KYC used to come down to one question: is the person opening this account the same person on the ID? Deepfakes complicate that. Someone can animate a stolen photo, tweak live video, or push pre-made footage straight into the verification flow. If you onboard customers remotely, whether you’re a bank, a fintech or a marketplace, you now have to ask a second thing: is this video even real?
Why remote KYC is exposed
Most remote flows pair a document check with a selfie or short video, then compare the face to the portrait on the ID. That works fine until the attacker never actually shows up on camera and sends synthetic media instead.
The ID itself can be completely genuine, and that’s the catch. If someone has got hold of another person’s details, the only thing left to fake is the face, which is exactly what generated media is good at.
NIST covers this in its Digital Identity Guidelines for identity proofing and enrollment. It points out that generative tools can create or alter applicant images and video, and that injection attacks can slip forged media in between the capture device and whatever system does the comparison.
A matching face doesn’t mean a live person
A high similarity score tells you two faces look alike. It says nothing about whether a real person was sitting in front of the camera. So there are two separate questions: does this face fit the claimed identity, and was this capture authentic?
A video authenticity tool helps with the second one. Under the hood it’s computer vision work: it looks inside the video for odd frame behavior, artifacts left behind by generation, or signs that the media arrived through an unexpected route.
Look at how the video got there
Plenty of teams treat deepfakes as a face-spotting problem and forget to ask how the footage arrived. Compare two attacks. In one, someone holds a screen playing generated video up to the camera. In the other, software feeds video into the session and the camera is never involved. Different attacks, different defenses.
So it’s worth asking a few plain questions. Can we tell camera input from injected input? Do we log strange device behavior? Can a suspicious session go to a human for review? Bolting a “deepfake detector” onto the end of the flow won’t answer any of those. The check has to connect to the systems you already run, or its results never reach the people who act on them.
Decide what happens after a flag
Rejecting everything that looks odd hurts real customers. Bad lighting, a slow connection, an old phone, heavy compression, accessibility needs: all of these can make an honest video look strange.
A better approach is to let risk signals decide the next step. That might be a retry, a different verification method, or manual review. And record why each application was escalated. You get an audit trail, and your fraud team gets a way to spot repeat attack patterns.
Over time, a single “flagged or not” answer matters less than the bigger picture: which combination of identity, device, document, biometric and media signals makes this particular application look risky?
Where this leaves KYC
KYC was built to prove that someone holds valid ID and matches it. Synthetic media adds a third requirement: confidence that the person on screen was really captured. Deepfake detection works best as one layer alongside document validation, biometric matching and capture integrity. Teams that look at all of those together are in a much better spot to catch serious impersonation than teams leaning on a single control.
FAQs
1. What is deepfake detection in KYC?
It’s a check that looks at the submitted selfie or video and tries to tell whether it shows a real, live capture or manipulated, generated or injected media. It sits next to document and face checks, not in place of them.
2. If the face matches the ID, isn’t that enough?
No. A match only says the faces look similar. A fraudster with a stolen ID can use a synthetic face built to resemble the real holder, and it will score well.
3. What is the difference between a deepfake held to the camera and an injection attack?
In the first, fake footage is shown to a real camera. In the second, fake video is fed into the session directly and the camera is skipped. They need different controls, which is why checking only the face isn’t enough.
4. Can a deepfake detector alone stop KYC fraud?
No. A real video can still come with stolen documents, and fake media can come with convincing paperwork. Detection works as one signal among several.
5. Will deepfake detection reject genuine customers?
It can, if you reject on every flag. Poor lighting, weak internet, old phones and heavy compression can all make real videos look odd. A retry, another verification method or manual review is a safer response than an instant rejection.
6. What should happen when a video is flagged as suspicious?
Decide this in advance. Common options are asking for another capture, switching to a different method, or sending the case to a reviewer. Whatever you choose, log the reason so there is an audit trail.
7. Which businesses need to worry about this?
Any business that verifies customers remotely: banks, fintechs, marketplaces and similar platforms.
8. What should a KYC team review first?
The whole capture path, from the moment the video is recorded until it reaches the verification system. Ask whether you can tell real camera input from injected input, whether odd device behavior is logged, and whether suspicious sessions can be escalated.
Comments are closed