Security teams should treat eKYC as a layered trust decision, not a single verification event. Strong controls combine document validation, face match, liveness detection, transaction screening, and behavioral risk analysis. The goal is to make synthetic identities harder to create, harder to reuse, and easier to flag before account opening or privileged access is granted.
Why eKYC Breaks Down Under Synthetic Identity Pressure
eKYC was built to decide whether a person is real enough to trust, but generative AI raises the quality of the evidence it has to judge. Fraudsters can now combine counterfeit documents, stolen personal data, face swaps, and voice cloning to make one verification step look convincing while the underlying identity remains synthetic or misattributed.
That is why the practical issue is not just image quality. It is whether the onboarding process can separate genuine identity assurance from polished deception. A strong eKYC flow has to validate document integrity, test for liveness, compare signals across channels, and look for reuse patterns that show the same synthetic persona appearing in different accounts or applications. NIST AI 600-1 GenAI Profile is useful here because it frames generative AI risk as something to govern across the full lifecycle, not only at the point of content generation.
In practice, many security teams discover the weakness only after a fake identity has already passed onboarding and been used to obtain accounts, credentials, or payment access.
How Strong eKYC Works When Deepfakes Are Cheap
Modern eKYC should be designed as a layered trust decision, with each layer asking a different question. Document checks answer whether the ID artifact looks genuine. Face match asks whether the selfie plausibly matches the document photo. Liveness checks ask whether the subject is present in real time rather than replayed or synthesized. Behavioral analysis asks whether the application flow itself resembles legitimate user behaviour or a fraud campaign.
The important operational shift is to treat AI-generated media as an input-quality problem and a correlation problem. A convincing face image is not enough if the device fingerprint, IP reputation, submission velocity, geo-location, and identity reuse pattern do not fit. Likewise, a good liveness score should not override a document that has inconsistent metadata, tampered fields, or repeated use across multiple applicants. This is where transaction screening and account-intent analysis matter: teams need to see whether the identity is being created for ordinary access, mule activity, fraud, or later privilege abuse.
Current guidance suggests that teams should also harden the workflow itself, not just the evidence it consumes. That means step-up verification for higher-risk journeys, tighter review thresholds for edge cases, and explicit controls on what happens when signals conflict. eKYC works best when it is allowed to fail closed for high-risk applications rather than being forced to auto-approve ambiguous ones. eIDAS 2.0 is relevant because it shows where stronger digital identity assurance and wallet-based verification can reduce reliance on a single selfie-and-document moment.
Evidence from identity and secrets research also reinforces the value of multi-signal controls: NHIMG research on the State of Secrets in AppSec notes that remediation delays and fragmented control environments create long-lived exposure once trust is misplaced. These controls tend to break down in high-volume onboarding environments because review queues, customer pressure, and automation bias push teams to accept the most fluent-looking application rather than the most trustworthy one.
- Use document, face, device, and behavioural signals together instead of promoting any single score to a final decision.
- Apply stricter review to first-time applicants, high-value accounts, and workflows that lead to payments or privileged access.
- Retain rejection and escalation data so fraud patterns can be tuned back into the onboarding logic.
Where eKYC Needs More Than Detection
Tighter verification often increases friction, manual review load, and abandonment risk, so organisations have to balance customer experience against fraud tolerance. That trade-off becomes sharper when the same synthetic identity can be reused across many onboarding attempts, because the cost of one weak approval is far higher than the cost of one blocked applicant.
Best practice is evolving, but there is no universal standard for how much synthetic-media resistance is enough. Some environments can rely on stronger identity wallets and regulated digital credentials, while others must compensate with layered review, risk scoring, and post-onboarding monitoring. Financial services and other regulated sectors should also align eKYC with AML and KYC obligations, because identity fraud and transaction abuse often surface together. FATF Recommendations are relevant where onboarding quality affects customer due diligence, beneficial ownership checks, and ongoing monitoring expectations.
The other edge case is agentic or automated abuse, where a fraudster uses AI systems to generate many slightly varied identities at scale. In that environment, isolated biometric checks matter less than the platform’s ability to detect clustering, reuse, and abnormal creation velocity. When the same risk patterns recur across channels, the problem is no longer identity proofing alone; it is identity fraud operations. In practice, the teams that perform best are the ones that treat eKYC as an adversarial workflow, not a compliance formality.
Risk and Threat Considerations
The material risk is synthetic identity fraud at onboarding, followed by account abuse, payment fraud, or credential issuance under a false trust decision. Deepfake media raises the attacker’s chance of crossing the initial assurance threshold, especially when reviewers over-trust a polished face match or document image.
Failure mechanism: Attackers combine stolen data, fabricated documents, generated selfies, and replayed or synthetic video to satisfy isolated checks while bypassing cross-signal scrutiny. Where the process lacks device binding, velocity limits, or reuse detection, the same synthetic persona can be scaled across many applications.
Impact: Organisations can open accounts for non-existent or misrepresented people, issue credentials to fraudulent actors, and inherit downstream exposure in fraud, money movement, compliance failure, and privileged-access abuse.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Inventory and Ownership | eKYC creates identities that need ownership, lifecycle, and abuse traceability. |
| NHI-03 — Secrets and Credential Management | Fraudulent identities often exist to obtain credentials or access tokens. | |
| NHI-05 — Authentication and Assurance | eKYC is fundamentally an assurance gate for identity proofing and trust. | |
| Recommendation — Inventory onboarding identities and assign accountable owners before trust is granted. Issue credentials only after higher-assurance verification and rotate anything exposed. Raise assurance thresholds for high-risk onboarding and step up verification when signals conflict. | ||
| NIST AI RMF | GOVERN — Govern AI Risk | Generative AI changes the threat model for identity proofing workflows. |
| Recommendation — Govern deepfake and synthetic-identity risk as a lifecycle control problem, not a one-time check. | ||
| CIS Controls v8 | 6 — Access Control Management | eKYC determines who gets access, so access decisions need tighter control. |
| Recommendation — Restrict onboarding paths and separate high-risk approvals from routine account creation. | ||
| MITRE ATT&CK | T1589 — Gather Victim Identity Information | Fraudsters collect identity data to build convincing synthetic applicants. |
| T1036 — Masquerading | Fake identities and deepfakes are forms of identity masquerading. | |
| Recommendation — Hunt for identity-enrichment activity that feeds synthetic identity creation. Detect masquerading by correlating document, biometric, and behavioural anomalies. | ||
Practitioner Guidance
What to prioritise: Treat the highest-risk onboarding journeys differently from ordinary sign-up flows. If an account can move money, access regulated services, or later receive elevated privileges, require stronger evidence than a face match and a document scan.
Decision rule: If any one signal looks strong but the rest of the application looks inconsistent, escalate rather than auto-approve. A convincing deepfake should not be allowed to outweigh weak device reputation, unusual velocity, repeated artefacts, or mismatched identity history.
What practitioners underestimate: The main failure is often not a single failed control but the absence of correlation across controls. Teams should be able to explain why an identity was accepted, what signals were decisive, and which anomalies were tolerated.
Practitioner takeaway: The goal is not perfect certainty at the door; it is to make synthetic identities expensive to scale and easy to detect before they become trusted accounts.
