Identity Fraud and Synthetic Identities: Cifas 2026 Data and Onboarding Controls

Identity fraud is now the single biggest category of fraud recorded in the UK, and it sits right on the front line of customer onboarding. Cifas, the UK fraud prevention service, publishes the most widely used figures, and its 2026 releases show both high volumes and a shift toward more sophisticated methods, including synthetic identities, AI-enabled impersonation and digitally manipulated documents. This guide summarises what Cifas has reported, using press coverage of its Fraudscape publications, and sets out practical onboarding controls for accountancy and finance firms. Always check the Cifas reports themselves for the exact figures and definitions.

What the Cifas data shows

The full year 2025

The Organised Crime and Corruption Reporting Project (OCCRP), reporting on Cifas's annual Fraudscape publication on 12 March 2026, says Cifas recorded a record 444,000 fraud cases in the UK in 2025, more than 1,200 a day. Identity fraud accounted for 54 percent of all filings, and misuse of facility was the second-largest category at 24 percent. Cifas described fraud as an industrialised, cross-border threat and said it expects AI-powered impersonation, synthetic media and fraud-as-a-service tools to keep identity fraud and account takeover as major threats.

January to June 2026

Get Safe Online reports that Cifas's Fraudscape 2026 six-month update, published on 5 August 2026 and based on the National Fraud Database, found more than 220,000 fraud-risk cases, the highest January to June total on record. Identity fraud made up 59% of those cases, nearly 130,000, a rise of 9% on the previous year. Other figures from the same report included:

• bank accounts and plastic cards were the primary targets, making up 68% of identity fraud cases;
• facility takeover reports rose 5% to nearly 40,000, with online retail takeovers up 84% and plastic card takeovers up 59%;
• money muling cases rose 69% to more than 13,000, making up 30% of misuse-of-facility cases;
• unauthorised SIM swap cases rose 402%, which Cifas links to the interception of security codes; and
• cases among 21 to 30 year olds rose 32%, although most identity fraud victims are aged 61 and over.

Cifas reports growing concern about synthetic identities, AI-enabled impersonation and digitally manipulated documents, but the coverage we reviewed does not give separate counts for these types.

What is a synthetic identity?

A synthetic identity is a fabricated identity built by combining real and invented details, for example a real identifier paired with a made-up name or date of birth. Because it does not belong to a single real person, there may be no victim to notice and complain. Treat this as a general description and check the Cifas definition if you need a formal one. The point for onboarding is that a document check or a database match alone may not tell you that the person is not who they claim to be.

Why it matters beyond banks

Accountants and other professionals meet the same techniques in client onboarding. A fabricated or stolen identity can be used to set up companies, open accounts or move money through client accounts. Money muling, which Cifas links to misuse of facility, is also a laundering route. Our guide to money mules and account misuse explains the pattern.

Practical onboarding controls

The following are suggestions that build on standard customer due diligence. They are not requirements taken from the Cifas reports.

1. Verify more than one thing. Combine document checks with biometric or live checks and independent data sources, so that no single check carries the whole decision. Our guide to digital identity verification under the Money Laundering Regulations explains the options.
2. Look for thin files. A person with little history, a recently created email address or phone number, or details that do not fit together deserves a closer look.
3. Check consistency across channels. Compare the details given at onboarding with later instructions. Changes to bank details, email addresses or phone numbers shortly after onboarding are a common warning sign.
4. Be careful with security codes. The sharp rise in SIM swap cases reported by Cifas is a reminder that a text message code is not a strong check on its own.
5. Treat manipulated documents as normal risk. Train staff to examine documents for inconsistencies and to escalate doubts instead of accepting them.
6. Monitor after onboarding. Fraud often shows up in behaviour rather than at the front door. See our guide to KYC and customer due diligence for accountancy practices.
7. Record your reasoning. If you accept an identity despite a concern, note why.

Frequently asked questions

What share of UK fraud-risk cases was identity fraud in early 2026?

59 percent, according to Get Safe Online's report of the Cifas six-month update.

How many fraud cases did Cifas record in 2025?

A record 444,000, according to OCCRP's report of the Cifas annual publication.

Are synthetic identities counted separately?

The coverage we reviewed describes growing concern but gives no separate counts.

Is this a legal requirement?

The controls above are good-practice suggestions. Your legal obligations come from the Money Laundering Regulations and your supervisor's guidance.

Next steps

Review how your firm verifies identity today, and whether any single check could be fooled on its own. To strengthen your team's financial crime skills, explore Learnsignal's CPD courses.