Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Product, fraud, and trust and safety teams at online merchants and marketplaces have been fighting bots for a long time. While there were occasional disagreements about how “bad” bots were (a purchase is a purchase, some might say), the general consensus often ranged from suspicious to block them all. But not anymore. As AI-powered browsers and agents become more commonplace, online merchants have to prepare for a world where agentic commerce is a standard sales channel.

Globally, companies lost an average of 7.7% of their annual revenue to fraud, according to TransUnion’s 2025 Digital Identity Risk Accelerates Fraud Losses report. In the US, companies reported revenue losses of 9.8%, a 46% increase from the previous year. That’s hundreds of billions of dollars heading into the hands of fraudsters. And those stats don’t account for the loss of trust, hit to brand reputation, and time and resources spent on mitigating and resolving the fraud.

An identity mule is someone who is compensated for sharing their identity. They may be asked for pictures of their identification documents and video selfies. Or, instructed to create an account and complete an identity verification flow before handing over the account’s credentials to a bad actor. The fraud cat-and-mouse game is taking a new turn. As organizations get better at detecting deepfakes, some bad actors are using real people’s identities to commit fraud.

All over the world, companies are seeing a rise in fake job applicants. You may have experienced it yourself: dozens of near-identical resumes arriving within hours, or candidates who refuse to turn on their camera during video interviews. Remote hiring, global talent pools, AI-generated resumes, and increasingly sophisticated fraud networks have profoundly changed the hiring landscape. Traditional hiring processes were never built to defend against the types of candidate fraud we’re seeing today.

For fraud fighters, link analysis tools like Persona’s Graph are becoming essential for stopping account sharing, deepfakes, identity mules, and other forms of sophisticated or scaling fraud attacks. Since we launched Graph in early 2023, we’ve spent countless hours gathering feedback from customers, investigating the latest fraud vectors, and testing new technology. Graph is a better product as a result, and we want to share six improvements that are helping fraud fighters today.

As with previous years, we asked identity and fraud experts to reflect on the closing year and share a few predictions for the next. You’ll get unique perspectives from fraud fighters, researchers, and an executive. We asked them about unexpected fraud trends, which tactics will become more valuable, leadership’s changing perceptions, and AI, of course. But we kicked things off with a lighthearted question.

Hiring teams face a new reality: your recruiters are now the first line of defense against workforce security threats. Gartner predicts that by 2028, one in four candidate profiles worldwide will be fake. Multiple forces are already paving the way for this surge in fake candidate identities.

This year's EDUCAUSE brought together leaders from IT, security, enrollment, and student services. The theme, “Restoring Trust,” reflects the challenges that higher education institutions and professionals are facing. Fraudsters are using new tools and techniques to target faculty and students. Whether they’re trying to gain access to sensitive information or steal student aid, the potential danger is real.

Security leaders are rethinking how they establish and maintain identity assurance across the employee life cycle as workforce fraud and AI-driven impersonation accelerate. And as threats increase, confidence is dropping. At a recent CISO event, more than 85% of security leaders told us they’re only somewhat confident or not confident at all in their ability to handle GenAI-enabled fraud.

Age-based regulations are evolving worldwide. While many people are already familiar with self-attestation forms for accessing adult content, the scope and approved methods of age assurance continue to expand due to evolving regulations worldwide. These regulations include the UK's Online Safety Act, which was accompanied by a set of highly effective methods to gauge age, and Australia's Social Media Minimum Age Act that places guardrails around what digital content children have access to.