Identity fraud and onboarding security

Identity security is an end-to-end operating problem. Strong capture can be defeated by forged evidence, injected media, weak manual review, duplicate enrolment, compromised recovery or misuse after onboarding.

For: fraud, CISO, identity-product, operations and procurement teams. This is independent information, not legal, compliance or security advice.

Attack surface

• Evidence acquisition, forgery and alteration.
• Photo, replay, mask, deepfake and injection attacks.
• Device compromise, automation and velocity.
• Synthetic identities and duplicate enrolment.
• Reviewer manipulation, coercion and social engineering.
• Account recovery, authenticator reset and support takeover.

Control layers

1. Define assurance and evidence requirements.
2. Validate evidence and authoritative attributes.
3. Verify ownership and applicant presence.
4. Protect capture, session, device and API paths.
5. Detect velocity, duplication and anomalous behaviour.
6. Govern manual review, recovery and privileged access.
7. Monitor post-enrolment events and respond to incidents.

Measure security without hiding user harm

Track fraud losses and confirmed attacks alongside false rejection, abandonment, manual-review demand, appeals and accessibility. An aggressive control can appear secure by excluding legitimate users.

Evidence hierarchy

Independent testing and current production telemetry are stronger than marketing claims, but both have limitations. Record attack scope, configuration, threshold and known gaps, and treat newly disclosed bypasses as change triggers.

Evidence and limits

MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.

• ENISA Remote Identity Proofing: Attacks and Countermeasures
• NIST SP 800-63A-4 identity proofing

Sources checked 22 August 2026. Re-check the linked primary material before making a consequential decision.

Next useful pages

• Attack types
• Deepfake controls
• Incident response