Advanced: identity fraud in eKYC.

Two ways to fool a camera

A remote identity check trusts what arrives from the applicant's camera. Attackers have two ways to corrupt that.

• Presentation attacks put something in front of the real camera: a printed photo, a video replayed on a screen, a mask. NIST's glossary, drawing on ISO/IEC 30107-1, defines a presentation attack as presenting something to the biometric capture system to interfere with how it works. Presentation attack detection (PAD), including liveness detection, is the defence. ENISA, the EU cybersecurity agency, noted in 2022 that modern high-resolution screens have made replayed video very viable, and that silicone and printed masks are also used.
• Injection attacks never go near the real camera. The attacker feeds images or video straight into the data stream, using a virtual camera, a device emulator, a modified app or a tampered connection. NIST describes them as inserting forged media between the capture point and the comparison. ENISA reported that industry saw video injection as the most promising attack method, precisely because it is not a presentation and so PAD may never see it.

A deepfake is content, not a channel. ENISA's point is simple: a deepfake can only enter a system by being shown to the camera or injected into the camera feed. Real-time face re-enactment means the operator on a video call may be talking to a live person whose face is replaced, so random gestures alone may not expose it.

Standards follow the same split. ISO/IEC 30107-3 is the test standard for presentation attack detection. CEN/TS 18099, published in 2024, covers biometric data injection attack detection and explicitly leaves presentation attack testing to ISO/IEC 30107.

What NIST now requires. The final SP 800-63A-4 (July 2025), written for US federal identity services but widely used as a reference, says a biometric comparison does not by itself stop injection attacks, and that PAD and live capture are not enough for every case. For all remote proofing it requires controls showing that media comes from a genuine sensor, such as detecting virtual cameras, emulators and jailbroken devices; analysis of all media for manipulation, with false-negative rates documented; and protected channels. In video sessions, agents must be trained to spot manipulated media and use random prompts, such as passing an object between the camera and the face.

Deepfakes and synthetic identities

Deepfakes in onboarding. In November 2024 the US Financial Crimes Enforcement Network (FinCEN) issued an alert after seeing more suspicious activity reports, from 2023, that described deepfake media used to defeat identity checks. Criminals altered real identity document images or generated entirely synthetic ones, and combined generated photos with stolen or invented personal details. Accounts opened this way were then used to receive and move the proceeds of other frauds.

FinCEN's red flags include:

• a photo that is internally inconsistent or does not fit other details, such as an apparent age that does not match the date of birth;
• several identity documents that do not agree with each other;
• a webcam plugin from a third party in use while the live check runs, or repeated "technical glitches" and requests to switch channel;
• a customer who declines multi-factor authentication;
• a reverse image search that finds the photo in a gallery of AI-generated faces;
• location or device data that does not fit the identity documents;
• a new account that immediately moves money rapidly, pays high-risk payees or attracts chargebacks.

FinCEN stresses that no single red flag is conclusive. The FBI's December 2024 warning adds visual tells of generated media, such as distorted hands, irregular faces, odd shadows and lag.

Synthetic identities are a different problem. Traditional identity theft uses one real person's identity, and the victim usually notices. A synthetic identity is a person who does not exist, built from a mix of real and invented details. The US Federal Reserve describes three methods: fabrication (all invented), manipulation (real details slightly changed) and compilation (real and fake combined, the most common). In the US the real element is often a Social Security number belonging to a child, an elderly person or someone who rarely checks their credit.

Synthetic identities are patient. They apply for credit until a file exists, build history, sometimes "piggyback" as authorised users on good accounts, then bust out: borrow to the limit and disappear. Some stay as "sleepers" for years. Because there is no complaining victim, losses are often booked as bad debt.

The Federal Reserve suggests looking for links rather than single traits: many applications from one device or IP address; the same identity number, address or phone across different names; credit history far shorter than the applicant's age suggests. It also warns that relying on one trait, such as a thin credit file, unfairly flags legitimate customers such as recent immigrants.

After onboarding, account takeover and SIM swap

A perfectly verified account can still be stolen. The FATF's 2023 report on cyber-enabled fraud, written with INTERPOL and the Egmont Group, describes takeover through phishing, social engineering and remote-access tools.

SIM swap is the classic route around text-message security. The criminal persuades or bribes a mobile operator to move the victim's number to a SIM they control, then uses "forgot password" and one-time codes sent by SMS to take over email, bank and other accounts. The FBI's 2022 warning described social engineering of operator staff, insiders paid by criminals, and malware planted through phishing of operator employees. The FBI recorded 1,611 SIM swap complaints with over US$68 million in losses in 2021, against 320 complaints and about US$12 million for the whole of 2018 to 2020. Its advice: operators must verify customers strictly before moving a number, and users should prefer authenticator apps, physical keys or biometrics to SMS codes.

Remote access and coached victims. In one case in the FATF report, from Austria, criminals persuaded victims to install remote-access software, opened accounts in the victims' own names at crypto platforms using their data, guided them through the online verification while hiding what was really on screen, and then had them transfer money. Losses exceeded EUR 600,000. The identity check was genuine; the person was being manipulated.

What helps:

• phishing-resistant multi-factor authentication instead of SMS codes where possible;
• treating a new device, a number change or an account recovery as a high-risk event, with step-up checks and notifications;
• monitoring for remote-access tools, emulators and browser manipulation;
• a cooling-off period and lower limits after a new device or new online banking enrolment, as the FATF suggests.

Mule accounts opened remotely

Fraud needs somewhere to send the money. The FATF's 2023 report says laundering networks behind cyber-enabled fraud typically involve money mules, recruited online through fake jobs and "easy money" offers, and that remote account opening makes it easy to set up accounts across borders. Mules may be complicit, deceived or negligent, and some are themselves fraud victims.

Remote onboarding creates particular patterns:

• Rented identities. In a Singapore case in the report, 147 people handed their national digital identity credentials to criminal syndicates, which used them to open 276 accounts remotely at eight banks. The financial intelligence unit found the network through shared transaction patterns, foreign contact details and device identifiers.
• Credential hand-over. Mules surrender logins, cards and tokens so the syndicate controls the account directly, sometimes for a limited rental period, which with a genuine onboarding makes detection harder.
• Bursts of account opening. Spain's financial intelligence unit flagged people opening accounts at three or more institutions within 20 days, which led to about 40,000 linked accounts.

Onboarding and early-life red flags from the FATF report include shared or altered identifiers, contact details changed soon after opening, email addresses that do not match the name, one device or IP address used by many customers, VPN or hosting addresses, keystroke patterns that suggest automation or coaching, remote-desktop sessions, and customers who cannot explain the funds.

Scale. Europol's European Money Mule Action in 2023, with 2,822 banks and other institutions taking part, identified 10,759 mules and 474 recruiters and led to 1,013 arrests.

The lesson for eKYC teams is that identity verification and fraud monitoring must share data. A customer who passes every check at onboarding can still be a mule; the evidence appears in the device, the network and the first weeks of transactions.

Layered controls, and what the cases show

Every source makes the same point. ENISA says one control alone cannot prevent these attacks and 100% assurance is impossible; the goal is to make fraud cost more than it pays. NIST calls for layered controls, and FinCEN and the Federal Reserve warn that single red flags mislead.

The layers:

• Document: security features, live capture of the document, and the chip where there is one, since a chip signed by the issuing state gives the strongest guarantee; checks against lost and stolen document databases.
• Face: active and passive liveness, tested to ISO/IEC 30107-3, with uncertain results routed to a trained person.
• Capture channel: virtual camera, emulator and tampering detection, a dedicated app or protected channel, and analysis of media for manipulation.
• Data: checks against authoritative sources, including death records where available, and duplicate detection, such as the same face or device appearing under different identities.
• Behaviour and early life: device and location signals, velocity limits and monitoring of the first transactions.
• People and testing: trained reviewers with authority to stop a session, regular attack testing, and controls updated as attacks change.

Cases from official sources:

• Face-swapped loan applications (Hong Kong Government, 2024). Police arrested nine people in August 2023 on suspicion of conspiracy to defraud. The syndicate was suspected of stealing identities and using an AI face-swap program to apply for loans online between September 2022 and July 2023. These are arrests, not convictions.
• A synthetic identity ring (US Department of Justice, 2022). A ring combined invented names and birth dates with real Social Security numbers, including children's, to open bank and credit card accounts, set up shell companies and cause losses of about US$1.9 million. One member was sentenced to 94 months in prison.
• A fake ID at a phone shop (US Department of Justice, 2025). A man printed a fake identity card, impersonated the holder of a high-profile social media account at a mobile phone store to get a replacement SIM, and passed the password reset codes to accomplices, who posted a false announcement. He was sentenced to 14 months. A strong online check is undone if the phone shop accepts a forged card.

In Kenya: the Computer Misuse and Cybercrimes Act, 2018 makes it an offence to fraudulently use another person's password or other unique identification feature (identity theft and impersonation), alongside computer fraud, forgery and phishing; a 2025 amendment added a definition of identity theft that names identification numbers, SIM cards and bank account information. The 2025 SIM registration regulations require original identity documents and verification against the relevant government database. The Financial Reporting Centre's 2023 risk assessment update describes fake or stolen identity documents used in mobile money, including a case, still in court, where relatives' identity cards were allegedly used to register SIM cards that received over KES 11 million. Check the current law and case outcomes.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.