What is identity fraud/theft? 

Identity fraud, also known as identity theft, is the criminal act of stealing or misusing another person’s personal or biometric information, such as their name, ID number, or facial image, to impersonate them or gain unauthorized access to services. It is a serious form of fraud that affects both individuals and organizations and is closely monitored under EU regulations like eIDAS, GDPR, and AML5. Preventing identity fraud is a core requirement for secure digital transactions and trust service compliance. 

How does identity fraud happen? 

Identity fraud typically occurs when someone unlawfully acquires another person’s personal information, often through phishing, data breaches, social engineering, or document theft, and uses it to commit fraud. This can involve opening bank accounts, accessing confidential data, applying for credit, or authorizing digital transactions in someone else’s name. As more services move online, especially in sectors like finance, insurance, and public administration, the risk of identity theft increases. 

To mitigate this risk, organizations use strong identity verification methods, including biometric identification, liveness checks, and qualified trust services. In the EU, the eIDAS Regulation mandates the use of trusted identity verification and electronic signatures, while GDPR requires secure processing and storage of personal data. AML5 further reinforces the need to verify customer identities during onboarding to combat financial crime. Companies that adopt secure, compliant onboarding tools not only prevent identity fraud but also foster customer trust and ensure legal reliability.   

^{Key characteristics} 

• Involves unauthorized use of personal or biometric data 
• Can result in financial loss, reputational damage, or legal consequences 
• Often includes forgery, impersonation, or document tampering 
• Enabled by data breaches, phishing attacks, or social engineering 
• Countered by robust ID verification, biometric checks, and liveness detection 
• Highly relevant in sectors regulated by eIDAS and AML5 
• Impacts both individuals and businesses, especially during remote onboarding  

^Examples  

• A criminal opens a bank account using a stolen ID and facial image to commit financial fraud 
• An attacker uses identity fraud to apply for a loan in someone else’s name through an unsecured online lender 
• A fraudster accesses a government benefits portal using leaked personal data and forged credentials 
• A company detects multiple failed identity verification attempts flagged as synthetic identity theft during onboarding       

^{Related terms} 

• Electronic identification 
• Biometric identification 
• Liveness check 
• AML and KYC checks 
• Qualified electronic signature (QES) 
• Digital identity   

^References 

European Commission – Data Protection under GDPR 

EUR-Lex – Directive (EU) 2018/843 (AMLD5)