TL;DR: Deepfake attacks now target onboarding as a primary fraud path, with multi-step attacks rising 180% to 28% of global fraud detected in 2025 and real-time verification increasingly measured in seconds, according to AU10TIX. Identity teams now need layered detection because liveness checks alone do not cover injected video, synthetic documents, or face swaps.
At a glance
What this is: This is an AU10TIX analysis arguing that deepfake detection has moved from a niche anti-fraud control to a core part of digital identity verification, because onboarding flows now face synthetic media, replay, and injection attacks at scale.
Why it matters: It matters because IAM and identity proofing teams need controls that evaluate media authenticity, not just match a face to an identity record, especially where onboarding speed, auditability, and cross-channel coverage all affect fraud exposure.
Context
Digital identity verification now has to answer two questions at once: is the person real, and is the media they present authentic? The article argues that deepfake attacks have moved into onboarding because fraudsters can now combine synthetic faces, manipulated documents, and injected video streams in a single verification flow.
For IAM and KYC teams, that shifts the control problem from one-time biometric matching to layered identity proofing. A process that only checks liveness or only inspects documents leaves gaps that AI-generated media can exploit, especially when user experience constraints limit the time available for review.
Key questions
Q: What breaks when liveness detection is missing from onboarding flows?
A: Without liveness detection, replay attacks and synthetic media can pass as legitimate identity evidence. That can lead to fraudulent account creation, recovery abuse, and later privilege misuse. The failure is not only technical detection; it is a broken assurance boundary between what is shown and what is actually present.
Q: What fails when synthetic identity fraud gets past onboarding?
A: The core failure is that the system has already accepted a fabricated person as real, so every downstream control starts from a false identity. Behavioural monitoring, credit checks, and complaint-based detection become weak because there is no real victim to surface the fraud. The right response is to strengthen proofing before account creation, especially where access or financial value can be built over time.
A: Security teams should treat verification as a risk-balancing exercise, not a single optimization for speed or conversion. The right approach uses layered checks, risk-based decisioning, and clear escalation paths for higher-risk users or transactions. That reduces fraud exposure while keeping legitimate users moving. The goal is to align controls with regulatory obligations and business tolerance for friction.
Q: Should organisations use the same controls for face spoofing and document fraud?
A: No. Face spoofing and document fraud attack different evidence types, so they need different detection methods that work together. Liveness or face analysis can help with presentation attacks, while document forensics targets synthetic IDs and visual tampering. Treating them as the same problem leaves a blind spot in the onboarding decision.
Technical breakdown
Why liveness detection is not enough for onboarding verification
Liveness detection answers whether a real person is present, but it does not prove that the submitted media is genuine. A face can be live while the image, video, or document stream is synthetic, replayed, or injected. That is why the article separates live presence from deepfake detection: the first checks physical presence, the second checks media authenticity. In practice, a verification flow that stops at liveness can still approve an AI-generated face swap or a fake document that looks convincing enough for human review. Practical implication: treat liveness as one layer in identity proofing, not as the complete control.
Practical implication: pair liveness with media authenticity checks so a live session does not become a false pass.
How injection attacks bypass the camera itself
Injection attacks do not try to fool the camera image alone. Instead, they feed manipulated video into the verification pipeline through a virtual camera or similar software path, which means the system may see a plausible feed while the real device camera is never used. Detecting that pattern requires device signals, stream integrity checks, and metadata analysis, not just face classification. This is a control problem because the trust boundary sits below the image layer. If the pipeline cannot distinguish native camera input from injected content, then even strong face analysis can be bypassed upstream. Practical implication: verify the capture path as well as the pixels.
Practical implication: validate capture integrity so injected video cannot masquerade as a live camera feed.
Why synthetic documents need separate forensic analysis
Synthetic document fraud is different from face spoofing because the attack target is the identity evidence itself. AI-generated IDs can pass visual inspection while still containing subtle artifacts in edge treatment, texture, compression, and frequency patterns. That is why document forensics uses signal analysis that is invisible to the human eye. The article also implies that document checks and biometric checks must be coordinated, because a strong face match does not compensate for a fabricated ID image. A verification stack that lacks document forensics is only seeing part of the onboarding evidence. Practical implication: inspect both the biometric and documentary layers before making an approval decision.
Practical implication: use document forensics alongside biometric checks so fabricated IDs are not accepted on visual resemblance alone.
Threat narrative
Attacker objective: The attacker’s objective is to create or validate fraudulent identities that can pass onboarding and be used for account abuse, fraud, or access to regulated services.
- Entry occurs through digital onboarding flows where fraudsters submit synthetic faces, replayed video, or AI-generated documents to a verification system.
- Credentialed access is not the issue here; the attacker’s advantage comes from passing the proofing step and establishing a false identity record.
- Escalation happens when coordinated multi-step campaigns probe thresholds, learn which checks fail, and scale the working method across many submissions.
- Impact is fraudulent account creation, identity compromise, and downstream abuse of the onboarding trust chain at industrial scale.
Breaches seen in the wild
- Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Deepfake detection is now an identity proofing control, not a media novelty. The article shows that onboarding fraud has shifted from crude document tampering to synthetic faces, injected video, and fabricated documents. That means identity teams are no longer defending a single matching step, they are defending the authenticity of evidence itself. The implication is that proofing architectures must be designed for adversarial media, not ordinary verification.
Single-point biometric controls create a false sense of coverage. Liveness, document forensics, and behavioural analysis each address different parts of the attack surface, and the article makes clear that no one method closes the whole gap. This is the same pattern we see in mature identity programmes: one control catches one failure mode, but attackers chain the blind spots. Practitioners should expect layered fraud, not isolated spoofing attempts.
Speed has become part of the trust decision. Real-time onboarding changes the control envelope because a check that takes too long becomes operationally unusable, while a check that is too shallow becomes fraud prone. That tension is now central to identity verification design. The practical conclusion is that teams need controls that preserve both throughput and evidentiary quality, rather than treating friction as the only cost metric.
Deepfake fraud exposes a new trust operations problem. The article’s Gartner reference points to dedicated trust operations emerging because fraud is no longer limited to manual review or static policy enforcement. The governance question is whether identity proofing can adapt as quickly as generation tools do. Practitioners should treat this as an operating model issue, not just a tool-selection issue.
Identity assurance now depends on adversarial evidence handling. Once fraudsters can industrialise synthetic identity creation, the assurance model has to assume the presented evidence may be deliberately constructed to evade human judgement. That is a change in baseline governance, not a niche fraud exception. Teams should therefore elevate forensic verification, auditability, and response criteria alongside enrollment policy.
From our research library:
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Deepfake-onboarding convergence: The control boundary has moved from identity presentation to evidence authenticity, which means proofing programmes must now assume adversarial media by default. That shifts investment toward document forensics, injection detection, and decision logging, not just biometric matching.
When onboarding is measured in seconds, the verification stack has to make a defensible decision fast enough for real users while still resisting synthetic media. Practitioners should expect fraud controls to be judged on both detection quality and operational latency.
The most important programme change is to stop treating deepfake detection as an add-on feature. In practice, it is part of identity assurance architecture, because synthetic media now attacks the trust chain before an account ever exists.
For practitioners
- Layer media-authenticity checks Add document forensics, liveness, and behavioural signal analysis into the same onboarding decision path so one failed layer does not end the review.
- Validate the capture path Test for virtual camera injection, replayable streams, and metadata inconsistencies before trusting webcam input in mobile and web onboarding.
- Tune for real-time onboarding Set latency thresholds that fit your user journey, then verify the verification stack still detects synthetic media within those limits.
- Preserve forensic evidence Keep decision logs, flagged artifacts, and approval rationale so fraud teams can review why a submission passed or failed.
Key takeaways
- Deepfakes are no longer a peripheral fraud issue, they now target the trust decisions inside digital onboarding and identity verification.
- Effective defence depends on layered checks that combine liveness, document forensics, and behavioural analysis rather than a single biometric signal.
- The practical test is whether your onboarding stack can detect synthetic media quickly enough to preserve user experience without lowering assurance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article centers on identity proofing and onboarding assurance. |
| Recommendation — Strengthen enrollment evidence requirements before issuing any account or service relationship. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Proofing outcomes determine whether an identity should be authorized at all. |
| Recommendation — Tie onboarding assurance levels to authorization decisions and reject weak proofing paths. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Injected video and trust-boundary bypasses often exploit weak integration settings. |
| Recommendation — Review verification integrations for misconfigurations that allow untrusted streams to bypass controls. | ||
| MITRE ATT&CK | TA0001;TA0006 — Initial Access; Credential Access | Fraudsters use synthetic identities to gain initial access and establish fraudulent accounts. |
| Recommendation — Map synthetic onboarding abuse to initial access patterns and watch for repeated credential-enablement attempts. | ||
Key terms
- Forensic Deepfake Detection: Forensic deepfake detection is the process of analysing media for signs of manipulation in a way that can support an evidentiary decision. It relies on repeatable methods, measurable signals, and clear reporting so experts can explain how a conclusion was reached. In legal contexts, transparency matters as much as accuracy.
- Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
- Injection attack: An attack that inserts synthetic or manipulated data directly into the verification flow rather than fooling the sensor itself. For identity programmes, this is a control-path problem, because the attacker may bypass the visible presentation layer and exploit the software decision point.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org