Loading story…
Fraudsters are increasingly exploiting outdated and weak state business registration systems in the United States to create synthetic businesses at minimal cost, often less than $150 per entity. These synthetic entities, fabricated using AI-generated documents and stolen data, can yield fraudulent payouts exceeding $100,000 per identity. The lack of robust identity verification and address validation in many state systems allows criminals to register fake businesses with ease, turning what was once a niche threat into a significant and mainstream risk for the financial sector.
Andrew La Marca, vice president of operations at Dun & Bradstreet, highlights that artificial intelligence tools are now being used to automate the creation of convincing bank statements and invoices, further accelerating the formation of synthetic entities. Private equity firms and lenders are advised to be vigilant for red flags during due diligence, as online registries and insufficient controls continue to facilitate this growing fraud vector. The rapid evolution of synthetic entity fraud underscores the urgent need for improved regulatory oversight and modernization of business registration processes to mitigate systemic risk.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Experts including Andrew La Marca of Dun & Bradstreet warned that lenders and private equity firms face growing risk from synthetic businesses during due diligence. Fraudsters were described as using fabricated bank statements, invoices and other records to make fake entities appear legitimate and obtain financing or other benefits.
By December 2025, security and fraud experts reported that synthetic entity fraud had rapidly escalated in the United States. They said criminals were exploiting weak state business registration controls and AI-generated or stolen documents to create convincing fake companies cheaply and at scale.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Artificial intelligence-powered scams, particularly those leveraging deepfakes and synthetic identities, escalated significantly in 2025. Experts warn that the quality and volume of deepfakes have reached a level where they are nearly indistinguishable from authentic media for most people, enabling fraudsters to deceive victims on a global scale. Voice cloning and visual deepfakes have been used to facilitate large-scale scams, while the emergence of synthetic entities has further blurred the line between real and fake identities, complicating fraud detection for financial institutions. The misuse of stablecoins and lax cryptocurrency oversight have created new avenues for cross-border fraud, with experts predicting these trends will intensify in 2026. Industry leaders emphasize the urgent need for improved data, reporting, and regulatory measures to counteract these evolving threats. The rapid proliferation of generative AI tools has enabled "pig butchering" scams and other fraud operations to target vast populations, underscoring the growing risk posed by synthetic media and AI-driven deception in the financial sector and beyond.
Jun 29, 2026
Security leaders and new research warn that **generative AI** is accelerating a shift toward **identity-based compromise**—notably phishing, social engineering, and impersonation—because traditional controls have reduced the effectiveness of brute-force and other “old-style” attacks. Thales’ Americas CISO Eric Liebowitz argues organizations should respond with stronger identity-focused defenses, including sustained employee training that goes beyond “red flag” spotting, **user behavior baselining** to detect anomalies, and technical controls such as internal AI-assisted defenses and **DLP** to counter increasingly capable *agentic* adversaries. Separate reporting highlights how the same trend is being monetized at scale: AMLTRIX research found an industrialized dark web market for **stolen and fabricated identities**, with “full identity packages” (ID scans plus matching selfies) priced as low as **$30**, enabling repeated account creation for laundering before detection; **pre-verified accounts** command a premium (e.g., verified crypto accounts at **$200–$400**), reflecting the difficulty of defeating live verification. Nametag’s 2026 workforce impersonation findings similarly warn that **deepfake-as-a-service** and readily available AI tooling are making high-value corporate fraud (e.g., spear-phishing and CEO fraud) more accessible, and that **consumer-grade identity verification** will be insufficient against injected deepfakes—driving a need for more continuous, hardware-backed verification and controls that account for emerging risks such as **prompt-injection-based poisoning of AI agent memory**.
Jun 29, 2026
Security researchers have observed a significant evolution in digital identity fraud, with threat actors increasingly leveraging automation, AI, and coordinated infrastructures to perpetrate large-scale attacks. Fraudulent activities now include the use of synthetic personas, credential replay, and high-speed onboarding attempts, all orchestrated through systems that learn and adapt over time. Deepfake experimentation and document spoofing have become part of connected ecosystems, where machine-driven agents iterate on attack methods using feedback from failed attempts. This shift means that fraud is less reliant on skilled human operators and more on scalable, automated workflows, making detection and prevention more challenging for security teams. In parallel, the 2025 holiday shopping season has seen a surge in industrialized online retail fraud, with threat actors registering hundreds of fake domains to impersonate major brands and deceive consumers. These campaigns utilize automated tools to mass-produce convincing counterfeit websites, often promoted via social media, to harvest sensitive financial data and distribute malware. The infrastructure supporting these attacks is highly organized, allowing rapid deployment and evasion as domains are taken down. The convergence of these trends highlights the growing sophistication and scale of automated fraud, posing significant risks to both organizations and individuals.
Jun 30, 2026