Shufti Finds Forged Documents Dominate Linked Fraud Attempts

Reused forged documents were the leading link between coordinated fraudulent onboarding attempts in the first half of 2026, according to an analysis of customer verification data released by identity verification provider Shufti.

The company’s Identity Fraud Report 2026 found that forged documents accounted for 65.68 percent of attribute matches connecting separate fraudulent attempts. Shared controlled IP addresses represented 17.67 percent of matches, while shared devices represented 16.64 percent.

Shufti said the largest connected cluster in its dataset linked 70 identities across 13 devices, with one device associated with 16 verification events. The pattern reflects fraud operations that reuse the same manipulated document, face, device or network infrastructure across multiple applications.

Cross-border activity represented 2.01 percent of the network fraud identified by Shufti. Within those groups, the median interval between activity in different countries was nine minutes and 33 seconds, while the fastest observed interval was 38 seconds.

The report draws on identity verification checks processed for Shufti customers in 11 industries from January through June. For each sector, the company calculated confirmed fraudulent verification attempts as a share of that industry’s total verification requests.

Digital-asset businesses recorded the highest attempted-fraud exposure at 22.49 percent, followed by fintech at 18.36 percent, foreign exchange at 17.18 percent, lending and investment at 17.08 percent, and online gaming at 12.45 percent. Shufti cautioned that those rates measure attack pressure together with the controls applied, not the relative security of each sector.

Deepfake document fraud represented 80.10 percent of the AI-enabled fraud identified in the analysis. Synthetic identities accounted for 12.31 percent, injected video for 4.01 percent and face swaps for 3.58 percent.

The distinction between presentation and injection attacks is central to remote onboarding. A presentation attack places a manipulated image or object in front of a physical camera, while an injection attack inserts images or video directly into the software pipeline. Recent government testing of remote identity verification systems has assessed both matching accuracy and defenses against fraudulent media.

Shufti has also been expanding the services surrounding identity checks, including qualified electronic signatures through an Evrotrust partnership. The new report focuses on the network relationships among fraudulent attempts and recommends combining document and biometric checks with device, behavioral and cross-attempt intelligence.

Sources: GlobeNewswire

–

By the ID Tech Editorial Team