A forecast that cannot be wrong is not worth reading. Every judgment below carries a probability term from our fixed scale, and next November we will publish how each one held up.
How to read this outlook
We have written an internal outlook every year since 2019 and scored it twelve months later. Last year, five of our seven judgments held, one did not and one remains too early to call. This is the first edition we have published outside our client base.
The judgments draw on 386 engagements closed so far in 2026 across our eleven disciplines. They describe what we see in our own casework, which is not a random sample of the world. Where a number comes from our work, we say so.
1. A borrowed identity is now cheaper than a forged one
For years, identity fraud meant forged documents, and document checks were a reasonable defense. The frauds we now see in hiring and onboarding use real identities, lent or sold by their owners and operated by someone else. The documents are genuine. The history around them is assembled.
Among remote technical candidates screened through Aldervane Screen, the share with a material identity discrepancy rose from 1.9 percent in 2024 to 4.6 percent in 2026. Across all subjects we screen, the figure is closer to 3 percent. The growth is concentrated in roles that come with privileged system access.
It is very likely that by the end of 2027, organizations that hire remotely into privileged roles will treat identity integrity checks as a standard control, in the way background checks became standard a generation ago. We describe the signals in The candidate who is not there.
2. Infrastructure is rented by the hour, so the money matters more
Our field note on infrastructure pivoting describes a fraud operator exposed by one reused tracking identifier. That kind of mistake is becoming rarer. Scam operators increasingly rent complete kits, with hosting, templates and registration handled by a supplier who serves many customers at once.
The effect shows in our attributions. In 2023, registration and hosting pivots contributed to 61 percent of our fraud attributions. In 2026 the figure is 34 percent. Over the same period, links through payment accounts, cash-out points and operational habits have become the lines of evidence that most often carry a finding to high confidence.
It is likely that shared infrastructure will produce more false attributions across the field in 2027, as investigators mistake a common supplier for a common operator. Infrastructure links should be treated as proof that sites are related, never on their own as proof of who runs them.
3. Extortion no longer needs an intrusion
Of the 58 leak and breach claims we were asked to verify in 2026, 23 turned out to be recycled from earlier incidents or fabricated outright. The criminals behind them had not broken into anything. They had repackaged old data, attached a countdown and relied on the victim's inability to prove a negative in 72 hours.
This works because the cost of making a claim is close to zero and the cost of disproving it is high. It will keep working until victims routinely test claims before responding to them, which is why we published a method for doing so.
It is likely that recycled and fabricated claims will make up a larger share of extortion attempts in 2027 than in 2026. It is very unlikely that genuine intrusions will decline. The two problems will coexist, and telling them apart quickly will be the skill that matters.
4. Rumor now arrives before the event has finished
During fast-moving events this year, 38 percent of the viral claims our regional desks checked were false, old or filmed somewhere else. The proportion has been stable for two years. What has changed is the speed. Misattributed footage now tends to appear within the first hour, while the real event is still unfolding and before reliable reporting exists.
For organizations with people on the ground, the first hour is exactly when decisions to move are made. In one case this year, eleven of fourteen circulating claims were false, and every one of them pointed toward a road that was blocked.
It is almost certain that generated and recycled footage will accompany every major unrest event in 2027. There is a roughly even chance that at least one widely reported corporate evacuation next year will later be shown to have been triggered by false footage.
5. Supply chain accountability keeps moving down the tiers
Importers in several major markets are now answerable for conditions far below the suppliers they contract with, and customs authorities are asking for evidence, not assurances. Since 2022 we have mapped more than 9,400 supplier entities for clients. In most projects, the finding that mattered sat at the third tier or below, beyond the reach of any audit the client had commissioned.
The pattern we see most often is not concealment by the client's direct suppliers. It is concentration: several tier-one suppliers depending, through different trading companies, on the same mill, smelter or processor.
It is very likely that evidence of sub-tier mapping will be requested in more enforcement actions in 2027 than in 2026. Questionnaires will remain necessary and will be less and less sufficient. Our guide to mapping past tier one sets out the method.
6. Machine assistance cuts both ways, and provenance decides
The people we investigate now generate profile photographs, biographies, reviews and whole personas at almost no cost. Investigators use the same class of tools to read more material, in more languages, than any team could manage unaided. Neither side holds a lasting advantage from the tools themselves.
What does hold is provenance. A generated persona has no past. A captured, hashed record has one that can be checked. Tools that claim to detect synthetic media are useful for triage and unreliable as evidence, and we do not treat their output as a finding. Our rules for machine assistance are set out in Machines for volume, people for judgment.
It is likely that at least one attribution published somewhere in the field in 2027 will be withdrawn because it relied on machine output that nobody checked against a source. It is very unlikely that any tool will reliably distinguish generated from authentic images by the end of the year.
What does not change
Every shift above makes one kind of evidence weaker and another more important. None of them changes the standard a finding has to meet. An attribution still needs at least three independent lines of evidence from distinct source types, no unresolved contradiction, a passed red-team review and reproducibility from preserved evidence.
If anything, the shifts reward that discipline. Borrowed identities fail when a history is tested against independent records. Rented infrastructure fails when the money is followed. Recycled leaks fail when samples are dated. False footage fails when it is located. In each case the answer was available to anyone who treated the first impression as a claim to be tested.
The tools on both sides will keep improving. The question a court, a regulator or a board asks will stay the same: how do you know?
What we are doing about it
Three commitments follow from this outlook, and we expect to be held to them.
- Provenance on every image. From January, any image relied on in an attribution will carry a documented provenance check in the evidence annex, alongside its hash.
- Independent review of movement decisions. Any verified event that drives a client decision to move people will be reviewed by a senior analyst from outside the desk before it is sent, as attributions already are.
- A public score. In November 2027 we will publish each judgment in this outlook beside what actually happened, including the ones we got wrong.