TL;DR: Readily available face-swapped imagery injection can evade mobile KYC liveness checks, creating a practical path to impersonation and fraudulent account access in financial services, banking, and cryptocurrency, according to iProov’s MITRE ATLAS case study. The finding underscores that identity verification now needs continuous, attack-aware controls, not static proof-of-presence tests.
At a glance
What this is: This is an analysis of how AI-driven deepfake injection can evade mobile KYC liveness verification and undermine remote identity proofing.
Why it matters: It matters because IAM and fraud teams need controls that can withstand synthetic media, device-feed substitution, and identity proofing bypass across human onboarding flows.
Context
Mobile KYC liveness verification is meant to confirm that a real person is present during remote identity proofing. The problem is that this control often assumes the camera feed and biometric signal are trustworthy enough to support a yes or no decision.
iProov’s case study shows that assumption is breaking under AI-driven injection attacks, especially where attackers can combine generated face video with a virtual camera on a mobile device. For identity programmes, the issue is no longer just spoofing a face, but defeating the trust boundary around the proofing session itself.
The article’s sector context is financial services, banking, and cryptocurrency, where remote identity verification is often tied directly to onboarding and access decisions. That makes liveness failures an identity governance issue, not only a biometric one.
Key questions
Q: What breaks when mobile KYC relies on liveness checks alone?
A: Liveness checks break when the verifier assumes the camera feed is trustworthy. If an attacker can substitute a virtual camera or inject synthetic video, the system is no longer confirming physical presence. It is validating attacker-controlled evidence, which is why proofing needs channel integrity and anti-injection testing, not just biometric matching.
Q: Why do deepfake attacks create a different identity risk than ordinary phishing?
A: Deepfakes reduce the value of human judgment because the attacker can imitate a familiar person, tone, and emotional state in real time. That means the defender is no longer judging message content alone. They are judging whether the identity evidence itself is authentic, which pushes controls toward stronger verification and workflow separation.
Q: How can security teams test whether mobile KYC controls are actually working?
A: They should run adversarial tests that use synthetic video, camera substitution, and streaming overlays against the full proofing journey. The goal is to see whether the control resists hostile evidence paths, not just whether it can score a genuine user correctly. A control is weak if it only works in benign conditions.
Q: Should organisations treat identity proofing as part of AI threat modelling?
A: Yes. If AI-generated media can influence onboarding decisions, identity proofing is already inside the AI attack surface. Teams should evaluate the proofing path as an adversarial system with injection, manipulation, and evasion risks, then align controls to that reality instead of assuming traditional fraud testing is sufficient.
Technical breakdown
How deepfake injection defeats active liveness checks
Active liveness detection asks the user to perform actions or present motion cues so the system can judge whether the sample is live. That works only if the image path, device camera, and presentation layer are trustworthy. In the scenario described here, face-swapped video is streamed into the session, so the system evaluates a synthetic presentation that still contains motion, facial structure, and timing cues. The failure is not only model weakness. It is that the challenge-response logic is being fed by an attacker-controlled media path.
Practical implication: treat the capture channel as part of the control, not just the biometric algorithm.
Why virtual camera substitution changes the threat model
A virtual camera app can replace the handset’s default camera feed with precomposed or live-generated video without rooting the device. That means device-level trust assumptions can fail even when the operating system appears intact and the session looks normal to the user. The attacker does not need to break the app’s authentication flow directly. Instead, they alter the evidence being evaluated before the liveness decision is made. This is a classic proofing bypass pattern: the verifier is authenticating a presentation, not the physical source it believes it controls.
Practical implication: validate the provenance of the camera feed, not only the outcome of the liveness test.
How MITRE ATLAS frames AI-enabled identity abuse
MITRE ATLAS is an adversarial knowledge base for AI systems, so this case study matters beyond one vendor’s biometric workflow. It documents a repeatable attack methodology that combines reconnaissance, tool acquisition, deepfake generation, and presentation evasion. For practitioners, the value is in understanding that AI-enabled identity abuse is now operationalised as a chain of accessible tools rather than a laboratory concept. That makes threat modelling more concrete: the attacker goal is not to fool a generic classifier, but to defeat identity proofing with plausible synthetic evidence.
Practical implication: map proofing scenarios to adversarial AI tactics, not only to traditional fraud patterns.
Threat narrative
Attacker objective: Bypass mobile KYC liveness checks to impersonate a victim or create fraudulent account access in regulated digital services.
- Attackers begin by collecting identity photos and other facial imagery from online sources, then assemble readily available deepfake tools and streaming software.
- They generate live face-swapped video and use a virtual camera application to substitute the handset’s normal camera feed during mobile KYC.
- The liveness system accepts the synthetic feed as legitimate, allowing impersonation and fraudulent account creation or privileged access.
- The attacker’s objective is to pass identity verification with a fabricated presence signal and gain access to financial accounts or onboarding flows.
Breaches seen in the wild
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
- 12,000 secrets in LLM training data: Truffle Security found 11,908 live API keys and passwords hard-coded in web pages captured by Common Crawl, a dataset used to train LLMs.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity proofing now has an attack-path problem, not just an assurance problem: The control is being judged on whether a live user is present, but the real question is whether the evidence path itself can be trusted. When a virtual camera can replace the handset feed, liveness becomes a mediated signal rather than direct proof. Practitioners need to treat media provenance as part of identity assurance, not a peripheral technical detail.
Continuous verification is becoming the practical boundary for remote onboarding: Static liveness checks assume the proofing event is isolated and honest once it begins. This case shows that adversaries can shape the evidence stream in real time using low-cost AI tooling. The implication is that mobile KYC programmes need attack-aware design, where the session is assessed as a hostile environment rather than a neutral user interaction.
CEN 18099 signals a shift from simple liveness to testable anti-injection controls: The article points to a European standard that explicitly raises the bar against injection attacks. That matters because biometric assurance is increasingly judged by whether it resists synthetic media and feed substitution, not only whether it can detect a blinking face. Identity teams should view this as a move toward measurable resistance, not marketing claims about biometrics.
Mobile KYC is now part of the broader AI security perimeter: The attack is not limited to fraud teams or onboarding workflows. It sits at the intersection of AI-generated media, device trust, and identity proofing, which means the same adversarial patterns will keep reappearing across regulated onboarding channels. The practical conclusion is that identity governance must absorb AI threat modelling into proofing design.
Proof-of-presence trust debt: Active liveness controls were designed for a world where the verifier could assume the camera input reflected the user’s device and physical presence. That assumption fails when synthetic video and camera substitution are both cheap and operationally viable. The implication is that organisations must stop treating liveness as a standalone gate and start treating it as one control in a hostile evidence chain.
What this signals
Proof-of-presence trust debt: Mobile KYC programmes increasingly rely on a control assumption that the user’s camera feed is genuine and the device is a reliable source of evidence. AI-driven injection attacks undermine that assumption by making the proofing channel itself part of the attack surface.
Identity teams should now evaluate liveness as an anti-injection problem, not only a biometric one. That changes how onboarding controls are tested, how fraud and IAM teams share responsibility, and how regulated digital services decide whether a proofing result is trustworthy.
For practitioners
- Strengthen capture-path validation Test whether the mobile proofing flow can detect virtual camera substitution, replayed video, and injected media before the liveness decision is made.
- Red-team the onboarding path Recreate the attack chain using public face-swapping tools, streaming software, and unmanaged Android camera substitution to measure how the control fails in practice.
- Map proofing to adversarial AI tactics Align mobile KYC threat models with AI-generated media abuse, injection attacks, and identity proofing bypass scenarios rather than generic fraud assumptions.
- Review biometric assurance requirements Check whether your proofing standard explicitly addresses injection resistance, synthetic media, and device-feed provenance in regulated onboarding flows.
Key takeaways
- AI-generated deepfake video can defeat mobile KYC liveness checks when the proofing channel itself is not trusted.
- The article shows a realistic attack path that combines image collection, face-swapping tools, and virtual camera substitution.
- Practitioners need attack-aware identity proofing that tests media provenance and injection resistance, not only user presence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, MITRE ATT&CK and MITRE ATLAS define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article shows liveness-based proofing being bypassed through synthetic media and feed substitution. |
| NHI-02 — Secret Leakage | The attack depends on uncontrolled external identity evidence and exposed source imagery used to build deepfakes. | |
| NHI-06 — Insecure Cloud Deployment Configurations | The proofing channel can be subverted when device and capture assumptions are too permissive. | |
| Recommendation — Test mobile KYC flows against injection and spoofing paths that can defeat authentication evidence. Reduce exposure of identity assets that can be harvested and reused in synthetic impersonation. Harden identity proofing deployments so hostile media paths cannot bypass capture and validation checks. | ||
| MITRE ATT&CK | TA0001;TA0006;TA0040 — Initial Access; Credential Access; Impact | The described attack chain moves from tool setup to identity abuse and fraudulent access. |
| Recommendation — Map the attack chain to initial access, credential access, and impact so detections cover the full abuse path. | ||
| MITRE ATLAS | Adversarial AI threat landscape | MITRE ATLAS is directly referenced and frames the AI-driven attack method against identity verification. |
| Recommendation — Use ATLAS tactics to model how synthetic media can be used to undermine AI-enabled identity controls. | ||
Key terms
- Active Liveness Check: An active liveness check requires the user to complete a prompt during verification, such as blinking, smiling, or turning the head. The system uses the response to confirm presence and detect replay or spoofing attempts. It is stronger against fraud, but it adds friction and depends on user participation.
- Deepfake Injection Attack: A fraud technique that replaces or alters the live input stream during a verification process with synthetic media. The target is not always the identity record. The attacker may instead attack the session layer by injecting fake video, camera output, or replayed content that appears authentic enough to pass checks.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Proof of Presence: A verification approach that aims to establish that a real person is actively participating at the moment of authentication. It goes beyond matching a stored trait and instead looks for live, context-specific evidence that resists replay, cloning, and remote fabrication.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org