New account fraud is a type of identity fraud in which a criminal opens a bank, credit, telco or online gaming account using a stolen, synthetic or fabricated identity. It is usually blamed on a one-off failure at onboarding, such as a forged document that slipped through or a verification process that was too lenient, and that explanation holds for some cases.
Well-built synthetic identities and deepfakes injected into the capture flow pose a different problem, because they are designed to pass each check independently. In those cases, the document, the biometric match and the liveness check can each return a correct result while the whole describes an identity that should never have been approved.
It is not a minor problem. In the UK, Cifas, the not-for-profit organization that runs the fraud database shared by the country’s banks and businesses, recorded more than 242,000 identity fraud cases in 2025, 54% of all fraud risk cases, according to its Fraudscape 2026 report. In Colombia, the Superintendencia de Industria y Comercio (SIC), the national consumer and data protection authority, received almost 14,000 identity impersonation complaints through its consumer complaints platform between 2022 and May 2026, 81% of them in telecommunications (SIC, June 23, 2026).
Reading those checks together is the idea I developed in my two articles on contextual defense, applied this time to the very first moment of the customer relationship. From there, I look at how fraudulent accounts are opened today, which signals give the attacker away during onboarding, which verification step stops each method and why, in my view, onboarding verification needs to be repeatable later on.
What Is New Account Fraud?
New account fraud is fraud in which a criminal gets an organization to open a new product under an identity it should never have accepted. It always happens at the same moment, customer onboarding, which is why it is also called account opening fraud or application fraud. The goal is usually to obtain credit, move illicit money or use the account to commit further fraud.
Three concepts are often used almost interchangeably and are worth separating:
- Identity theft: obtaining someone’s personal data, for example after a data breach or a phishing attack.
- Impersonation: using that data to pose as that person before an institution.
- New account fraud: impersonation, or an invented identity, applied to opening a new account.
The distinction has practical consequences. While someone only holds the data, there is no loss yet; the loss begins when that data is used to open an account, which is why onboarding is where every check pays off most. Synthetic identities complicate matters further, because there may not even be a real victim to report it.
Legal treatment also varies by country. In Spain, Article 401 of the Criminal Code punishes anyone who usurps another person’s civil status (BOE, Criminal Code), but the Supreme Court (Tribunal Supremo) requires the offender to appropriate rights or obligations that belong only to the impersonated person, with some continuity over time (STS of January 15, 2025). As a result, a one-off fraudulent account opening may end up being prosecuted as fraud or document forgery. Colombia has opted for specific legislation. Ley 2573 of 2026, enacted on May 19, requires financial and credit institutions, telecom operators and retailers to adopt measures to protect impersonation victims. Its general provisions take effect in November, six months after enactment, although some provisions have applied since that same day (Ley 2573 de 2026).
The 4 Most Common New Account Fraud Methods
Attackers don’t rely on a single method. They choose whichever one gets past each institution’s checks and switch as soon as they meet resistance, a pattern we see repeated across very different markets. These are the four most frequent, each with the verification step that stops it.
1. Stolen identities
The criminal uses a real person’s data, obtained through data breaches, data trading or phishing campaigns. In Mexico, the Comisión Nacional para la Protección y Defensa de los Usuarios de Servicios Financieros (CONDUSEF), the public body that protects banking customers, has warned of a rise in fraud attempts via SMS, messaging apps and fake links designed to obtain banking information or commit identity theft.
Because the data belongs to a real person, the application easily passes basic checks, and the case is usually discovered late, when the victim is chased for a product they never took out, as shown in some real-world cases of identity fraud we have compiled.
At onboarding, what stops it is combining a biometric match between the applicant’s face and the document photo with a check that the document itself is genuine, because someone holding stolen data can present a forged document bearing their own face.
2. Synthetic identities
Here the identity is fabricated by combining real and invented information, for example a valid identification number with a name and address that belong to no one. With no negative history and no victim to report its use, it doesn’t trigger traditional alerts, which is why synthetic identity fraud has dynamics of its own that deserve separate analysis.
At onboarding, document and biometric verification stop it, together with checks against official registries where they exist, because they force the name, ID number, document and face to match each other and a reliable source.
3. Forged or manipulated documents
The attacker presents an ID card, passport or other identity document that has been altered, forged or generated with AI. Cifas notes that generative AI is making forged documents and synthetic identities increasingly convincing. The bar rises when verification goes beyond the image of the document. Its security features are checked, along with the machine-readable zone (MRZ), the lines of characters at the bottom that include check digits to detect tampering. For electronic documents, the NFC chip is also read; it stores the holder’s data and photo, digitally signed by the issuing authority. That signature makes the chip’s contents far harder to forge than the printed surface.
4. Deepfakes and injection attacks
This is the most sophisticated method and the one we follow most closely in R&D, because it changes the nature of the problem. In a presentation attack, the attacker places something in front of the camera, such as a photo, a screen or a mask. In an injection attack, the camera is taken out of the process. Using virtual cameras, emulators or tampered devices, the attacker injects a recorded video or a deepfake directly into the capture flow, and the system receives a flawless image that never passed through a real sensor.
That is why the US National Institute of Standards and Technology (NIST), whose digital identity guidelines are a technical reference across the industry, now requires identity providers to detect virtual cameras, emulators and jailbroken devices (NIST SP 800-63A-4). It is the same vector behind many deepfakes in identity verification.
At onboarding, liveness detection and injection attack detection in the capture channel stop it.
New Account Fraud vs. Account Takeover
New account fraud creates a fraudulent account from scratch, while account takeover hijacks an existing, legitimate account. They target different moments in the customer relationship, and confusing them leads to strengthening the wrong control. The Financial Action Task Force (FATF), the body that sets international standards against money laundering, explains this in its 2020 guidance on digital identity. According to the FATF, verification at onboarding answers the question of who the person is, while authentication later confirms that whoever is accessing the account is the same person who was verified.
| New account fraud | Account takeover | |
|---|---|---|
| What happens | A new account is opened with a stolen, synthetic or fabricated identity | An existing, legitimate account is hijacked |
| When | At onboarding | After onboarding, at any login or transaction |
| What is exploited | Identity verification at onboarding | Authentication: passwords, social engineering, SIM swapping |
| Who loses | Mainly the institution, and the impersonated person in their credit history | The legitimate customer, whose funds or credit are drained |
| Typical signal | Tampered document, mismatched selfie, application velocity | Unknown device, changed contact details, anomalous behavior |
Identity verification at onboarding stops the first. Against the second, authentication and reverification play a role, but so do device and behavioral signals during the session, because in an account takeover the credentials are usually correct and what gives the attacker away is how they behave. When all of them work on the same identity and share their evidence, each one makes the others more reliable.
New Account Fraud Red Flags During Onboarding
No risk signal should be read in isolation, and at onboarding that principle is especially useful. Some indicators have legitimate explanations on their own but deserve a second look:
- Data that doesn’t add up: name, date of birth, address or phone number that don’t match the document, or a network location inconsistent with the declared address.
- Document anomalies: inconsistent holograms, fonts or MRZ check digits. The European Banking Authority (EBA) explicitly requires checks on the security features embedded in official documents (EBA/GL/2022/15).
- Unreadable NFC chip on a document that should have one.
- Selfie that doesn’t match the document photo.
- Capture with no signs of life, such as a printed photo, a screen or a mask.
- Signs of a virtual camera, emulator or tampered device.
- Reused infrastructure: the same device, IP or network behind many applications, or proxies that appear on blocklists.
- Abnormal velocity: too many applications in too little time.
These signals come from different sources. Some come from verifying the document and the face, and others, such as the device, the network or application velocity, from analyzing the session. A customer who switches phones on the day of onboarding or applies from another city is not suspicious for that reason alone. The pattern emerges when several signals coincide on the same identity, and that is when it makes sense to ask for an additional check. It is also worth remembering that a new identity is not necessarily a suspicious one; it is simply an identity about which little is known yet.
How Identity Verification Stops New Account Fraud
Detecting fraud at onboarding comes down to three questions: whether the document is genuine, whether the person presenting it is its owner and whether they are really present. Each fraud method attacks one of them, and each is answered by a specific verification step.
| Fraud method | Verification step that stops it | Reference standard or guidance |
|---|---|---|
| Stolen identity | 1:1 biometric match between the face and the document photo, together with document authenticity verification | EBA/GL/2022/15 · ICAO 9303 |
| Synthetic identity | Document and biometric verification and, where available, checks against official registries (INE/RENAPO in Mexico, Registraduría in Colombia) | EBA/GL/2022/15 |
| Forged or manipulated document | Security feature and MRZ checks, with NFC chip reading | ICAO 9303 |
| Deepfake or injection attack | Liveness detection and injection attack detection in the capture channel | ISO/IEC 30107-3 · CEN/TS 18099 · NIST SP 800-63A-4 |
Together, document verification, biometric matching, liveness detection and injection attack detection close the main routes fraudsters use to open accounts, although none of them does so on its own.
The regulatory framework pushes in the same direction in the markets where we operate:
- European Union: the EBA guidelines on remote customer onboarding, applicable since October 2, 2023, require institutions to check that the person’s visible information matches the documentation provided and, in unattended onboarding, to perform liveness detection checks (EBA/GL/2022/15).
- Mexico: the Comisión Nacional Bancaria y de Valores (CNBV), the national banking supervisor, regulates non-face-to-face customer identification, a key piece of AML compliance in Mexico.
- Colombia: Ley 2573 requires institutions to hand over a copy of the information and documents provided at onboarding when the alleged victim requests it, to suspend any service obtained fraudulently and to investigate the possible liability of their staff (Ley 2573 de 2026).
Each verification step at onboarding also leaves evidence behind: the verified document, the result of the biometric match and the liveness check, and the date and time of each check. That evidence makes it possible to show later how an account was approved, something regulations such as Ley 2573 are beginning to require, and it becomes part of the identity’s history for subsequent checks.
None of this has to turn onboarding into an obstacle course. The response should be proportional to the risk, so that legitimate customers complete onboarding without extra steps and a dynamic challenge, an additional verification to gather more evidence before deciding, is triggered only when the signals don’t match. That is how good onboarding fraud detection works.
Why Identity Verification Can’t Stop at Onboarding
For years, identity was treated as an event that was checked once at onboarding and taken for granted from then on. Consider a concrete case. An account is opened with a well-built synthetic identity, passes the onboarding checks and sits almost dormant for months. One day it starts receiving transfers from third parties and forwarding them within hours. By the time that pattern appears, onboarding verification has already done its job and no one looks at it again.
“Onboarding is day one. Fraud can happen on any other day.”
Some accounts opened with synthetic or stolen identities are later used as money mule accounts, with no real person behind them who lent them out, or in bust-out schemes, in which the fraudster builds a clean history before maxing out the available credit.
That is why the identity verified at onboarding must be able to be checked again when the context changes, with reverification when risk rises, a dynamic challenge for an unusual transaction or biometric authentication before a sensitive operation. That is the idea behind continuous identity. Identity is not verified nonstop; each new check builds on the evidence gathered since day one and adds to it.
Key Takeaways for Fraud and Risk Teams |
|
Frequently Asked Questions
New account fraud is a type of identity fraud in which a criminal opens a bank, credit, telco or online gaming account using a stolen, synthetic or fabricated identity. The goal is usually to obtain credit, move illicit money or use the account to commit further fraud under an identity the organization should never have accepted.
Not exactly. Identity theft is obtaining someone’s personal data, while new account fraud is using stolen or invented data to open an account. With synthetic identities, there may not even be a real victim.
New account fraud creates a fraudulent account from scratch, while account takeover hijacks an existing, legitimate account. The first is a problem of accepting a false identity at onboarding, and the second, of failing to confirm later that whoever is operating the account is still its owner.
Yes. Fraudsters use AI-generated faces and videos, sometimes injected directly into the capture flow through virtual cameras or emulators, to pass selfie checks. Liveness detection and injection attack detection are designed to stop this at onboarding.
By checking at onboarding that the document is genuine, that the person presenting it is its owner and that they are really present. Together, document verification, biometric matching, liveness detection and injection attack.
