Shufti report says fraud rings are using deepfakes to recycle identities across borders

Shufti’s Identity Fraud Report 2026 says organized fraud rings are using deepfakes, forged documents and shared infrastructure to target digital businesses during remote onboarding. Digital assets had the highest fraud share at 22.49% across 11 sectors, with cross-border networks and reused identities raising AML risks.

Why it matters: - Organized fraud rings are moving identity fraud from one-off attacks to repeatable, cross-border operations. - The report says that raises risk for KYC controls, AML compliance and remote onboarding across digital businesses. - Digital assets, fintech and forex face the highest exposure among the 11 sectors measured.

What happened: - Shufti published the Identity Fraud Report 2026 on Tuesday, based on its production verification data from January through June 2026. - The analysis covers remote onboarding fraud across 11 industries. - The report says deepfakes and AI-generated identity fraud are now being used by organized crime networks, not just individual fraudsters. - Those networks are using forged identity documents, synthetic identities, shared devices and controlled digital infrastructure to bypass KYC checks and move across jurisdictions.

The details: - Among linked fraudulent verification attempts, 65.68% of attribute matches traced back to forged identity documents. - Separate fraudulent attempts were also linked by shared controlled IP addresses at 17.67% and shared devices at 16.64%. - The largest connected cluster observed linked 70 identities across 13 devices. - One device anchored 16 verification events. - The report says generative AI has lowered the cost of producing convincing fake identities, letting one operator recycle the same document, face or device across multiple attempts. - A document declined as forged at one institution can reappear under another name, on another device and at another business. - Cross-border network fraud accounted for 2.01% of the cases in the report. - The typical interval between activity in one country and the next was 9 minutes 33 seconds. - The fastest observed interval was 38 seconds. - The report says that timing is inconsistent with physical movement between jurisdictions. - Digital assets recorded the highest share of remote onboarding fraud at 22.49% of verification requests. - Fintech followed at 18.36%, forex at 17.18%, lending and investment at 17.08%, and iGaming at 12.45%. - Deepfake document fraud made up 80.10% of AI-enabled fraud. - Synthetic identities accounted for 12.31%. - Injected videos accounted for 4.01%. - Face swaps accounted for 3.58%. - Altered documents led the detection rate by attack instrument in nine of the 11 industries measured. - Banking recorded a fraud rate of 4.24%, with replay and screenshot attacks remaining the leading vectors. - The report defines presentation attacks as manipulated artifacts that reach the system through the camera. - The report defines injection attacks as images or video streams inserted directly into the verification pipeline through virtual cameras, emulators or frame injection. - The report says injection attacks never reach a physical sensor and therefore also represent a software integrity problem. - Multi-identity account abuse concentrates in iGaming, forex and lending. - One operator can use multiple accounts to farm sign-up bonuses, evade self-exclusion or hold opposing positions. - The report closes with a four-part framework covering multi-layered verification, identity network intelligence, behavioral and continuous verification, and risk-based decisioning. - The report also includes an evaluation checklist for compliance and product teams.

Between the lines: - The report suggests the main threat is not a single fraudulent submission, but repetition across institutions. - Shufti’s analysis also points to a gap between document checks and network-level fraud detection. - Sector rates in the report reflect both attack pressure and the controls applied, so they measure exposure rather than a pure security ranking. - The cross-border timing pattern suggests centralized coordination rather than isolated local fraud.

What’s next: - Shufti says compliance and product teams can use its framework and checklist to assess identity verification providers. - Businesses in high-risk sectors are likely to face more pressure to combine document checks, deepfake detection and fraud ring intelligence. - The report points to broader adoption of continuous verification and risk-based decisioning as fraud networks become harder to stop at onboarding alone.

The bottom line: - Identity fraud is becoming networked, automated and cross-border, and the report says point-in-time checks are no longer enough to stop it.