Fraud Rings Run on Reused Documents, New Industry Data Shows

The ring economy in four numbers

Beyond document reuse, the report maps the infrastructure that binds rings together. Shared IP addresses connected 17.67 percent of linked fraud, and shared devices another 16.64 percent. Cross-border operations made up 2.01 percent of network fraud, and they move fast: the average gap between the same identity assets appearing in different countries was 9 minutes and 33 seconds, with the fastest observed interval at 38 seconds. No passport moves that quickly. Credentials traded across a ring do.

On the AI side, deepfake documents dominated, accounting for 80.10 percent of AI-enabled attacks, ahead of synthetic identities at 12.31 percent, injected videos at 4.01 percent, and face swaps at 3.58 percent. The generative wave has concentrated on the artifact businesses check least rigorously: the document image itself.

Why single-session checks keep losing

A reused forged document is, by definition, a document that has already passed somewhere. Each business that verified it in isolation added a false clean record to the asset's history. The ring's economics depend on exactly this: manufacturing one convincing kit is expensive, but replaying it across dozens of targets is nearly free, and every target that judges sessions independently resets the attacker's odds.

The countermeasure is correlation. Document fingerprinting spots the same forged asset across attempts, device intelligence links the personas sharing hardware, and velocity analysis flags the 38-second country hop no human can perform. deepidv's provenance layer runs those checks against a continuously growing forensic index, so the 70th identity from a 13-device ring is met with the accumulated evidence of the previous 69. Luna then turns the cluster into a single case narrative instead of 70 unrelated files.

The sector spread tells its own story

The report's industry fraud rates rank digital assets first at 22.49 percent, then fintech at 18.36 percent, forex at 17.18 percent, lending and investment at 17.08 percent, and iGaming at 12.45 percent, with traditional banking lowest at 4.24 percent. The gradient is not random: it tracks how quickly value can be extracted and how young each sector's verification stack is. Rings are rational actors moving toward the softest well-funded targets.

The banking number carries the lesson. Decades of layered controls, shared intelligence, and regulatory pressure pushed banking's rate to a fifth of the digital asset sector's. Every younger vertical is now speedrunning the same curve, and the ones adopting fleet-level detection first will compress it fastest.