The global rate of identity fraud decreased in 2025 from the previous year’s high, but the threats have become more severe.

Fraud isn’t retreating, it’s maturing. The sloppy, low-effort attacks that thrived in 2024’s era of widely available tools are being replaced by fewer but sharper operations: multi-step, coordinated, and built to bypass basic verification.

Sumsub, a global verification and fraud prevention firm, have identified this Sophistication Shift, signalling that the next stage of identity fraud won’t be measured by volume alone.

Why attackers are leveling up

Behind the numbers is a change in criminal behavior. When simple tactics stop working, fraudsters don’t quit — they evolve.

The 180% year-over-year increase in sophisticated fraud points to a broader shift toward more effective planning, stronger social engineering, and higher-quality forgeries.

The objective is no longer just to slip past a single checkpoint. It involves manipulating entire journeys, exploiting weak links across channels, and blending into legitimate user behavior long enough to cash out.

The data backbone of the 2025–2026 view

This year, Sumsub analysed more than four million fraud attempts, alongside insights from hundreds of fraud and risk professionals and over a thousand end-users.

Three-quarters of respondents believe identity fraud is becoming more sophisticated and AI-driven, a conviction that isn’t fueled by hype alone.

In 2025, AI-generated documents accounted for 2% of all detected fakes, with mainstream tools now integral to the fraud production process.

ID cards stand out as the most vulnerable document type, a reflection of how widely they are used, how frequently they are requested, and how easily well-crafted forgeries can pass superficial checks.

Industry pressure and the economics of trust

Dating and Online Media sit at the top of industries with the highest fraud rate, highlighting the power of social engineering in environments where identity can be fluid, and trust is often established quickly.

Financial Services and Crypto remain under sustained pressure, while Professional Services shows one of the sharpest year-over-year jumps, an indicator that higher-value, higher-trust environments are increasingly in scope.

Customer trust metrics add nuance rather than comfort. Financial Services remains the most trusted sector, even while facing chronic attack pressure.

Crypto appears on both high-fraud and high-trust lists, signaling that expectations are rising faster than defenses can standardise.

The underlying message is simple: trust is becoming conditional, and the organisations that protect it most visibly will shape customer choices in 2026.

Regional snapshots: progress, pressure, and deepfake momentum

In APAC, synthetic personal data spiked 142% year over year, suggesting a future where constructed identities become as operationally common as stolen ones.

Shockingly, 1 in 4 end users in APAC were found to have been personally targeted for money mule activity.

Europe’s overall fraud rate decreased between 2024 and 2025, yet deepfakes rose sharply across major markets, including France, Spain, and Germany.

LATAM and the Caribbean experienced strong growth in deepfake, alongside widespread consumer exposure to account compromise.

The Middle East combined steep rises in synthetic identity abuse with exceptionally high consumer expectations for robust anti-fraud controls.

Africa presents a mixed but encouraging picture, where regulatory maturity and crackdowns on cybercrime appear to be tied to declines in some major markets, even as deepfake growth continues to accelerate.

The U.S. and Canada experienced a welcome decline in overall fraud rates, but deepfake incidents increased rapidly, another example of the rise of sophisticated attacks.

What readiness looks like in 2026

The most resilient strategies for 2026 will likely be those that unify document and biometric signals with device and behavioral intelligence, integrate network detection into the core stack, and treat risk scoring as a continuous process rather than a one-time decision.

If 2024 was defined by accessibility, 2025 is defined by intent. The attacks are fewer, but the planning is deeper. The tools are more common, but the outcomes are more consequential.

The Sophistication Shift isn’t a trend to observe from a safe distance. It represents a structural shift that will reshape what security, trust, and growth will demand in the year ahead.

Sumsub’s Identity Fraud Report 2025-2026 is available here.

Featured image: Edited by Fintech News Malaysia, based on image by Freepik