It is increasingly difficult for legitimate businesses and sites to know the true identity of users accessing their systems.