Deepfake Identity Fraud: Why Liveness Detection Matters in Digital Verification

A selfie used to be solid evidence that a real person was applying for an account. Now that assumption is weakening. Since 2023, the US Treasury’s FinCEN has seen rising suspicious activity reports describing deepfake media used to get past identity checks. Deepfake identity fraud therefore bears on the face match many fintechs rely on.

What Makes Deepfake Identity Fraud Hard to Spot

Criminals use generative AI to produce falsified documents, photographs, and videos, which FinCEN says lowers the cost of defeating verification controls. FinCEN also says accounts opened with suspected AI-generated identities are used to receive and launder proceeds of other fraud.

A deepfake only needs to fool the software, not a human reviewer. Identity verification that compares a face with an ID photo and stops there can be beaten by a synthetic face, because a match shows two images that resemble each other, not that the applicant was at the camera.

Why Liveness Detection Is Only Half the Answer

Liveness detection asks whether a live person is in front of the camera, which defends against presentation attacks such as a held-up photo, screen or mask.

Injection attacks bypass the lens. Synthetic or pre-recorded video is fed directly into verification, so a check that inspects only what arrives cannot tell whether it ever came from a real camera. Gartner reported such attacks rose 200% in 2023, and in February 2024 forecast that by 2026, 30% of enterprises would no longer treat face biometrics as reliable in isolation. That was a prediction, not a measurement, but the weakness holds: a liveness check that trusts any incoming video can be handed a fake.

Standards help buyers press on this. ISO/IEC 30107 covers testing of presentation attack detection, while CEN/TS 18099 addresses injection attack detection and leaves presentation attacks to ISO/IEC 30107.

How Deepfake Detection Fits Into the Workflow

Deepfake detection works in layers because no single signal is conclusive. FinCEN’s red flags include a third-party webcam plugin during a live check, a photo matching a gallery of AI-generated faces, and device or location data that contradicts the ID document. Each tests a different assumption: the camera, the face and the session’s origin.

Take an applicant whose selfie passes but whose session ran through a virtual camera on a device in a country unrelated to their ID. Neither fact may alarm alone; together they warrant manual review.

When assessing a provider, ask whether it tests for injection as well as presentation attacks, and whether it pairs face checks with device signals (identity, location) and behavioural signals (how the applicant moves through the session) with thresholds your team can set.

About VerifiEdge

VerifiEdge is a verification platform for fintechs and other digital-first businesses. Its biometric liveness checks and video verification confirm a user is physically present, alongside KYC, AML, PEP and sanctions screening, with custom rules set through its API. The company states most verifications finish within 30 to 60 seconds, depending on the checks required. At a demo, ask how it handles both presentation attacks and camera-feed manipulation.