Opening an account online often takes only a few minutes. You upload an identity document, take a selfie, and wait for approval. But the same convenient process gives criminals repeated opportunities to test fake or stolen identities.
The Identity Fraud Report 2026, published by identity verification provider Shufti, highlights a growing challenge in online identity verification: fraudulent applications may appear unrelated until a business connects the documents, devices, and network details behind them. A fake ID rejected in one application can resurface in another. Finding that connection can matter more than assessing each application separately.
WHAT DOES THE DATA SHOW?
The report draws on identity verification requests across 11 industries in the first half of 2026. Of the matches between fraudulent attempts that shared an attribute, 65.68% involved reuse of the same fraudulent identity document. Its largest connected cluster linked 70 identities across 13 devices through shared document, device and network signals.
Those connections warrant investigation; they do not establish that all 70 identities belonged to one person. A device or internet connection can also be shared for legitimate reasons.
In that dataset, confirmed identity fraud accounted for 22.49% of verification requests in crypto and exchanges and 18.36% in fintech. These figures describe the requests the company measured, not fraud rates across either industry as a whole.
The report also identifies AI-enabled methods. Deepfake document fraud, ranging from AI-altered genuine documents to wholly counterfeit ones, accounted for 80.10% of the AI-enabled fraud it recorded. For most businesses, however, the more pressing issue is how easily a false document can be reused with different images or account details.
HOW ARE FAKE IDS USED TO OPEN ONLINE ACCOUNTS?
An attacker may submit an altered document, pair it with a stolen or synthetic identity, and try to pass a selfie or liveness check. If an attempt fails, the document or other identity details may be used again through another device or connection. A later application can look new unless previous attempts are considered together.
This matters wherever accounts can be opened remotely. A false identity might be used to access financial services, claim a promotional benefit, obtain credit or evade an account restriction. The report describes these as possible forms of misuse; a shared technical signal alone does not prove any particular intent.
WHAT CAN INDIVIDUALS DO TO REDUCE IDENTITY FRAUD RISK?
People cannot control every place their identity details have been stored, but they can take practical steps to limit misuse and spot it sooner:
- Check where you upload your ID. Open the organization's official website or app yourself instead of following an unexpected verification link.
- Secure your key accounts. Use unique passwords and multi-factor authentication, especially for email and financial services.
- Act on unfamiliar notices. If you receive an account-opening message or verification code you did not request, contact the organization through its official channel.
If you suspect that someone has opened an account in your name, keep the relevant messages and contact the organization promptly so it can investigate.
HOW CAN BUSINESSES IMPROVE ONLINE IDENTITY VERIFICATION?
Document authentication and selfie checks remain useful at onboarding. The report suggests looking at repeated signals across applications as well: has a document already been rejected as false, or do several apparently unrelated applications share an unusual combination of devices, network details and identity attributes?
A proportionate response is to use existing onboarding and review processes to connect meaningful alerts, then reassess identity risk at sensitive moments such as account recovery or a high-value transaction. A shared device or IP address should prompt context-sensitive review, not an automatic fraud conclusion. Family members, for example, may use the same device or connection.
Businesses should also be able to explain and correct their decisions. Collecting more device or personal information only helps if it reveals a useful pattern and can be handled lawfully and securely.
WHY DOES IDENTITY VERIFICATION MATTER AFTER ONBOARDING?
A fraudulent link may emerge only when the same document is submitted later under another name. That is why a one-time approval cannot settle every future identity question. Reviewing new evidence when an account is recovered, changed or used for a significant transaction can help a business identify misuse that was not visible when the account opened.
CLOSING THOUGHTS
Identity fraud in 2026 is less about one convincing fake than about repetition: the same false document, tried again and again until an attempt gets through. That shifts the key question from “Is this ID genuine?” to “Have we seen any part of this before?”
Individuals who guard their details and act quickly on unfamiliar activity, and businesses that connect related signals without jumping to conclusions, make that repetition harder and less rewarding. Fraudsters rely on each attempt being judged in isolation; the most effective defense is to remember.
Source: Shufti, Identity Fraud Report 2026, pp. 5, 12, 15–17, 22–24, 35–36 and 41. Findings are based on the provider's internal production data for the first half of 2026, which the report states is not externally published, and should be interpreted within that dataset.