AI fraud accelerates US’ shift toward cryptographic digital identity

For decades, proving identity online has often meant converting a physical credential into a digital artifact. Generative AI and industrial-scale data breaches, however, are undermining nearly every assumption behind that model.

A criminal marketplace called Nexus reportedly offered more than 170 million scanned North American identity documents, including 153 million driver’s licenses, 10 million identity cards, and 3 million travel documents.

Before going offline in early September, the marketplace appeared on the Russian cybercrime forum, Exploit, in late August. Rather than typical password dumps or stolen credit cards, the site sold forensic-grade images of physical identity cards.

Investigative reporting has linked the materials to the identity verification provider IDScan.net, though the data’s source has not been definitively established. The Federal Bureau of Investigation’s New Orleans field office is investigating.

The episode does not make physical driver’s licenses obsolete. It exposes the risk created when high-resolution scans become reusable digital artifacts. Once stolen, they can be combined with breached personal information and generative AI to create convincing synthetic identities. AI is simultaneously making the evidence used to validate those documents less reliable.

At a July Senate Special Committee on Aging hearing, “The AI Deception Machine: Deepfakes, Chatbots, and the New Frontier of Senior Fraud,” lawmakers were told that criminals can clone voices, fabricate photographs and video, and tailor scams using stolen personal information at a scale previously impossible.

In 2025, Americans over 60 reported $7.7 billion in scam losses, while a bipartisan committee report identified more than 22,000 complaints totaling $893 million in AI-related losses.

An American Bankers Association official described generative AI as “industrializing” fraud.

Americans reported a record $15.9 billion in scam losses to the Federal Trade Commission in 2025, up 25 percent from the previous year, while an Associated Press and FRONTLINE investigation found that AI increasingly enables criminal organizations to operate at greater scale and sophistication.

Together, those developments are driving a fundamental change in how identity is established online.

From document verification to cryptographic proof

The emerging alternative is not simply a driver’s license displayed on a phone. It is a cryptographically verifiable credential, with trust grounded in mathematical proof that an authorized issuer created the credential, that its contents have not been altered, and, depending on the implementation, that the person presenting it controls the device or cryptographic key to which it was issued.

For a conventional document image, the question is whether it appears to be a real license and whether the person presenting it appears to match the photograph.

With a cryptographic credential, the question is whether the verifier can confirm that the state issued the claimed attributes, that the credential has not been altered or revoked, and that the presenter is authorized to use it.

That distinction is increasingly evident in federal standards and legislation.

Washington begins building the trust model

NIST’s draft practice guide SP 1800-42A outlines how financial institutions could use mobile driver’s licenses (mDLs) for online customer identification.

The document is voluntary and does not require banks to accept mDLs. However, it provides a reference architecture for incorporating state-issued cryptographic credentials into existing Customer Identification Program processes.

The information in an mDL is cryptographically signed by the issuing government agency. A bank can verify the signature using public-key cryptography rather than trying to determine from the pixels alone whether a document appears genuine.

Credentials can also be bound to a user’s device, protected by local authentication, and revoked and reissued if compromised.

The significance in the age of generative AI is straightforward. AI can generate a remarkably convincing image of a driver’s license, but it cannot generate the state DMV’s valid cryptographic signature. Nor can a stolen scan by itself produce the private cryptographic material required to present a properly device-bound credential.

Digital credentials can also reduce the amount of personal information consumers share. Instead of handing a business a complete copy of a license, an mDL can support selective disclosure, allowing a verifier to request only the attributes necessary for a transaction.

Congress is considering legislation that could accelerate the transition.

H.R. 7270, the bipartisan Stop Identity Fraud and Identity Theft Act of 2026, would direct the Treasury to establish an Identity Fraud Prevention Innovation grant program for states developing digital driver’s licenses and other credentials that align with NIST guidance.

The bill states that those systems should protect privacy and security and be designed to resist threats, including AI-enabled deepfakes. Participation by states and individuals would remain voluntary, and the legislation would not eliminate physical credentials.

The funding issue is significant because the U.S. identity system is decentralized. States issue driver’s licenses, so any broad shift toward higher-assurance digital credentials depends on dozens of state systems interoperating with thousands of potential verifiers.

Cryptography becomes one layer of trust

The Financial Services Sector Coordinating Council (FSSCC) and the Better Identity Coalition are advancing a similar approach.

Guidance developed through a Treasury-led initiative involving more than 130 government and industry experts recommends stronger liveness and injection-attack detection, authoritative checks of identity information, device and network risk analysis, deepfake detection, and stronger authentication.

Crucially, the guidance does not suggest that cryptographic credentials will make the other controls unnecessary. Instead, it treats mDLs and other verifiable credentials as a stronger root of trust within a layered fraud defense.

The FSSCC illustrates the problem with a hypothetical synthetic identity assembled from breached personal data, a forged driver’s license, and AI-generated photographs. A conventional verification system could authenticate the apparent document, match the photograph to a selfie, and still approve a fraudster.

The guidance recommends combining cryptographic credentials with liveness detection, authoritative data checks, device intelligence and behavioral analytics, rather than relying on any single identity signal.

The Treasury department moved in the same direction in its March report to Congress required by the GENIUS Act.

Although the GENIUS Act is primarily a digital asset law, Treasury has given digital identity a significant role in its approach to illicit finance. It said financial institutions may use mDLs for customer identification and described portable credentials that can disclose information on a need-to-know basis.

Treasury also said that cryptography can make identity information substantially more difficult for attackers to alter or recreate with AI.

“Illicit actors cannot reengineer an identity, even if they use AI,” Treasury said, noting that “leveraging new technologies to combat identity fraud is an urgent need.”

The department said it plans to issue guidance on using verifiable digital credentials within existing customer identification programs, explore additional funding for states and small businesses, and work with NIST and international partners on common guidelines.

Treasury also acknowledged the privacy argument against digital identity.

Poorly designed systems, it said, could create centralized repositories of personally identifiable information, making them new high-value targets for attackers. However, existing financial processes that rely on collecting and retaining copies of physical identity documents already create large stores of sensitive information.

That point becomes particularly difficult to ignore after Nexus.

The privacy comparison is no longer simply between a physical card and a digital one. It is increasingly between systems in which consumers repeatedly surrender complete, durable copies of physical credentials and systems that can transmit cryptographically authenticated information without giving every verifier another permanent copy.

However, cryptographic identity still does not eliminate fraud.

A valid credential cannot establish that its legitimate holder is not being manipulated by a scammer, that a compromised account is being used for a legitimate purpose, or that activity later in a banking session remains trustworthy.

That is why the identity shift is converging with what fraud providers call continuous or adaptive trust.

Feedzai argues that identity should increasingly be treated as a dynamic level of confidence built from credentials, devices, behavior, transactions, and shared fraud intelligence, rather than a one-time decision made when an account is opened.

The emerging model therefore has multiple layers. Cryptography establishes the credential’s provenance. Device binding and local biometrics or a PIN help establish that the presenter controls the credential. Liveness and anti-injection technology protect biometric interactions against generated media. Behavioral and transaction analytics monitor what happens afterward.

But cryptographic credentials address a weakness that generative AI has increasingly made fundamental.

The traditional model asks businesses and software to recognize something as real. The emerging model increasingly enables them to verify that it is real.

A stolen driver’s license scan can be copied indefinitely, incorporated into synthetic identities, and presented repeatedly to institutions nationwide. The legitimate holder cannot revoke the JPEG.

A properly implemented digital credential works differently. Its claims are issued by an issuer that can be cryptographically authenticated. The credential can be bound to a holder or a device. Its validity can be verified. It can be revoked. And the holder can disclose less of the underlying identity in the first place.

A new trust architecture

The bigger change is not simply that identity is shifting from a plastic card to a phone. It is that verification is beginning to move away from visual inspection, static records, and reusable document images toward credentials whose origin, integrity, and status can be independently verified.

Generative AI has made it easier to produce convincing evidence of identity. Cryptographic digital identity is an attempt to make authenticity depend less on how evidence looks and more on whether it can be proven.

Article Topics

AI fraud  |  Better Identity Coalition  |  digital ID  |  digital identity  |  fraud prevention  |  identity proofing  |  U.S. Government  |  United States  |  verifiable credentials