2026 across 11 industries. - Digital assets recorded the highest share of remote onboarding fraud at 22.49% of verification requests. - Fintech followed at 18.36%, forex at 17.18%, lending and investment at 17.08%, and iGaming at 12.45%. - Among linked fraudulent verification attempts, 65.68% of attribute matches traced back to forged identity documents.

The details: - Shufti found that deepfakes and AI-generated identity fraud are now being used by organized crime networks and coordinated fraud rings, not just individual fraudsters. - Fraud rings are using forged identity documents, synthetic identities, shared devices and controlled digital infrastructure to bypass KYC checks and facilitate financial crime. - Matches between separate fraudulent attempts broke down as reused fraudulent documents at 65.68%, shared controlled IP addresses at 17.67%, and shared devices at 16.64%. - Document reuse was the strongest matching signal because legitimate users can share networks and devices. - The largest connected cluster observed linked 70 identities across 13 devices, with one device anchoring 16 verification events. - Deepfake document fraud accounted for 80.10% of AI-enabled fraud. - Synthetic identities accounted for 12.31% of AI-enabled fraud, injected videos for 4.01%, and face swaps for 3.58%. - Altered documents led the detection rate by attack instrument in nine of the 11 industries measured. - Banking recorded a fraud rate of 4.24%, where replay and screenshot attacks remained the leading attack vectors. - The report says 2.01% of network fraud spanned more than one country. - In cross-border groups, the typical interval between activity in one country and the next was 9 minutes 33 seconds. - The fastest observed gap was 38 seconds. - The report says that timing is inconsistent with physical movement between jurisdictions. - Shufti distinguishes between presentation attacks, where a manipulated artefact reaches the system through the camera, and injection attacks, where images or video streams are inserted directly into the verification pipeline through virtual cameras, emulators or frame injection. - The report says an injection attack never reaches a physical sensor, making it a software integrity problem as well as a document problem. - Multi-identity account abuse concentrates in iGaming, forex and lending. - The report closes with a four-part framework covering multi-layered verification, identity network intelligence, behavioural and continuous verification, and risk-based decisioning. - Shufti also included an evaluation checklist for compliance and product teams to use when assessing identity verification providers.

Between the lines: - The data suggests fraud rings are industrializing identity abuse by recycling the same assets until one attempt succeeds. - Cross-border timing and shared infrastructure point to coordinated operations that individual institutions are unlikely to spot on their own. - The report’s framing matters because sector fraud rates combine attack volume and control strength, so the numbers measure exposure rather than a direct ranking of security quality.

What’s next: - Shufti is pushing buyers toward verification tools that combine deepfake detection, fraud ring detection, behavioural signals and continuous monitoring. - Compliance and product teams can use the report’s checklist and four-part framework to evaluate providers against coordinated fraud, not just single-transaction checks. - The company is directing readers to the full report for more detail.

The bottom line: - AI-enabled fraud is no longer just a fake-face problem; it is a network problem that moves across accounts, devices and borders.