A method provides a security action based on identity profile scores. One or more processors represent an identity profile as a knowledge graph. The processor(s) associate a set of changes of the identity profile across a plurality of identity networks with a fraud score. The processor(s) then implement a security action based on the fraud score.