- In its report, TransUnion says trust can no longer be settled at onboarding alone. It says account login made up 53% of suspected digital fraud in the first half of 2026.
- TransUnion's Brian Killeen says attackers use leaked data, deepfakes and automated pipelines to pass sign-up checks and probe defenses. TransUnion argues that identity needs continuous assessment.
- Leaders should ask where identity is rechecked after sign-up: login, password resets, help desks and payment changes. Each recheck adds friction that has to be weighed.
Trust checked once goes stale
Dark Reading reports that many organizations have tightened security at sign-up. A new TransUnion report argues that this is not enough. Fraudsters, it says, exploit trust throughout the customer lifecycle.
The report puts it this way: "Trust has become easier to exploit and harder to establish." Our reading is that identity is not a stamp you collect once. It is a signal that ages, and it needs renewing when someone asks for something that matters.
What TransUnion reports
In its report, as Dark Reading quotes it, TransUnion says fraud now mostly happens after a customer is already on the books. The sources give no figure, period or market behind "most". Treat it as TransUnion's claim, not a measured rate.
Dark Reading also reports that 58% of organizations described themselves as very or extremely worried that fraud is adapting faster than their defenses can respond.
TransUnion says account login accounted for 53% of all suspected digital fraud in the first half of 2026. The sources do not say which markets or dataset that covers. The report says it combines TransUnion's global intelligence network with business and consumer research across multiple markets.
Our reading is that login fits the argument, because it comes after sign-up. But the sources do not say who was logging in. They do not say whether these were returning customers or takeovers of older accounts.
The report names three shifts: manufactured identities, communications as an early fraud signal, and AI-enabled attacks that it says have industrialized fraud.
How the attack works
Brian Killeen, TransUnion's vice president of global identity solutions, told Dark Reading that widespread data breaches make fake identities easy to build. Scammers copy leaked documents or use deepfakes to get past identity checks at onboarding.
He also said attackers build logic into automated pipelines that reverse-engineer security controls. That lets them find where and how defenses block them. This is one executive's account to a trade outlet, and TransUnion sells identity products.
TransUnion did not detail the technique. Our reading is that a refusal can leak information. If a system reveals which check failed, such as the document, the device or a limit on attempts, software can log that answer. It can then adjust the next try.
Repeated at machine speed, those refusals can map where the defense is thin. A control that only blocks, without limiting what the block reveals, may be teaching the attacker.
Javvad Malik, a CISO advisor at KnowBe4, told Dark Reading that the basic social engineering tricks are familiar. The change he sees is attackers using AI to hunt for weaknesses. He says they are starting to aim at AI agents directly.
Where the people sit
Dark Reading frames the threat as attackers who skip malware and phone a help desk, with AI assistance. The sources give no data on how common help desk fraud is. Treat the picture as illustration, not measurement.
Our reading is that a convincing voice or document can make a request feel routine. That makes the person answering the phone part of the control.
The coverage cites two further examples. In 2025 the FBI warned of criminals targeting employee self-service portals for payroll and benefits. They used fake search ads that led to sites copying real companies' logos and layouts.
Check Point flagged a phishing campaign posing as Anthropic's Claude assistant. The emails pressed a due payment and asked for 500 euros through an "update payment" link. That is one campaign, not a trend.
What rechecking looks like
This section is our analysis, not TransUnion's. The report says organizations may need to move toward a more continuous approach, without detailing how.
In practice, that could mean recognizing a returning device and watching for odd behavior during a session. Sensitive actions would trigger a step-up check: a one-time code, a document or a call back. Those actions include password resets and changes to payment details.
The cost is friction. Honest customers will meet more prompts, and support teams will field more calls. The trade is to spend that friction only where a mistake is expensive.
Read the evidence with care
The 58% figure measures concern, not losses. TransUnion also points readers to a "connected identity intelligence framework", so it has a product interest. The central point still deserves a test: trust granted once and rarely revisited is a design choice.
Questions to put to your team
Ask where identity is checked again after sign-up. Login, password resets, payment changes and help desk calls are the obvious places. If the answer is "nowhere", that is the gap.
Ask what your refusals reveal. Do error messages say which check failed? Do repeated failed attempts get noticed as a pattern? Ask how help desk staff confirm a caller when a voice or document can be faked.
Ask for a list of the AI tools and agents your company runs, and who checked their configuration. Ask the customer-facing teams what extra friction they would accept for sensitive actions.
Trust is not a door you pass through once. It is a lease, and it has to be renewed.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: TransUnion.
