Deepfakes now feature in one in five biometric fraud attempts, and the best attacks never show anything to the camera. Three industry voices explain what changed at onboarding, and the data shows which controls hold up.

For years, remote onboarding worked on a simple idea. Hold up an ID, take a selfie, blink on cue, and the system decides whether the face matches. Generative AI has broken that idea. Deepfake KYC attacks can now fake the face, the document and even the camera feed itself.

So we asked industry leaders one question: how have deepfakes or synthetic identities changed the way your company verifies customers at onboarding, and what has worked better than you expected? We wanted real examples over vendor pitches. Three respondents answered. Below, we set their replies against the latest data.

How big the deepfake KYC problem is

The numbers have moved fast. Deepfakes now account for one in five biometric fraud attempts, and injection attacks rose 40% in a year, according to Entrust’s 2026 Identity Fraud Report. Crypto platforms see 67% of their fraud attempts at onboarding. In addition, digital forgeries made up 35% of document fraud.

The UK deepfake KYC picture is similar. Cifas recorded a record 444,000 fraud-risk cases in 2025, with identity fraud making up 54%, according to Fraudscape 2026. Meanwhile, US regulators flagged the trend early. A 2024 FinCEN alert warned that criminals were using generative AI to create ID documents and photos to open accounts.

When the face is easy to fake

Our first respondent runs an AI video platform, so he sees synthetic media from the other side.

“We’re a creative tools company, not a bank or crypto platform, but we deal with synthetic media every day. The same technology that makes deepfakes frightening is what we use to help small businesses make content. The line between a creative tool and a fraud tool is all about intent, and intent is almost impossible to check when something is created.

The quality of synthetic media has risen so fast that basic liveness checks are now the minimum, not an edge. A year ago, holding up a phone and blinking was enough. Today you can make a realistic face swap video in under a minute. Anyone relying on a single visual check is already behind.

What has worked better than we expected is layering behaviour signals. We look at how people use the product, not just who they say they are: what they create, session timing and the gap between sign-up and first action. Fraudulent accounts tend to skip exploring altogether and go straight to one workflow. Treat identity as a signal you keep reading, not a gate people pass once.”

Runbo Li, Co-founder and CEO, Magic Hour

His point on liveness needs one addition. The most dangerous deepfake KYC attacks do not hold anything up to the camera at all. Injection attacks feed a fake video straight into the verification system, so blink tests never see the real camera. FinCEN lists third-party webcam plugins during live checks as a red flag for exactly this reason.

His advice on continuous deepfake KYC checks fits the data, though. TransUnion found that 81% of suspected digital fraud in the first half of 2026 hit existing customers at login or payment, not at sign-up, according to its October report.

Prove where the evidence came from

Our second respondent pointed to the capture itself.

“Check where the evidence came from, not just what the uploaded image looks like. Deepfake images are now convincing enough that onboarding needs more than visual checks.

Build verification that looks at how a photo or video was captured before you accept it. That means tying each submission to its capture conditions, such as timestamp, location and device orientation. Location mismatches are worth watching. Truepic found that 57.8% of virtual inspections it reviewed had images taken more than 200 metres from the expected address.

Stricter checks also deter bad actors. In the same work, nearly 70% of applicants asked for authenticated images dropped out. Track that drop-off closely, because it tells you how well your controls are working.”

Carlos J. Correa, Chief Operating Officer, Ringy

His principle is sound for deepfake KYC, but the figures need context. Both come from a Truepic case study on Dun and Bradstreet’s business verification, not consumer KYC. The applicants had already been flagged as higher risk. Truepic itself says distance alone does not confirm fraud. The 70% also includes people who simply never replied, so drop-off measures friction as well as deterrence.

A second channel beats a sharper eye

Our third respondent runs an IT services firm and offered a simpler case.

“My firm isn’t a bank, so I have no KYC results to share, only a plainer case from IT support with no deepfake involved. The Hamburg sales branch of an industrial group got a phishing email asking to change an employee’s salary bank account. Since then, our support team there only accepts requests from senders on the staff list and confirms everything else by phone. As a founder, I’d trust a second channel like that over judging whether a face or voice looks real.”

Jens Hagel, Founder, kjello

His principle carries straight over to deepfake KYC. The safest checks do not ask a person to judge a face. However, the call-back must use a number already on file, never one supplied in the request, or a fraudster simply answers.

What works against deepfake KYC fraud

Taken together, the deepfake KYC evidence points to provenance over appearance. First, reading the NFC chip in a passport or ID card verifies the issuing state’s digital signature, which a generated image cannot copy. Second, device and injection checks catch virtual cameras, emulators and rooted phones. Firms should ask vendors for injection attack test results under CEN/TS 18099, not just liveness certificates.

Third, bank-held data is harder to fake than a scanned document, which makes it a strong deepfake KYC defence. In June, six UK banks backed a bank-led digital verification service through UK Finance, though it has not published results yet. Finally, consortium data such as Cifas, and continuous checks after onboarding, catch what slips through. For more on identity tools for AI agents, see our report on Socure’s agent tools.

Common misconceptions

Several claims come up often in deepfake KYC debates. Better liveness alone does not solve the problem, because injection attacks skip the camera. Drop-off is not proof of fraud prevented, because genuine customers leave too. In addition, a synthetic identity is not just a deepfaked face. Most mix real and invented personal data and build a credit history over time, as our roundup on AI fraud models explored.

What to watch next

Several changes will shape deepfake KYC in 2027. The FCA has proposed updating its financial crime guide on AI, synthetic identities and deepfakes, with comments due by 24 December 2026. In the US, regulators confirmed in September that mobile driving licences can satisfy customer identification rules. The UK bank-led verification service should also publish its first results.

Above all, the deepfake KYC lesson is consistent. A face on a screen is no longer proof of identity. The checks that hold up prove where the evidence came from.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial or legal advice. Views expressed are those of the FintechBits editorial team.