Deepfakes Are Breaking Identity Verification Systems, and Banks Are Racing to Adapt

What happened?

Financial institutions, telecommunications providers and government agencies have reported a marked rise in fraud attempts using AI-generated synthetic audio and video, commonly known as deepfakes, designed to bypass identity verification systems that rely on facial recognition or voice authentication. Several major banks have confirmed incidents in which fraudsters used AI-generated video to impersonate customers or, in some documented corporate cases, impersonated executives to authorise fraudulent transactions.

The trend has prompted an accelerated shift away from relying on a single biometric check toward layered verification approaches that combine multiple signals, such as device behaviour, document verification and liveness detection designed specifically to identify signs of AI-generated manipulation, reflecting a recognition that facial and voice recognition alone are no longer sufficiently reliable safeguards on their own.

Key points

• Fraud attempts using AI-generated deepfake audio and video to bypass identity checks have risen sharply across banking and telecom sectors.
• Attackers have used synthetic video to impersonate customers during account verification and, in some cases, executives authorising transactions.
• Financial institutions are shifting from single biometric checks to layered verification combining multiple independent signals.
• Liveness detection technology, designed to spot signs of AI manipulation, is becoming a standard component of identity verification systems.
• Regulators and standards bodies are beginning to issue specific guidance on deepfake-resistant identity verification for regulated sectors.

What we know

Identity verification systems that rely on comparing a live video or photo of a person against a government-issued identity document have become widely used across banking, telecommunications and government services as a way to verify customers remotely without requiring an in-person visit. These systems were generally considered robust against casual fraud attempts, but the rapid improvement in AI tools capable of generating realistic synthetic video and audio has eroded this assumption considerably over the past two years.

Fraud monitoring reports from financial institutions and cybersecurity firms document a growing number of cases where fraudsters used AI-generated video, sometimes created from photos or videos scraped from social media, to attempt to pass facial verification checks during account opening or high-value transaction approval processes. Voice cloning technology, similarly, has been used in reported cases to impersonate individuals during phone-based identity verification or, in corporate fraud cases, to convincingly imitate a senior executive's voice when instructing staff to make urgent financial transfers.

Officials and experts

Fraud prevention specialists at major financial institutions describe the rise of deepfake-enabled fraud as one of the most significant emerging threats to digital identity verification systems, noting that the technology required to generate convincing synthetic media has become considerably more accessible and requires less technical skill than in previous years. They have emphasised that no single verification method should be considered sufficient on its own going forward, advocating instead for layered approaches that are harder for an attacker to defeat simultaneously.

Cybersecurity researchers developing deepfake detection technology caution that this is an ongoing technical contest, since detection methods that work against current-generation synthetic media may become less effective as the underlying generation techniques continue to improve, requiring continuous updates to detection systems rather than a one-time fix. Regulators overseeing financial services have begun signalling that institutions will be expected to demonstrate resilience against AI-enabled identity fraud as part of routine supervisory expectations, rather than treating it as a purely voluntary best practice.

Background

Remote identity verification technology expanded rapidly over the past decade, driven initially by demand for convenient digital banking and government services, and accelerated further as pandemic-era restrictions pushed many services that previously required in-person verification toward remote alternatives. Facial recognition and voice authentication became widely adopted components of these systems, valued for offering a reasonable balance between security and user convenience compared with older methods such as security questions.

The rapid advancement of generative AI technology over the past several years, initially celebrated for creative and productivity applications, has also lowered the barrier to creating convincing synthetic audio and video, tools that can be misused to defeat exactly the kind of biometric verification systems that had become widely trusted. This has created a fast-moving challenge for security teams, who must adapt verification systems designed around assumptions that are being actively undermined by advances in the same broader AI field driving other beneficial applications.

Detailed analysis

The core challenge posed by deepfake-enabled identity fraud is that it directly attacks the assumption underlying biometric verification: that a face or voice is a reliable, hard-to-fake proxy for a person's identity. As AI tools have made it increasingly feasible to generate convincing synthetic representations of a specific person's face or voice, often using publicly available photos, videos or audio recordings scraped from social media or previous data breaches, this assumption has become considerably less safe to rely on in isolation, particularly for high-value transactions or account changes.

In response, the industry has moved toward what is often described as layered or multi-factor verification, combining biometric checks with additional signals such as device fingerprinting, behavioural analysis of how a user interacts with an application, cross-referencing against known fraud databases, and liveness detection technology specifically designed to identify subtle artefacts or inconsistencies characteristic of AI-generated media, such as unnatural blinking patterns or inconsistent lighting reflections in synthetic video. No individual signal is treated as fully reliable on its own; instead, the aim is to require an attacker to successfully defeat multiple independent checks simultaneously, which is considerably harder than defeating a single verification step.

This has created what researchers describe as an ongoing arms race between deepfake generation technology and detection technology, where improvements in one domain tend to prompt corresponding improvements in the other, without either side achieving a permanent, decisive advantage. This dynamic means that identity verification systems now require continuous investment and updating, rather than being treated as a fixed piece of infrastructure implemented once and left unchanged, a shift in mindset that some organisations have been slower to adopt than others given the ongoing cost implications.

The corporate fraud dimension of this trend has drawn particular attention because of the scale of losses involved in individual incidents, with reported cases of fraudsters using cloned voices or, in some instances, video deepfakes convincingly impersonating senior executives during video calls to instruct finance staff to authorise large wire transfers. These incidents have prompted many companies to introduce additional verification protocols for high-value financial instructions, such as requiring confirmation through a separate, independently verified communication channel before transactions above a certain threshold are processed, regardless of how convincing the initial instruction appeared.

There is also a broader societal dimension to this trend beyond financial fraud specifically. As synthetic media becomes harder to distinguish from genuine audio and video, trust in remote verification generally, including in contexts such as video-based legal proceedings, remote hiring interviews and even personal relationships conducted primarily online, faces new pressure, an issue that extends well beyond the immediate fraud prevention concerns of financial institutions and touches on broader questions of digital trust in an AI-saturated information environment.

Why it matters

The erosion of trust in biometric identity verification has direct financial consequences for individuals and institutions targeted by deepfake-enabled fraud, but it also carries broader implications for how much confidence can reasonably be placed in remote digital interactions generally as synthetic media technology continues to improve. Financial institutions and other organisations that fail to adapt their verification systems risk both direct fraud losses and reputational damage from high-profile incidents.

For consumers, the trend underscores the importance of institutions maintaining robust, multi-layered verification rather than relying on convenience-focused single-factor checks, even if this occasionally introduces friction into legitimate transactions. For policymakers and regulators, the challenge is ensuring that verification standards keep pace with the evolving capabilities of AI-generated synthetic media, a moving target that requires ongoing rather than one-time regulatory attention.

What happens next?

Expect continued investment by financial institutions, telecommunications providers and identity verification vendors in layered authentication systems and improved deepfake detection technology, alongside growing regulatory attention to minimum standards for identity verification resilience in sectors handling high-value transactions. Corporate policies requiring independent confirmation of high-value financial instructions through separate channels are likely to become more standardised across large organisations.

Over the medium term, the effectiveness of these defences will depend on how the ongoing contest between deepfake generation and detection technology evolves, an area of active research and investment on both sides that is unlikely to reach a stable equilibrium in the near future, making continuous adaptation the most realistic long-term strategy for institutions and regulators alike.