AI-Powered Sign-up Fraud Is Scaling Fast

Summary

Shiv Ramji (President, Auth0 at Okta) warns that attackers are shifting from traditional login attacks to automating fraudulent account registrations using generative AI. Sign-up funnels have become the path of least resistance: AI scales fake registrations rapidly, exploits promotional offers and overwhelms verification steps. Observations include nearly half of registration attempts on one platform flagged as attacks in 2024, and some retail campaigns seeing fraudulent sign-ups outnumber genuine ones by 120:1.

The piece also covers two related risks: AI-assisted phishing (easy-to-create, convincing impersonation sites using GenAI tooling) and the growing problem of “identity debt” from agentic AI — static secrets and broadly scoped machine accounts that give persistent access if exposed. The author recommends stronger bot detection, risk-based CAPTCHAs, identity proofing, passkeys for new registrations and secure OAuth/token-vault patterns for AI agents.

Key Points

Attackers now target sign-up pages using AI to create large volumes of fraudulent accounts quickly.
In 2024, 46% of registration attempts on one platform were flagged as sign-up attacks; some retail campaigns saw fraud outnumber legit sign-ups by 120:1.
GenAI tools make building convincing phishing sites trivial, lowering the attacker skill barrier and increasing impersonation risk.
Agentic AI increases “identity debt”: static API keys and broad machine accounts are frequently exposed, creating persistent access risks.
Recommended defences include risk-based bot detection, smart CAPTCHAs, identity proofing, moving to passkeys for new registrations, and using OAuth plus secure token vaults for AI agents.

Context and Relevance

This commentary arrives as organisations accelerate AI adoption across customer-facing and internal systems. For retail and e-commerce teams, the immediate business impact is clear: promotional campaigns and onboarding flows are lucrative targets that can be drained by automated fraud, creating direct financial loss and inflated user metrics. For security and engineering teams, the article highlights two accelerating trends — automated impersonation at scale and the brittle nature of machine-to-machine credentials — that intersect with existing identity, access and fraud controls.

Adopting passkeys and stronger, centralised machine-auth patterns (OAuth + token vaults) reduces attack surface. Risk-based protection at sign-up helps preserve legitimate customer acquisition while deterring AI-driven abuse. The piece is a timely reminder to treat customer acquisition as a security boundary, not just a marketing funnel.

Why should I read this?

Short answer: because your next freebie or onboarding funnel could be handing cash and accounts to bots — and AI makes it cheap and fast. This article cuts straight to what’s changing (attackers pivoting to sign-up), why it matters now (scale, cost and identity debt), and what to do about it without burying you in technobabble. Quick, practical and right on the money if you care about fraud, customer metrics or identity security.

Source

Source: https://www.darkreading.com/vulnerabilities-threats/ai-powered-sign-up-fraud-scaling-fast