More than half of identity verification checks across key UK sectors are still being carried out manually, according to new data from SmartSearch, raising fresh concerns as the Financial Ombudsman Service reports a sharp rise in investment and employment scams.
The Financial Ombudsman Service has warned of a surge in online fraud, revealing it handled 31,300 scam-related complaints in 2025, with 20,000 involving authorised payments. Compliance specialists at SmartSearch say the figures highlight a systemic weakness in how businesses verify customers and counterparties at the point of onboarding and beyond.
Collette Smith, chief customer officer at SmartSearch, said that behind each successful scam lies a critical failure in identity verification.
“The criminal opened an account. They passed basic checks. They looked legitimate. And then they used that legitimacy to defraud victims,” she said, “The question isn’t whether these platforms had verification processes. It’s whether those processes could catch what criminals are deploying in 2026: AI-generated identities, deepfake documents, and synthetic profiles that pass traditional checks without triggering any alarms.”
SmartSearch recently surveyed 1,000 senior decision-makers across the finance, property, legal and accounting sectors. The research found that 54% of identity checks are still conducted manually, while only 46% are completed digitally. The findings suggest that many organisations continue to rely on visual document inspections and static database lookups, approaches that may struggle to detect increasingly sophisticated fraud tactics.
“Manual processes can’t scale to catch the volume and sophistication of modern fraud. Visual inspection doesn’t detect pixel-level document forgery,” warns Smith.
“Static database checks don’t identify synthetic identities built from stolen data fragments. And checks performed once at onboarding miss the evolving risk signals that emerge over time.”
The compliance provider argues that the Ombudsman’s advice to consumers to pause, research and verify before transferring funds is necessary but insufficient. Smith said firms must shoulder greater responsibility.
“Businesses have a responsibility, and a regulatory obligation, to ensure that the accounts facilitating these scams don’t exist in the first place.”
She outlined a number of measures firms should adopt to strengthen controls, including automated biometric verification to detect deepfakes and synthetic identities, real-time sanctions and PEP screening against global watchlists updated daily, and multi-source identity triangulation to identify data inconsistencies. SmartSearch also advocates ongoing monitoring throughout the customer lifecycle, rather than relying solely on checks at onboarding, as well as enhanced due diligence for higher-risk profiles, including cryptocurrency-linked accounts.
Smith also referenced the Payment Systems Regulator’s reimbursement rules introduced in October 2024, which place greater liability on financial providers to compensate victims of authorised push payment (APP) scams.
“The PSR’s reimbursement rules introduced in October 2024 place more responsibility on financial providers to protect customers from APP scams. That’s appropriate. But reimbursement is reactive, it happens after the harm is done.
“The real solution is prevention: ensuring that criminals can’t open the accounts, register the platforms, or establish the credibility they need to defraud victims in the first place.
“As Patrick Hurley, Ombudsman Director, said: “If it sounds too good to be true, it probably is a scam.” But businesses shouldn’t rely on consumers being sceptical. They should build systems that make it impossible for “too good to be true” offers to establish legitimacy in the first place. “That’s not checkbox compliance. It’s defence.”
Keep up with all the latest RegTech news here
Copyright © 2026 RegTech Analyst
Copyright © 2018 RegTech Analyst
