34% of organisations have failed a compliance audit due to identity-related issues.

38% of organisations suffered a phishing attack that led to unauthorised access.

36% of organisations experienced a data breach involving identity credentials.

Just 27% of organisations enforce a least privilege access model.

Organisations self-identifying as "Established" in their identity posture follow 5.1 best practices.

Stolen identity "fullz" (comprehensive personal information) can be bought for as little as $3 on the dark web.

In 2025, 74% of global consumers said they would willingly spend more time on identity verification when accessing travel and hospitality-related platforms if it improved their security. This is up from 71% in 2024.

69% of respondents globally believe AI-powered fraud now poses a greater threat to personal security than traditional forms of identity theft.

Global willingness to spend time verifying identity on sharing economy platforms was 70% in 2025, which is only slightly down from 71% in 2024.

50% of consumers globally don't feel adequately protected in the sharing economy (including vacation rentals and other travel-focused gig economy services).

80% of consumers globally were willing to spend more time on security for digital platforms supporting banking and financial services

55% of consumers in the UK don't feel adequately protected in the sharing economy (including vacation rentals and other travel-focused gig economy services).

44% of global consumers lack confidence in the travel industry's ability to protect them from AI-powered fraud, including identity theft and account takeover fraud.

Of attempted misuse attempts that involved financial accounts, 14% involved checking accounts.

New types of scams reported included toll road scams, which accounted for 3% of all reported scams.

For attempted misuse, thieves tried to open a new account (69%) more often than attempting to take over an existing account (31%).

Google Voice scams decreased by 84 percentage points and made up 9% of all scam reports.

There was a 754-percentage-point increase in reports of account takeover involving tech accounts.

The top methods of identity compromise reported were due to PII being shared in a scam, stolen documents with personal information, and unauthorized access to a computer or mobile device.

Individuals who reported stolen documents with personal information primarily reported stolen driver’s licenses, Social Security cards, payment cards, birth certificates, and phones or tablets.