4. Malicious Actors & Misuse2 - Post-deployment

Impersonation / identity theft

Theft of an individual, group or organisation’s identity by a third-party in order to defraud, mock or otherwise harm them or another party

Source: MIT AI Risk Repositorymit1337

ENTITY

1 - Human

INTENT

1 - Intentional

TIMING

2 - Post-deployment

Risk ID

mit1337

Domain lineage

4. Malicious Actors & Misuse

223 mapped risks

4.3 > Fraud, scams, and targeted manipulation

Mitigation strategy

1. Implement Mandatory Multi-Factor Authentication (MFA) and Strong Credential Policies: Mandate the use of strong, unique passwords or passphrases in conjunction with Multi-Factor Authentication (MFA) across all digital accounts to establish a foundational, layered defense against unauthorized access stemming from credential harvesting and account takeover fraud. 2. Establish Comprehensive Cybersecurity Training and Verification Protocols: Institute mandatory, recurring training programs for all personnel to enhance recognition of advanced social engineering tactics, including phishing, deepfakes, and urgent fraudulent requests, coupled with strict procedural requirements to verify the authenticity of critical financial or account modification requests through independent, out-of-band communication channels. 3. Deploy AI-Enhanced Identity Verification and Behavioral Analytics: Integrate advanced AI and Machine Learning systems, specifically those utilizing Presentation Attack Detection (PAD), liveness checks, and behavioral biometrics, across all identity-critical checkpoints (e.g., onboarding, high-value transactions) to proactively detect and prevent synthetic identity fraud, deepfake impersonation, and anomalous user activity patterns.