Loading the State of Identity Fraud 2026 report…
VerifyNow Intelligence Series
The State of
Identity Fraud
2026
Measured consumer harm, AI-enabled identity attacks, South African context and layered defence.
$27.3bn
US traditional identity fraud losses · 2025
18m
US victims · representative survey
1 in 5
Biometric fraud attempts linked to deepfakes · vendor network
+741%
Annual iOS injection attack growth · monitored environment
Prepared by
VerifyNow Research Team
verifynow.co.za
2026
Updated 26 July
Table of Contents
Sixteen sections with measured figures separated from network and survey evidence.
01Executive Summary02Measured Identity Fraud03Types of Identity Fraud04AI, Deepfakes and Injection05Account and Payment Fraud06Industry Impact07South African Context08Cross-Border Verification09Data Breaches and Identity Risk10Victim and Customer Impact11Regulatory Landscape12Prevention and Detection13Control Checklist14Emerging Threats15Applying the Research16Methodology and Sources
01
Executive Summary
Losses levelled off, but victim exposure and attack quality increased
Data currency. Consumer figures use Javelin's 2026 study, based on a representative survey conducted in late 2025. FTC figures are unverified consumer reports from 2024. Technical attack figures describe named vendor networks, not the whole identity-fraud market.
Traditional identity fraud cost US consumers $27.3 billion in 2025. Javelin estimates 18 million victims. New-account fraud victims rose 31%, from 4.2 million to 5.4 million, while account-takeover victims rose 18%, from 5.1 million to 6 million. (Javelin 2026 Identity Fraud Study)
AI-enabled methods are present, but there is no defensible global incident total. Deepfakes accounted for roughly one in five biometric fraud attempts in Entrust's network. iProov observed a 741% annual rise in iOS-targeted injection attacks. These measures use different populations and must not be added together. (Entrust 2026 Identity Fraud Report) (iProov 2026 Threat Intelligence Report)
Identity proofing must treat the capture channel as part of the evidence. NIST requires genuine-sensor confidence, forged-media analysis, protected channels, documented testing and manual review where needed. It says biometric comparison and presentation-attack detection do not cover every injection or forged-media case. (NIST SP 800-63A-4, July 2025)
US losses
$27.3bn
Traditional identity fraud · 2025
US victims
18m
Representative consumer survey
New-account victims
+31%
4.2m to 5.4m
ATO victims
+18%
5.1m to 6.0m
02
Measured Identity Fraud
Loss, victims and reports answer different questions
Javelin's survey measures US adult experiences and estimates population totals. FTC Consumer Sentinel records reports submitted to the agency and its contributors; those reports are not verified cases and are not a population survey. In 2024, Sentinel received 6.5 million consumer reports across fraud, identity theft and other consumer-protection categories, including more than 1.1 million identity-theft reports. (FTC Consumer Sentinel Data Book 2024)
Victims of new-account fraud and account takeover
Millions of United States adults · 2024 versus 2025 · Javelin consumer survey
| Fraud type | 2024 victims | 2025 victims | Change |
|---|---|---|---|
| New-account fraud | 4.2m | 5.4m | +31% |
| Account takeover | 5.1m | 6.0m | +18% |
“Fraud reports”, “victims”, “losses”, “fraud attempts” and “verification fraud rate” are not interchangeable. Every chart in this revision keeps the original unit and denominator visible.
03
Types of Identity Fraud
The useful distinction is how the identity is obtained and used
New-account fraud
A stolen, fabricated or synthetic identity is used to open a new financial, telecoms, retail, betting or other account.
Account takeover
An attacker gains control of an existing account through stolen credentials, social engineering, SIM compromise or recovery-process abuse.
Document and biometric fraud
Documents or biometric media are forged, altered, replayed, deepfaked or injected into a remote identity-proofing process.
Synthetic identity
Real and fabricated attributes are combined into an identity that may be cultivated over time before higher-value abuse.
Payment identity fraud
A stolen identity or payment credential is used for account opening, card-not-present payments, refunds or withdrawals.
Impersonation and coercion
A criminal convinces a person, employee or support agent to disclose credentials, change an account or approve a transaction.
Selected FTC identity-theft report subtypes
Consumer reports · United States · 2024 · categories may overlap
04
AI, Deepfakes and Injection
Attack realism improved; the measurement remains fragmented
Entrust's 2026 report draws on more than one billion verifications from September 2024 to September 2025. It reports that physical counterfeit documents represented 47% of document fraud in its network, digital forgeries 35%, physical forgeries 10% and digital counterfeits 9%. The total is 101% because the published values are rounded. (Entrust 2026 Identity Fraud Report)
Document fraud by production method
Share of document fraud · Entrust verification network · 2025 · rounded values
1 in 5
Biometric fraud attempts
Entrust linked roughly one in five biometric fraud attempts in its network to deepfakes.
+40%
Injection cadence
Entrust reported an approximately 40% annual increase in injection-attack cadence.
+741%
iOS injection attacks
iProov reported annual growth in iOS-targeted injection attacks in its monitored environment.
Identity fraud rate in one verification network
Sumsub network · 2023 to 2025 · not a global population rate
The former unsourced deepfake-count series and modelled AI-share series have been removed. The current evidence is reported source by source, with its own denominator.
05
Account and Payment Fraud
The identity decision must survive login, recovery and payout
New-account fraud and account takeover now affect more US adults than they did a year earlier. The two risks require different controls. New-account fraud tests whether the person and evidence are genuine; account takeover tests whether the current actor is still the legitimate customer. (Javelin 2026 Identity Fraud Study)
At account opening
Document validation, genuine-sensor checks, biometric comparison where lawful, device integrity, identity-attribute consistency, sanctions and risk screening.
At authentication
Phishing-resistant or risk-based authentication, device change detection, credential-stuffing controls and session-risk analysis.
At account recovery
Treat phone, email and password changes as high-risk identity events. Prevent a support interaction from bypassing stronger login controls.
At payment or withdrawal
Check payer or beneficiary ownership, transaction velocity, profile consistency and recent account changes before releasing value.
A successful identity check is not a permanent trust decision. High-risk changes should trigger re-authentication or re-verification proportionate to the value and threat.
06
Industry Impact
The same identity can be abused differently by sector
Financial services
New accounts, credit applications, payment fraud, account takeover and mule activity connect identity risk directly to financial loss and AML obligations.
Online betting
Stolen or repeated identity, underage access, bonus abuse, third-party payments, account takeover and laundering risks appear at different lifecycle stages.
Telecommunications
SIM compromise and account recovery can redirect authentication and weaken controls used by other sectors.
Retail and ecommerce
Stolen accounts, new-account promotion abuse, card-not-present fraud and refund diversion link identity to payment risk.
Employment and platforms
Fabricated credentials, impersonation and synthetic profiles affect onboarding, access to systems and payout accounts.
Government and public services
Identity misuse can redirect benefits, create fraudulent records or exploit high-volume remote-service channels.
For the current evidence on licensed betting, casino fraud and FIC Act duties, read the The 2026 iGaming Industry Report.
07
South African Context
Grey-list exit does not end the control work
FATF removed South Africa from increased monitoring on 24 October 2025 after the country addressed the strategic deficiencies in its action plan. FATF's statement points to improvements in beneficial-ownership access, risk-based supervision, use of financial intelligence, money-laundering investigations, confiscation and targeted financial sanctions. (FATF, 24 October 2025)
The removal is not evidence that identity fraud or money-laundering risk disappeared. For businesses, the practical question remains whether customer due diligence, beneficial-ownership work, transaction monitoring, sanctions controls and reporting operate effectively in the current channel.
Document diversity
Risk models must support the identity documents and populations the service actually accepts without treating document format alone as proof of fraud.
Mobile-first journeys
Device, SIM, application, network and account-recovery signals matter where onboarding and authentication happen primarily on a phone.
Provider evidence
An external verification result should retain source, time, input, decision, confidence and fallback information for later review.
08
Cross-Border Verification
Coverage and assurance are different questions
Cross-border identity proofing introduces different documents, scripts, registries, privacy rules, sanctions exposure and fraud patterns. A provider's country list proves availability, not equal assurance. Organisations should define what evidence is accepted, which checks are authoritative, how transliteration is handled and when manual review is required.
| Risk | Control question | Evidence |
|---|---|---|
| Document coverage | Does the check validate this exact document version and issuing country? | Document type, version, issuer, capture quality and validation result. |
| Name and script | Can the workflow preserve the original script and explain transliteration? | Original value, transliterated value, match logic and reviewer decision. |
| Data source | Is the result based on document analysis, a database, user assertion or a combination? | Provider, source class, response time and returned attributes. |
| Privacy and transfer | Where is personal or biometric data processed and retained? | Lawful basis, notices, processor terms, transfer controls and deletion record. |
| Fallback | What happens when the strongest source is unavailable? | Fallback reason, reduced-assurance label and any additional manual evidence. |
09
Data Breaches and Identity Risk
A breach supplies attributes; later systems decide whether they are enough
Stolen identity attributes can support phishing, credential stuffing, synthetic profiles, help-desk impersonation and knowledge-based verification. Breach volume is therefore not the same as identity-fraud loss, but it changes the value of static questions and reused personal information as evidence.
POPIA section 19 requires a responsible party to identify foreseeable internal and external risks, establish appropriate safeguards, verify that safeguards are implemented and update them. Section 22 addresses notification when there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. (Information Regulator, POPIA guidance)
The previous unverified breach-volume claim has been removed. Material breach figures should appear only when confirmed by the organisation, regulator or another primary record with a clear scope.
10
Victim and Customer Impact
Resolution time is part of the harm
10.4h
Average resolution time
Time spent resolving identity-fraud issues in 2025, up from 9.5 hours in 2023.
17.0h
Account takeover
Average resolution time reported by account-takeover victims.
17.8h
New-account fraud
Average resolution time reported by new-account fraud victims.
These Javelin measures are United States survey estimates. They show why customer-impact monitoring should include time to restore access, repeated evidence requests, complaint volume and the quality of communication, not only reimbursed loss. (Javelin 2026 Identity Fraud Study)
Age alone should not become an automatic fraud label. Use behaviour, identity evidence, device, transaction and contextual signals, then test for unfair outcomes across customer groups.
11
Regulatory Landscape
Privacy, financial crime and identity assurance have different scopes
POPIA
Applies to the lawful and secure processing of personal information. Identity and biometric workflows need purpose, proportionality, safeguards, processor controls, retention decisions and incident handling. (Information Regulator, POPIA guidance)
FIC Act
Applies where the business is an accountable institution. Duties include registration, an RMCP, customer due diligence, ongoing monitoring, records, reporting, governance and training. (Financial Intelligence Centre compliance guidance)
Sector rules and licences
Financial services, telecoms, gambling, credit, employment and other sectors add their own licensing, conduct, customer-protection and reporting requirements.
NIST SP 800-63-4
A technical standard rather than South African law. It is useful for designing and testing remote identity proofing, especially injection and forged-media controls. (NIST SP 800-63A-4, July 2025)
The previous unsourced future-amendment label, universal beneficial-owner threshold and fixed future deadlines have been removed. Legal duties depend on the institution, relationship, risk and current official instruments.
12
Prevention and Detection
No single biometric, database or score closes the problem
1
Resolve and validate the identity
Collect the minimum necessary attributes, validate authoritative evidence where available and record the source and time of each result.
2
Inspect documents and capture channels
Test document integrity, media manipulation, device integrity, virtual cameras, emulators and genuine-sensor confidence.
3
Use biometrics proportionately
Combine biometric comparison with presentation-attack and injection controls. Define accessibility and manual-review paths.
4
Bind identity to account, device and payment
Detect repeated identity elements, shared infrastructure, payment-owner mismatch and new beneficiaries.
5
Monitor the relationship
Reassess risk at login, recovery, profile change, transaction and payout. Do not treat onboarding as permanent proof.
6
Investigate and learn
Give reviewers the complete event sequence, preserve evidence, measure confirmed outcomes and test controls against current attack artefacts.
Passive or active liveness can help, but NIST says capture and presentation-attack controls are not sufficient for every injection or forged-media case. (NIST SP 800-63A-4, July 2025)
13
Control Checklist
Evidence that can survive a later investigation
Define accepted identities, documents, countries and assurance levels.
Record which source produced every material identity result.
Test document and biometric controls against current attack artefacts.
Detect virtual cameras, emulators, tampered media and device compromise.
Link identity, account, device, contact details and payment ownership.
Apply strong recovery controls to email, phone and password changes.
Reassess risk at high-value transaction and withdrawal points.
Keep manual-review reasons, evidence and override decisions.
Measure false acceptance, false rejection and customer abandonment.
Review privacy, retention, processor and breach-response controls.
Map FIC Act duties only where the institution is in scope.
Update controls when confirmed cases expose a new failure mode.
14
Emerging Threats
Watch attack paths, not unsupported loss forecasts
Human-like automation
Bots and automated agents can imitate normal interaction, test defences and operate accounts at a scale that manual rules miss.
Real-time synthetic media
Live face swaps, generated documents and injected video reduce the value of unauthenticated camera capture.
Identity packages
Stolen documents, credentials, devices and biometric media can be sold together as a reusable onboarding or takeover kit.
Cross-channel replay
An identity that fails in one provider or sector may be retried through a different channel with altered evidence.
Recovery-path attacks
Support agents, SIM changes and credential recovery remain attractive because they can bypass controls at normal login.
Evidence pollution
Synthetic documents and profiles can enter internal and third-party data sources, making later corroboration less independent.
These are threat directions supported by current network reports and technical guidance. They are not forecasts of incident counts or financial loss.
15
Applying the Research
Start with the decision and evidence, not a product label
An identity control should state what it decides, which evidence it uses, the population it covers, its failure and fallback conditions, and the record retained. That makes provider changes, audits and investigations possible without confusing a vendor response with the final business decision.
Decision
What action is being permitted, restricted or referred, and what assurance is required?
Evidence
Which document, registry, biometric, device, account and transaction signals support the decision?
Audit
Can a reviewer reconstruct the source, time, rule, exception and human judgement later?
Review a high-risk identity journey
VerifyNow can help scope the evidence and controls around account opening, recovery, high-risk transactions or cross-border verification.
Request an enterprise assessment16
Methodology and Sources
Measured results are separated from reports, network data and standards
The July 2026 revision removed unsupported projections, interpolated deepfake counts, synthetic AI-share estimates, unconfirmed breach figures and legal claims that could not be matched to a current official source.
Consumer survey estimates, consumer reports and vendor-network detection rates answer different questions. The report keeps those evidence types separate. Competitor research is named where it supplies a necessary statistic but competitor websites are not linked.
- [1]Javelin Strategy & Research: 2026 Identity Fraud Study: The Illusion of Progress2026 · Representative consumer survey · 5,010 United States adults surveyed in November and December 2025
- [2]United States Federal Trade Commission: Consumer Sentinel Network Data Book 2024March 2025 · Consumer report database · Unverified reports submitted by consumers and data contributors
- [3]Entrust: 2026 Identity Fraud Report2026 · Identity-verification network · More than one billion verifications, September 2024 to September 2025
- [4]iProov: 2026 Threat Intelligence Report8 April 2026 · Threat-intelligence network · Injection and deepfake activity observed in monitored environments
- [5]Sumsub: Identity Fraud Report 2025–20262025 · Identity-verification network · Global verification network; figures are not population estimates
- [6]National Institute of Standards and Technology: SP 800-63A-4: Identity Proofing and EnrollmentJuly 2025 · Technical standard · Remote identity proofing and forged-media controls
- [7]Financial Action Task Force: Jurisdictions under Increased Monitoring24 October 2025 · Intergovernmental statement · Removal of South Africa from increased monitoring
- [8]Information Regulator South Africa: POPIA guidance and security-compromise notificationAccessed 26 July 2026 · Regulatory guidance · Security safeguards and notification duties for personal information
- [9]Financial Intelligence Centre: Compliance and supervisionAccessed 26 July 2026 · Regulatory guidance · Duties applying to businesses that are FIC Act accountable institutions
Published 12 February 2026. Fact-checked and updated 26 July 2026. This report is general research, not legal or regulatory advice.