Synthetic-Identity Onboarding Fraud via AI-Generated Documents
Detects the creation or invitation of new users in Azure AD where integrated identity-verification platforms have flagged document authenticity, liveness, or face matching as anomalies. These flags are cross-referenced with suspicious account attributes such as geolocation mismatches, the use of VOIP phone numbers, or the usage of newly registered email domains, suggesting a potential fraudulent account creation attempt.
Microsoft Sentinel (KQL)
