AI and Deepfakes Are Streamlining Account Takeover Attacks – Digital Transactions
The allure of financial accounts continues to attract bad actors, and now they are using AI and deepfakes to impersonate legitimate consumers, making it tougher for companies to protect these accounts. That’s one takeaway from Microblink’s latest review of account-takeover fraud data.
Microblink, a fraud-prevention firm based in Brooklyn, N.Y., said its own data finds that 30% of fraud failures involved fake U.S. identity documents. The use of fake documents can help criminals gain access to trusted accounts, Microblink says.
A complete false credential may not even be necessary for a criminal to start building a fake identity. As Javelin Strategy & Research outlined in its 2026 Identity Fraud Study, a consumer tricked into releasing some data may be enough. “Now that your information is out there, we don’t really know what’s going to happen to it,” Suzanna Sando, lead analyst in the Javelin fraud-management practice, told Digital Transactions News in April. The victim may consider the threat neutralized, but realistically, the criminal may harbor it only to use it later for another scam or identity-fraud scheme, she says.
Microblink says the dilemma for consumers and businesses is that account takeovers expose a weakness in traditional approaches to digital identity. These approaches assume trust does not change over time. But consumers may create an account and pass the identity-verification stage and then continue to use the account for years, and even may adopt multifactor authentication as another safety measure.
“None of those events guarantees that every future interaction with the account is legitimate,” Microblink says in its report. “Modern fraud attacks move across the customer journey. They adapt and target the moments where trust is assumed rather than verified.”
This takes on greater importance as AI agents evolve, which could spur more consumer use. “Digital interactions will increasingly involve not only humans, but software acting on their behalf. Establishing identity at account creation will remain important, but organizations will also need to understand who is acting, under whose authority, and whether the behavior makes sense within the context of the relationship,” Microblink says.
