AI fraud drives identity verification toward continuous trust and layered assurance

Trust in current identity verification tools remains low among most organizations, according to a new Regula survey, “The New Shapes of Identity Threats 2026.” Just forty eight percent of respondents say they fully trust their technical controls. More than half (52 percent) cannot fully verify that biometric data was captured live, exposing a gaping hole in liveness detection technology that is supposed to be table stakes for IDV. Synthetic data remains largely hidden, and only 50 percent can trace identity decisions end-to-end.

In terms of consequences, 92 percent report business impact from incorrect identity verification results. “When identity decisions are wrong, the consequences can affect revenue, compliance, operations, customer trust, and brand reputation at the same time.”

The long and the short of it is, identity security is currently playing catch-up in a race with AI fraud, which continues to accelerate. Static identity verification is a relic; according to the report, “identity is no longer verified once. It is maintained across the customer lifecycle.” Or, per a release, “the challenge is not detecting fakes – it is managing trust.”

Identity and trust are linked, and to maintain trust is to maintain confidence in verified identity across transactions. But that no longer exclusively means human identity. AI is an active participant in digital interactions, making it difficult for organizations to determine who – or what – is behind an identity verification attempt.

Today, says Henry Patishman, executive vice president of IDV at Regula, “organizations must verify not only identity signals but also the interaction itself. They need to understand whether biometric data was captured live, whether identity evidence is authentic, and ultimately whether a real person is actually behind the session.”

Regula says the findings reflect a fundamental shift in identity verification, which requires “a broader approach to identity assurance that combines multiple identity signals, validates the integrity and origin of those signals, continuously reassesses risk, and maintains trust throughout the entire customer lifecycle.”

“The future of identity verification is not a single check performed during onboarding,” Patishman says. “Trust can no longer be established once and assumed forever.”

Microblink study shows diversity of fraud across regions

New data from Microblink suggests that identity fraud is “no longer evolving uniformly,” and that deepfakes and generative AI fraud are no longer emerging threats, but rather “the new baseline”  for carefully crafted digital fraud.

“Fraudsters are increasingly tailoring their techniques to specific regions, document ecosystems, and verification systems while using generative AI to make attacks faster, cheaper, and more difficult to detect,” says a release from the AI computer vision software provider.

For example, North America is a hotbed for sophisticated photo forgery attacks, while other regions show “higher concentrations of presentation attacks or physical reproductions.”

Microblink says the findings “suggest that effective fraud prevention increasingly depends on understanding regional attack patterns rather than relying on one-size-fits-all detection models.”

“Generative AI has fundamentally changed the economics of identity fraud,” says Hartley Thompson III, CEO of Microblink. “Fraudsters no longer need to build convincing fake identities from scratch. They can modify legitimate credentials quickly, inexpensively and at scale, making traditional verification approaches increasingly difficult to rely on.”

The report also gives a name to the dialectical nature of fraud and fraud prevention: the “Sophistication Paradox” describes the process by which security improvements drive new attack techniques and technologies. “As governments and issuers strengthen identity documents with more advanced security features, fraudsters are responding with increasingly precise AI-assisted editing techniques designed to evade traditional verification methods.”

A key takeaway? Static rules no longer apply. “Identity verification can no longer rely solely on one-time checks at onboarding or login. Trust now needs to be evaluated continuously across the customer lifecycle using layered signals such as biometrics, behavioral analysis, device intelligence, transaction context, and ongoing risk monitoring.”

Kenshiki Labs opens challenge to red teams, offers $12,500 bounty

“AI didn’t just make fraud faster and cheaper,” said Stephen Fishburn, CEO of Kenshiki Labs. “It made it scale by driving the cost of manufacturing a human identity to near zero. Fraud rings exploit vulnerable identity signals at industrial scale, and the legacy systems still haven’t caught up in this AI arms race.”

To help bring them up to speed, Kenshiki has launched the Pulse Bond Challenge, a $12,500 “public bounty” for any cybersecurity red team that can bypass its deterministic proof-of-identity infrastructure without a live human present, according to a release.

The firm says its proof-of-identity system cannot be compromised by forged signals. “It treats a session as complete when a phone’s hardware, a live biometric check, and an NFC read from a chip-enabled government ID are all linked on the backend. The Pulse Bond Challenge targets apex predator attackers: to win, a red team must defeat the full hardware-bound stack.”

The Pulse Bond Challenge opens July 4, 2026, and runs for 28 days.

Au10tix integrates ‘physio-behavioral AI’ from Validit.ai

Au10tix has announced a collaboration with Validit.ai, a provider of “physio-behavioral AI technology backed by multiple granted U.S. patents for real-time human authenticity verification,” per a release.

The collaboration will see the two companies Au10tix and “explore how physio-behavioral AI can be applied as an additional risk-signal layer within digital identity verification and fraud prevention workflows, helping organizations stay ahead of the next generation of identity fraud.”

Validit.ai’s patented physio-behavioral AI technology analyzes signals through a standard device camera, generating “real-time authenticity and risk indicators that can support customer-defined workflows such as step-up verification, manual review, transaction approval, or internal risk policy decisions.”

“Staying ahead of fraud requires constant innovation,” says Yair Tal, CEO of Au10tix. “Our collaboration with Validit.ai is another example of how Au10tix continues to bring new intelligence and capabilities to our clients, enabling them to detect emerging risks, strengthen trust, and make better decisions across high-stakes digital journeys.”

BC-based Hydaway launches liveness in RealityChek platform

Hydaway Digital Corp is launching a new liveness detection feature within the RealityChek platform. A release says Liveness Checker “enables real-time verification of whether a person present in a video stream or submission is a live, authentic human being – or an AI-generated deepfake, synthetic avatar, or pre-recorded replay attack.”

In launching liveness detection, Hydaway moves RealityChek – a wholly owned subsidiary, which it acquired in February 2026 – beyond static content verification and into real-time identity security. Liveness Checker uses a multi-signal approach, analyzing multiple behavioral, biometric, and forensic signals simultaneously.

Karl Kottmeier, CEO of Hydaway, says RealCheck Liveness Checker is built to stay ahead of the AI fraud curve, by providing thorough understanding. “It’s not just checking for a heartbeat, it’s performing a deep forensic analysis of what it means to be genuinely, verifiably human in a digital interaction.”

Hydaway is based in North Vancouver, and RealityCheck is registered as a corporation in Ontario. RealityCheck also offers the DETECT product, which allows users to upload images and URLs for validation.

Article Topics

AI fraud  |  AU10TIX  |  biometric liveness detection  |  bug bounty  |  identity verification  |  Kenshiki Labs  |  Microblink  |  RealityChek  |  Regula