AI fraud pushes identity defenses toward IAD and continuous verification

AI-powered fraud can defeat biometrics and liveness detection. It can defeat cryptographic protections and humans in the loop, and it is increasing at an alarming rate. But even sophisticated fraud involving deepfakes and cutting-edge tools can be prevented, if the defenses above are deployed properly and in concert.

A recent arrest in Spain, new guidance from Interpol and warnings from cybersecurity researchers all point to the same conclusion: organizations need stronger defenses at issuance, including injection attack detection (IAD), cryptographic protections and continuous trust rather than relying on biometric liveness detection alone.

During a recent live video identification process, a moment of lag in video processing exposed the face of a fraudster using real-time face-swap deepfake technology. The individual was attempting to obtain digital signatures to use in future fraud attacks. The alleged perpetrator in the Murcia region has been arrested by Spanish police, who accuse him of posing as 30 different people in the course of 38 attempts to get false certificates by spoofing identity verification.

The incident, reported by the Register, was carried out with a special lighting setup to mimic the security features on legitimate identity documents, plus the camera injection. It highlights a trust problem that starts with issuance, which is why that is the part of the process the attacker targeted.

Verifyo CMO Victor Mendez made the case for cryptographic signatures as a way to dodge the threat of deepfakes in an analysis earlier this year. But he also warns of the necessity of injection attack detection (IAD) to guard against deepfakes, rather than relying on human review or biometric liveness checks. In this case IAD could have defended the verification required to issue the digital signature.

Interpol recommends biometric SIM registration, deepfake detection

The explosive growth in the use of AI to commit fraud is clearly shown by an African Cyberthreat Assessment Report 2026 published by Interpol in June.

It is a commonplace hurtling toward cliche in the identity industry that “the proliferation of AI has fundamentally altered the threat landscape.” But the barriers to enforcement Interpol identifies – limited law enforcement capacity and complications that hinder cross-border investigations – are likewise felt all around the world.

AI was a component in 55 percent of reported cybercrimes in Africa during 2025, according to Interpol’s figures. Last year marked the shift of identity theft from a focus on credential theft to fraud attempted with synthetic identities and AI to bypass biometric checks, the report says. Deepfakes, the report says, “became the most visible manifestation of this trend.”

Feedzai VP of Product Planning and Strategy Dan Holmes noted in a Biometric Update guest post that a recent survey found 12 percent of U.S. fraud victims in 2025 noticed the use of a deepfake or AI, and he expects the figure to rise. The survey he refers to also notes the true figure may be higher than victims realized.

Deepfake incidents in Africa spiked sevenfold from the second quarter of 2024 to the fourth, and have continued to rise since then.

The telecom industries in Tanzania and Rwanda, two countries where biometric checks were introduced to cut down on SIM swaps and other crime related to fraud, have struggled to implement the technology.

Meanwhile the increasing expansion of digital tools like mobile money platforms have created new attack surfaces, particularly in countries with weak KYC regulations or enforcement.

“Without a continental digital identity framework, built on interoperable standards, biometric verification, and real-time fraud detection, Africa’s financial inclusion gains are at risk of being reversed by the very technologies designed to empower them,” Interpol warns.

The international law enforcement agency’s recommendations include requiring biometric verification for all SIM registration and KYC onboarding on the continent. National cybercrime units should be equipped with deepfake detection technology, along with tools for mobile forensics and tracing cryptocurrency.

Holmes pointed to the importance of building continuous adaptive trust into identity verification and authorization systems, which he sees becoming “a de facto requirement for banks.”

1 to 2 years to get ready for AI attacks at scale: KnowBe4

A similar message was delivered by KnowBe4 Chief Deception Strategist Perry Carpenter at Black Hat. PC Mag shares a video of his presentation, in which Carpenter predicts we are one to two years away from a hyper-personalized attacks, committed at massive scale, with little or no human involvement.

Recent advances allow attackers to remove the human in the loop from numerous steps to scale attempts while improving their results.

The vast majority of cyberattacks have long come down to social engineering or exploitations of vulnerabilities in software or firmware, KnowBe4 CISO Advisor Roger Grimes wrote in a company blog post a year ago. Then-new advances in AI tools allow many of the steps in these processes to be automated, with the net effect of higher quality attacks, like deeply personalized spear phishing, and more of them.

Human Risk Management firms have been carrying out experiments for several years to test the relative effectiveness of social engineering attacks carried out by humans against those carried out by bots. The humans won in 2023, Grimes writes, and squeaked out a victory in 2024, but as of last year, just as fraudsters across Africa were embracing AI to carry out attacks, the bots hold the trophy.

In 2026, organizations that don’t have IAD and deepfake detection in place are often stuck relying on a moment of lag in which the fraudster’s mask slips.

Article Topics

AI fraud  |  biometric liveness detection  |  biometrics  |  continuous verification  |  deepfake detection  |  injection attack detection  |  KnowBe4