Identity churn is the repeated creation, use, and disposal of identities to avoid detection. In cyber security, an identity can be an account, email address, phone number, device fingerprint, payment profile, or any other record used to recognize a person or system. Attackers churn identities to stay ahead of bans, fraud controls, reputation systems, and investigation.
It matters because many defenses assume one identity represents one actor. When an attacker can quickly replace blocked accounts with new ones, scams, spam, credential attacks, and payment fraud become harder to stop. Defenders look for patterns that survive identity changes, such as shared devices, IP ranges, transaction timing, behavioral similarity, or repeated enrollment attempts. Common countermeasures include stronger verification, velocity limits, anomaly detection, graph analysis, and workflows that freeze suspicious activity before a new identity can be used again.