Identity is critical in today’s modern enterprise — knowing who your customers, employees and partners are (and who’s pretending to be them) can help thwart increasingly cunning cybercriminals.

But it’s an ever more challenging proposition these days: Fraud is at an all-time high, with roughly 14% of all new digital accounts suspected to be fake in 2023. This, according to TransUnion’s 2024 State of Omnichannel Fraud Report, is closely related to the rising occurrence of data breaches, which increased by 157% between 2020 and 2023.

“Data breaches are a leading indicator of future fraud as cybercriminals steal credentials in unprecedented numbers,” TransUnion researchers wrote. “Now more than ever, knowing the identity of the person you’re dealing with is central to every organization’s fraud prevention strategies.”

Account takeover, creation on the rise Per the report, data breaches rose 15% year over year in 2023 to “a level never seen before.” Also, the average breach risk severity — or the ability for an incident to enable identity fraud — increased 11% YoY, the highest ever measured, according to the consumer credit reporting agency.

As they amp up their attacks, fraudsters are using both fabricated and stolen identities, and their top methods of choice include account takeover (ATO), account login and fake account creation. In fact, nearly one in seven newly created digital accounts are suspected to be fraudulent, TransUnion found.

“This early-phase new account fraud may represent a paradigm shift of sorts among fraudsters,” said Steve Yin, SVP and global head of fraud solutions at TransUnion. “In lieu of using traditional tactics to gain access to and ultimately compromise existing accounts, they are increasingly choosing to create new accounts that they can control themselves.”

Not surprisingly, threat actors crave access to personally identifiable information (PII). They are seeking out dates of birth, full Social Security numbers and home addresses, as well as email addresses and phone numbers to potentially take over existing accounts or create new ones.

“They’re using all means possible, targeting organizations and consumers alike, to harvest identity credentials to fuel fraud schemes,” the report said.

More than half (54%) of consumers in 18 geographic regions said they were targeted with online, email, phone call or text messaging attempts — and that was just between September and December 2023. These came in the way of phishing via emails, fake websites, social posts and QR codes, as well as smishing (phony text messages) and vishing (fraudulent phone calls).

As a result, consumers are increasingly demanding that companies step up protection. Half of consumers ranked personal data security as a top reason to do business with an online company. And, an overwhelming majority (93%) said confidence that their personal data wouldn’t be compromised was most important to them when transacting with an online company.

“Consumers have high expectations for organizations to protect their identities while delivering convenient experiences,” the report emphasized. “Organizations need to ensure omnichannel experiences are perceived as safe and secure or risk losing customers.”

Increased attacks on third parties, call centers In 2023, third-party service providers were the largest data breach vector. Fraudsters also increased their attacks on call centers to gain access to credentials as TransUnion documented a 55% increase in high-risk calls to U.S. call centers from 2022 to 2023. The riskiest of these was nonfixed IP, or a number not associated with a physical device.

At the same time, threat actors are facilitating  account takeovers (ATO) using outbound call spoofing to scam consumers into giving up their credentials.

“Call centers play an important role in an omnichannel customer experience — representing a high-trust touchpoint for consumers who are being exploited in multiple ways,” according to the report.

Persistent account hacking persists Researchers concluded that organizations will continue to deal with “persistent account hacking” and ever more sophisticated techniques as threat actors are increasingly enabled by technology allowing them to move with “unprecedented reach and speed.”

“Fraud leaders should take an enterprise-wide approach to fraud prevention and building customer trust,” researchers wrote. “Employ a strategy of continuous innovation through better data, analytics and technology to detect possible fraud more accurately while reducing friction for good customers.”