Why Did So Many Identity Controls Fail in 2025?

A recent data review identified deceased members still recorded as active – including deaths dating back to 2002.

A recent pension data cleanse for a large UK industrial defined benefit scheme identified that approximately 2% of members were deceased, including several individuals whose deaths dated back more than twenty years.

Two members recorded as active in the scheme records were found to have died in 2002.

For large defined benefit schemes, discrepancies of this scale can represent a material number of member records requiring validation before insurer pricing can proceed.

No administrative exception had been raised. The discrepancy only became visible once member records were validated against external sources.

These findings illustrate how member data inaccuracies can remain embedded within scheme records for extended periods without triggering operational alerts.

Insurer due diligence

When schemes approach buy-in or buy-out transactions, insurers undertake detailed due diligence on the member population. Confidence in the integrity of scheme data therefore becomes an important consideration.

Insurers typically review several areas, including:

• mortality status
• member identity validation
• geographic location of members
• completeness of contact records
• accuracy of benefit entitlements

Where information cannot be independently validated, additional verification work may be required before pricing can be confirmed. In some cases this can extend transaction timelines or introduce further assumptions into pricing models.

The Pensions Regulator also emphasises that trustees are responsible for maintaining complete and accurate member data as part of effective scheme governance.

Why data gaps occur

Pension schemes operate over long time horizons. Member records may remain in administrative systems for several decades and often pass through multiple administrators and technology platforms.

Over time, several structural issues can arise. Members may pass away without the scheme being notified, particularly where contact with the scheme has been lost.

In England and Wales alone, over half a million deaths are registered each year, according to the UK Office for National Statistics (ONS). Reconciling long-standing member records against this scale of national mortality data is therefore an important element of maintaining accurate scheme populations.

Increasing international mobility also reduces visibility within domestic datasets. Addresses and contact details may remain unchanged for extended periods, and historical system migrations can introduce inconsistencies across records.

These issues do not necessarily affect day-to-day administration but can become visible when scheme data is examined more closely during transaction preparation.

External validation sources

To address these risks, schemes increasingly supplement internal records with additional verification sources such as:

• Civil registration data, including GRO death records
• Probate filings and estate notices
• Online obituary publications
• Open-web signals, including professional networks and social media activity

Platforms such as Heka help consolidate these signals into structured intelligence. This allows schemes to validate member records, identify mortality indicators, and improve confidence in the accuracy of their member population.

Conclusion

Undetected deaths in scheme records illustrate a broader issue: member data can deteriorate silently over time.

Routine administrative processes may not surface these discrepancies. However, when schemes approach buy-in or buy-out preparation, such gaps can become operationally and financially relevant.

Early validation of member data can therefore reduce uncertainty, support insurer due diligence, and improve readiness for endgame transactions.

The New Retirement Reality

The "traditional" UK retiree is a vanishing demographic. As of 2026, the Office for National Statistics (ONS) and the DWP report that over 1.1 million UK pensioners now reside overseas. This isn't just a trend for high-net-worth individuals; it is a cross-demographic shift driven by global mobility and the search for lower costs of living.

However, the risk to pension schemes doesn't start at the point of retirement. It begins decades earlier.

The Rising Challenge of the Mobile Workforce

While pensioners moving abroad is a well-documented trend, a more systemic risk is quietly accumulating in the "deferred" category: The Young Mobile Workforce.

• The 75% Stat: Recent data reveals that 75% of UK emigrants are now under the age of 35. These are young professionals moving for global career opportunities.
• The "Digital Decay" of Small Pots: These individuals leave behind small, auto-enrolled pension pots. Within a few years of moving, their UK digital footprint (electoral roll, credit headers) begins to decay, making them "untraceable" by standard domestic methods.
• Fragmented Careers: By the time these workers reach retirement, they may have accrued numerous different pots. The administrative cost of managing these "lost" small pots – currently valued at a total of £31.1 billion in the UK – is a significant drain on scheme resources.

Three Growing Risks for Trustees

1. The Fiduciary "Out of Touch" Trap

A trustee’s duty of care does not end when a member moves overseas. Traditional UK-centric tracing is no longer a "reasonable endeavor" when a significant portion of the membership is international. Without global data, trustees cannot fulfill mandated disclosure requirements or support members in making informed retirement choices.

2. The Mortality Blindspot

The most significant financial risk is overpayment. Without robust international mortality screening, schemes can continue paying benefits for years after a member has passed away overseas. Reclaiming these funds from foreign jurisdictions is legally complex and often impossible.

3. Member Welfare & Social Responsibility

Small pots represent a member's future livelihood. When schemes lose touch, they lose the ability to provide value. For the mobile workforce, being "out of touch" means being "under-saved."

Closing the Gap: Next-Generation Data Restoration

To address these complexities, the industry is moving toward AI-enabled web intelligence that looks beyond standard registry searches. Heka’s approach focuses on three core pillars to restore scheme integrity:

1. Global Web Intelligence: By scanning over 3,000 data sources across the open-source web, schemes can locate members deemed "untraceable" by standard legacy providers. This includes identifying active digital footprints such as verified mobiles, professional profiles, and even local news stories to verify identity and marital status.
2. Dynamic Mortality & Life Status: AI can detect "unreported" life events by identifying signals like online obituaries or funeral recordings globally. This allows for real-time mortality updates even in jurisdictions where official death registries are slow or inaccessible.
3. Next-of-Kin & Relationship Mapping: Modern family structures are complex. Data enrichment can now identify spouses, children, and next-of-kin through relational mapping, ensuring that death benefits reach the correct beneficiaries and helping to re-establish contact with the primary member.

Conclusion

As the UK workforce becomes more international, the risk of "lost" members is no longer a fringe issue – it is a core governance challenge. Trustees who bridge the global data gap today will protect their members’ welfare and their scheme’s long-term financial health.

‍

The digital trust ecosystem has reached a breaking point. For the last decade, the industry’s defense strategy was built on a simple premise: detecting anomalies in a sea of legitimate behavior. But as we enter 2026, the mechanics of fraud have fundamentally inverted.

With global scam losses crossing $1 trillion and deepfake attacks surging by 3,000%, the line between the authentic and the synthetic has been erased. We are now witnessing the birth of "autonomous fraud" – a landscape where barriers to entry have vanished, and the guardrails are gone.

At Heka, we believe we have reached a critical pivot point. The industry must move beyond the futile arms race of trying to outpace generative models by simply using AI to detect AI. The new objective for heads of fraud and risk leaders is not just detecting attacks; it is verifying life.

Here is how the landscape is shifting in 2026, and why "context" is the only defense left that scales.

‍

The Industrialization of Deception

The most dangerous shift in 2026 is the democratization of high-end attack vectors. What was once the domain of sophisticated syndicates is now accessible to anyone with an internet connection.

This "Fraud as a Service" economy has lowered barriers to entry so drastically that 34% of consumers now report seeing offers to participate in fraud online – an alarmingly steep 89% year-over-year increase.

But the true threat lies in automation. We are witnessing the rise of the "Industrial Smishing Complex." According to insights from the Secret Service, we are seeing SIM farms capable of sending 30 million messages per minute – enough to text every American in under 12 minutes.

This is not just spam; it is a volume game powered by AI agents that never sleep. In the "Pig Butchering 2.0" model, automated scam centers are replacing human labor with AI systems that handle the "hook and line" conversations entirely autonomously. When a single bad actor can launch millions of attacks from a one-bedroom apartment, volume becomes a weapon that overwhelms traditional defenses.

‍

The Rise of the "Shapeshifter" and "Dust" Attacks

Traditional fraud prevention relies on identifying outliers – high-value transactions or unusual behaviors. In 2026, fraudsters have inverted this logic using two distinct strategies:

1. The Shapeshifting Agent 

Static rules fail against dynamic adversaries. We are now facing "shapeshifting" AI agents that do not follow pre-defined malware scripts. Instead, these agents learn from friction in real-time. If a transaction is declined, the AI adjusts its tactics instantly, using the rejection data to "shapeshift" into a new attack vector. As noted by risk experts, these agents autonomously navigate trial-and-error loops, rendering static rules useless.

2. "Dust" Trails and Horizontal Attacks

While banks watch for the "big heist," fraud rings are executing "horizontal attacks." By skimming small amounts – often around $50 – from thousands of victims simultaneously, attackers create "dust trails" that stay below the investigation thresholds of major institutions.

Data from Sardine.AI indicates that fraud rings are now using fully autonomous systems to execute these attacks across hundreds of merchants simultaneously. Viewed in isolation, a single $50 charge looks like a normal transaction. It is only when viewed through the lens of web intelligence –seeing the shared infrastructure across the wider web – that the attack becomes visible.

‍

The "Back to Branch" Regression

Perhaps the most alarming trend in 2026 is the erosion of confidence in digital channels. Because AI-generated identities and deepfakes have reached such sophistication, 75% of financial institutions admit their verification technology now produces inconsistent results.

This failure has triggered a defensive regression: the return to physical branches. Gartner estimates that 30% of enterprises no longer trust biometrics alone, leading some banks to demand customers appear in person for identity proofing.

While this stops the immediate bleeding, it is a strategic failure. Forcing customers back to the branch introduces massive friction without solving the core problem. As industry experts note, if a teller reviews a driver's license "as if it's 1995" while facing a fraudster with perfect AI-generated documentation, we are merely adding inconvenience, not security.

‍

The Solution: Context is the New Identity

The issue facing our industry is not a failure of digital identity itself; it is a failure of context.

Trust is fragile when it relies on a single signal, like a document scan or a selfie. In an AI-versus-AI world, seeing is no longer believing. However, while AI can fabricate a driver's license or a video feed, it consistently fails to recreate the messy, organic digital footprint of a real human being.

To survive the 2026 threat landscape, organizations must pivot toward:

1. Web Intelligence: Linking signals together to see the wider web of interactions rather than isolated events.

2. Long-Term, Consistent Presence: analyzing the continuity of an identity over time. Real humans have history. Synthetic identities, no matter how polished, lack the depth of a long-term digital existence.

3. Cross-Channel Consistency: Looking for the shared infrastructure and overlapping identities that horizontal attacks inevitably leave behind.

‍

The 2026 Takeaway

The future offers a clear path forward. Fraud prevention is no longer about beating a single control – it is about bridging the gaps between them.

While identity and behavior are easier to fake in isolation, the real advantage lies in the complexity of real-world signals. These are the signals that remain expensive to manufacture at scale. Organizations that embrace this context-driven approach will do more than just stop the $1 trillion wave of autonomous fraud; they will unlock a seamless experience where trust is automatic.

‍

Stay informed. Stay adaptive. Stay ahead.

At Heka Global, our platform delivers real-time, explainable intelligence from thousands of global data sources to help fraud teams spot non-human patterns, identity inconsistencies, and early lifecycle divergence long before losses occur.

‍