Impersonation: the patterns that keep coming back.
Techniques change; the shapes of identity fraud repeat.
Every few years a new identity fraud technique appears that seems to change everything. First it was stolen passwords, then intercepted text messages, later photos and masks, and now videos and voices generated by artificial intelligence. The tools change quickly. The forms fraud takes, however, are few, and they repeat. Knowing them makes it possible to design defenses that will not become obsolete with the next novelty.
Six patterns
1. Stealing the credential
The attacker obtains whatever the person uses to prove who they are: a password, a code, a key. The classic route is deception, through messages that imitate a bank or a provider. It works against any system that depends on a secret the person is able to reveal.
2. Intercepting the channel
Instead of stealing the secret, the attacker gets in the path it travels along. The best known example is the fraudulent duplication of a SIM card in order to receive codes sent by text message. That is why, since 2017, the NIST digital identity guidelines have classified SMS codes as a restricted authenticator.
3. Faking the presentation
In front of a camera or sensor, the attacker shows something that is not the person: a photo, a screen playing a video, a mask, a tampered document. The ISO/IEC 30107 standard calls these presentation attacks and defines how to evaluate a system's ability to detect them.
4. Injecting instead of presenting
One step further: the attacker places nothing in front of the camera, but instead replaces the camera feed with a fabricated video, using virtual cameras, emulators or tampered devices. This is where synthetic faces and voices are most dangerous, because the system never sees the real world.
5. Deceiving the legitimate person
The hardest fraud to detect is the one in which the right person, with the right credential, signs or authorizes something under false pretenses. In 2024, the Hong Kong police reported the case of an employee at a multinational company who transferred about HK$200 million after a video call in which every other participant, including a supposed chief financial officer, was an imitation generated by artificial intelligence. No identity check failed: the person was exactly who they claimed to be.
6. Abusing account recovery
Many systems are strict about getting in and generous about recovering an account. If a call to the help desk or an email is enough to change the phone number or reset the password, that is the system's true level of security, however demanding everything else may be.
From pattern to defense
| Pattern | A defense that does not depend on the technique of the moment |
|---|---|
| Credential theft | Factors that cannot be revealed or reused, such as keys stored on the device or physical security keys. |
| Channel interception | Authenticators bound to the device instead of codes that travel over the telephone network. |
| Fake presentation | Independently evaluated liveness detection, and reading the document's chip rather than its photo. |
| Injection | Controls on the integrity of the device and of the capture itself, not just the image. |
| Deceiving the person | Verification through a separate channel, dual approval, and pauses for unusual transactions. |
| Weak recovery | Requiring the same level for recovery as for enrollment. |
- Which of the six patterns does it protect against, and which does it not?
- Is account recovery held to the same level as enrollment?
- Is there a pause or a second approval for anything unusual?
- Does the evidence record which controls were applied and with what result?
Identity fraud follows six patterns: stealing the credential, intercepting the channel, faking the presentation, injecting signals, deceiving the legitimate person, and abusing account recovery. Techniques change; patterns do not. A layered defense, designed for each pattern and recorded in the evidence, holds up better than any single technology.