07/31/2025

Who’s Really Behind the Mask? Combatting Identity Fraud

Security Week

In our hyper-connected world, identity isn’t just personal, it’s vulnerable. Behind each login, each email, and each access request, there could be a legitimate user. Or a skilled impersonator. Unlike the physical world, where identity is anchored in faces and fingerprints, the digital world depends on credentials: fragile, fallible, and frequently stolen.

In the virtual world, identity is everything, and yet, it’s increasingly difficult to verify. Cybercrooks take refuge behind stolen identities, masquerading as legitimate users in order to compromise systems and commit fraud. But how can we distinguish between a traveling employee and a threat actor? Between a late-night login and a breach in progress? The answer lies in context. Without the right context and a sound behavioral baseline, security teams can’t tell legitimate users from highly sophisticated impostors. Getting an accurate sense of what “normal” is for each person is the first step in slicing through that web of confusion.

The Tactics Behind Identity Fraud

Cybercriminals have many tools in their arsenal to impersonate users and gain system access. Every attack takes advantage of a unique vulnerability. One increasingly common tactic involves initial access brokers (IABs), threat actors who specialize in breaching networks and then selling access credentials to other cybercriminals on dark web forums. In account takeover (ATO), attackers assume control of a valid account using compromised credentials or brute force methods, often purchased from IABs, and utilize it for lateral movement or data exfiltration. Identity theft is another strategy, where the data of individuals is harvested, typically from a data breach or social engineering, and used to open new accounts, apply for loans, or make illicit purchases. Credential stuffing is a method where malicious automated bots try stolen username-password combinations, frequently traded by IABs, on various platforms, takin