A customer signs up on a Tuesday evening, uses the 20% welcome code and orders two items. The first card is declined and the second goes through. A month later the bank reverses the payment and adds a chargeback fee. By then the parcel is long gone, and the name on the account belongs to someone who has never heard of the shop.
Plenty of small business owners treat this as part of the cost of selling online. Most of it can be stopped. The place to do that is sign-up, when the account is first opened with an identity that is stolen, invented or already in use.
What a fake sign-up looks like
Most small shops run into more than one kind.
The most familiar is the stolen identity. Someone uses a real person’s name, address and card details, usually bought after a data breach or taken in a phishing scam. The shop sees an ordinary customer. The real person sees a charge they never made, disputes it, and the shop pays.
A synthetic identity is harder to catch. It blends real and invented details, for example a genuine ID number with a made-up name and date of birth. The Federal Reserve defines synthetic identity fraud as using a combination of personal information to fabricate a person or entity for personal or financial gain. Nobody real is missing money, so nobody complains, and the account can sit quietly for months before it is used.
Then there are repeat accounts: one person opening ten accounts to claim a first-order discount ten times, farm a referral scheme or come back after a ban. Each one arrives looking like a new customer.
The newest kind uses AI to fake the face or the document. In November 2024 FinCEN, the US Treasury’s financial crimes unit, warned banks about a rise in suspicious activity reports that described deepfakes. Criminals had used generative AI to produce fake documents, photos and videos to get past identity checks.
Why small online businesses get hit
Fraud goes where the checks are thinnest. A bank has a fraud team and years of customer history to compare against. A small online shop usually has an email confirmation and whatever its payment provider screens for.
Fake accounts are also the part of identity fraud that is growing. Javelin Strategy & Research’s 2026 Identity Fraud Study found that identity fraud losses in the US held steady at $27.3 billion in 2025. The number of new-account fraud victims, though, rose 31%, from 4.2 million in 2024 to 5.4 million.
The people behind it are often organised. Shufti’s Identity Fraud Report 2026 looked at its verification data from January to June 2026. Reused fraudulent documents made up 65.68% of the links it found between separate fraud attempts. The largest connected group used 70 identities across 13 devices, and one device was tied to 16 verification events.
In practice, a handful of people can turn up at a small shop as dozens of customers. If nothing connects them, every one of them looks new.
What fake sign-ups cost
The refunded order is usually the smallest part of what a fake sign-up costs.
A chargeback on a stolen card takes back the sale and usually adds a dispute fee, while the goods are already gone. Repeat accounts eat into offers that were priced for genuine first-time buyers. They also make sign-up figures look healthier than they are, so marketing money keeps going to the channels that bring in fraud. Then there is the time spent on disputes and refunds, which a three-person team rarely has spare.
Card networks have also grown less tolerant. On 1 April 2026 Visa lowered the fraud and dispute ratio at which it treats a merchant as excessive from 2.2% to 1.5%, according to the Merchant Risk Council. Merchants enrolled in the programme pay $8 for each fraudulent or disputed transaction. Payment providers are held to tighter limits across all their merchants, so they tend to act early on a small shop whose disputes are climbing.
Fraud totals across the US are still climbing. The US Federal Trade Commission says consumers reported $15.9 billion in fraud losses in 2025, up from over $12 billion in 2024. Deloitte’s Center for Financial Services estimates that generative AI could push US fraud losses to $40 billion by 2027, up from $12.3 billion in 2023.
Deepfakes are a fast-growing share of this. Shufti’s Deepfake Identity Fraud Index Report 2026 projects a 495% rise in deepfake identity fraud in 2026. In the first half of the year, deepfake documents made up 80.10% of the AI-enabled fraud in Shufti’s verification data.
How identity verification stops fake sign-ups
Identity verification checks the person before they can place an order or get paid out. For the customer, it usually means photographing an ID and taking a selfie. Behind those two steps, several checks run at once.
The ID is examined for signs that it has been edited, printed, photographed off a screen or generated. The selfie is compared with the photo on the ID, and a liveness check confirms that a real person is in front of the camera. That liveness step is what catches a printed photo, a mask or a deepfake video fed straight into the camera stream. Where records are available, the name and date of birth are checked against trusted data sources. The face, document and device are also compared with earlier sign-ups, which is how one person running ten accounts gets caught.
Shufti’s identity verification software runs all of this in one short flow, so a genuine customer gets through quickly and a fake one stops at the first screen.
Warning signs worth knowing
FinCEN’s alert also listed red flags for deepfake fraud. It was written for banks, but several apply to any business that signs up customers online:
- The ID photo shows signs of editing, or does not fit the customer’s other details.
- Two documents from the same customer do not match each other.
- A reverse image search finds the ID photo in an online gallery of AI-generated faces.
- The customer uses a third-party webcam plugin during a live check, or asks to switch to another channel because of repeated technical problems.
- The device or location data does not match the country on the ID.
- A brand-new account suddenly makes rapid transactions or runs up chargebacks.
What to look for in an identity verification tool
Most providers demo well. These questions help separate the tools that suit a small business from the ones built for large banks.
Where to start
You do not need to verify every visitor from day one. Start with the points where money leaves the business.
Pull the last three months of chargebacks, refunds and blocked accounts, and look for what they have in common. It might be one discount code, one product, one payment method or a cluster of sign-ups from the same few devices. Add verification at those points first, such as a first payout, a first high-value order, a referral reward or the move from free trial to paid.
Track chargebacks and sign-up completion for a month before and after. Where the checks pay for themselves, widen them.
Fake sign-ups are a cost most small businesses can bring down. Checking who a customer is at the door is cheaper than chasing a chargeback a month later.
Sources (for the editor)
Every figure was checked against the page below. The FTC, FinCEN and Javelin pages are linked in the article. The others are cited by name only, and the Shufti identity verification page is the only Shufti link. All URLs below are the final addresses, with no redirects.
|
Source |
Published |
Figures used |
|
25 Mar 2026 |
$15.9 billion reported fraud losses in 2025; over $12 billion in 2024 |
|
|
21 Apr 2026 |
$27.3 billion identity fraud losses in 2025; new-account fraud victims up 31%, 4.2 million to 5.4 million |
|
|
29 May 2024 |
$40 billion US fraud losses by 2027 from $12.3 billion in 2023 |
|
|
13 Nov 2024 |
Deepfake documents, photos and videos used to get past identity checks; red flag list |
|
|
Federal Reserve: Synthetic Identity Fraud, Defined It to Fight It |
6 Apr 2021 |
Definition of synthetic identity fraud |
|
2026 |
Visa merchant threshold cut from 2.2% to 1.5% on 1 Apr 2026; $8 fee per fraudulent or disputed transaction |
|
|
2 Sep 2026 |
65.68% of links were reused documents; 70 identities on 13 devices; 16 events on one device; deepfake documents 80.10% of AI-enabled fraud |
|
|
2026 |
495% projected rise in deepfake identity fraud in 2026 |
