Deepfake fraud is forcing stronger liveness checks at onboarding

At a glance

What this is: This is an analysis of how deepfake fraud is changing onboarding security, with liveness detection positioned as the core check against replayed, recycled, or manipulated facial presentations.

Why it matters: It matters because identity teams responsible for onboarding, fraud controls, and KYC need to verify presence and authenticity at capture time, not assume a face image or video proves the person is real.

By the numbers:

• The Wall Street Journal reported that companies lost over $200 million to deepfake scams in the first quarter of 2025.

Context

Deepfake fraud is now an onboarding and identity assurance problem, not just a media authenticity problem. When an attacker can present synthetic face video, replayed footage, or manipulated biometrics, the control failure is that presence was assumed rather than verified.

The article argues that liveness detection addresses this gap by checking that a face is captured in real time and not from a pre-recorded or altered source. For identity and fraud teams, the issue is whether onboarding can still distinguish a live claimant from a convincing impersonation at the point of enrolment.

Key questions

Q: What breaks when banks rely on face matching without liveness detection?

A: Face matching alone breaks when an attacker can inject a replayed, synthetic, or manipulated video stream into the app. The control may still see a plausible face, but it has no trustworthy evidence that the person is live or that the capture path was untampered. That creates a false sense of assurance in onboarding and payment approval.

Q: Why do deepfakes and AI-enabled fraud create new pressure on KYC and AML programmes?

A: Deepfakes raise the chance that organisations will trust fabricated identities, manipulated documents, or impersonation during onboarding and support interactions. That creates gaps in KYC and AML controls if verification is only point-in-time. Teams need layered checks, behavioural signals, and stronger exception handling to detect anomalies, especially where fraud risk increases during periods of rapid digital growth or regulatory tightening.

Q: What are the signs that onboarding anti-spoofing controls are not working?

A: A weak control often shows up as repeatable success against the same capture flow, failed detection of replayed media, or fraud cases where a claimant passed facial verification but later proved false. Those signals mean the system is checking similarity more effectively than authenticity.

Q: How should businesses detect deepfake fraud in remote onboarding and authentication flows?

A: Businesses should combine liveness checks, AI-based anomaly detection, and step-up verification for high-risk actions. Deepfakes are designed to defeat human judgment, so controls must look for manipulated image artifacts, duplicate identities, and suspicious behavioral patterns. The most effective approach is layered: verify identity, validate session risk, and require stronger checks when confidence drops or the transaction is unusually sensitive.

Technical breakdown

Why liveness detection matters at onboarding

Liveness detection is a facial anti-spoofing control that checks whether the person presenting to the camera is physically present in real time. It uses motion cues, contextual analysis, and biometric signals to distinguish a live capture from a replay, a recycled clip, or a synthetic face presentation. In onboarding, this matters because the attacker’s objective is not only to look plausible but to pass the capture step with evidence that later appears trustworthy. The article’s central point is that traditional image matching alone cannot prove presence. Practical implication: treat liveness as a capture-time control, not a downstream review control.

Practical implication: Move liveness checks into the first trust decision, before identity proofing can proceed.

How deepfakes fit into fraud-as-a-service

The article places deepfakes inside a broader fraud-as-a-service economy, where criminals can buy tools, rent capabilities, and industrialise impersonation. That model lowers the skill barrier and increases attack volume, which means onboarding teams face more attempts by more actors with better tooling. The important technical shift is that fraud has become scalable and operationally repeatable, rather than dependent on one-off manual deception. That makes human visual judgment unreliable at the front door. Practical implication: design onboarding controls for repeatable machine-assisted fraud, not isolated social-engineering events.

Practical implication: Assume deepfake attempts will scale and use automated controls rather than manual screening alone.

What automated anti-spoofing has to detect

A liveness system has to identify whether a capture is genuine, manipulated, or replayed, and whether the face matches the submitted identity evidence. The article highlights multi-layered analysis combining machine learning, motion cues, and contextual signals to detect advanced spoofing methods, including silicone or 3D masks. That is different from simple face match scoring, which answers whether two images resemble each other but not whether the source is authentic. Practical implication: require both authenticity checks and identity match checks in the same onboarding flow.

Practical implication: Use both live-presentation testing and identity matching, because either one alone leaves a gap.

Threat narrative

Attacker objective: The attacker’s objective is to get a fraudulent identity accepted during onboarding so the resulting account or relationship can be used for fraud.

1. Entry occurs when an attacker presents a synthetic or manipulated face during digital onboarding, using deepfake video or replayed imagery to reach the trust boundary.
2. Credential or identity evidence is harvested when the fraudulent presentation is accepted as a genuine claimant and is bound to an account or customer record.
3. Impact follows when the impersonated identity is onboarded, enabling account abuse, fraud, or other downstream misuse tied to the trusted record.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Liveness is becoming a front-door trust control, not a narrow biometric feature. The article shows that onboarding is where synthetic identity, replay attack, and impersonation risk now concentrate. When deepfakes can convincingly simulate presence, the real control question is whether the claimant was live at capture time. Practitioners should treat liveness as part of identity assurance, not as an optional user-experience layer.

Deepfake fraud has industrialised onboarding deception. The article’s fraud-as-a-service framing matters because it changes the threat model from isolated spoofing to repeatable, rentable abuse. That means the defender is no longer dealing only with human deception skills but with scalable tooling and automation. The practical conclusion is that onboarding controls must assume volume, variation, and persistence in the attack pattern.

Presence, not resemblance, is the governing concept for digital onboarding. Face similarity alone does not answer whether the capture happened in real time, on a live subject, and without replay or manipulation. That distinction is central to identity fraud prevention because an onboarding decision made on likeness alone creates a trust record that is already corrupted. Practitioners should redesign verification around proof of presence as the decisive gate.

Deepfake loss data is a governance signal, not just a fraud metric. The scale cited in the article indicates that weak onboarding assurance is no longer a niche control issue. It now affects fraud, customer trust, and operational exposure at the programme level. The governance implication is clear: liveness and onboarding assurance belong in identity risk oversight, not only in product configuration discussions.

From our research library:

• Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.

What this signals

Proof of presence is becoming the decisive control in identity onboarding. As synthetic media improves, programmes that still rely on static resemblance or document capture alone will keep accepting false positives. The operational shift is toward controls that verify the claimant is live at the moment of capture, not merely visually plausible.

Deepfake fraud forces identity teams to think like fraud operators, not just verification designers. The article makes clear that attackers can industrialise deception through repeatable tooling and marketplaces. That means onboarding governance needs test cases, detection thresholds, and escalation paths that assume scalable impersonation attempts rather than one-off abuse.

For practitioners

• Strengthen proof-of-presence at the first capture Require liveness verification before any onboarding decision can bind a face to a customer record, account, or credential set.
• Test replay and synthetic-media failure modes Include replayed video, manipulated imagery, and 3D mask scenarios in onboarding assurance testing so the control is evaluated against the fraud patterns described in the article.
• Separate face match from authenticity checks Do not treat successful facial similarity as evidence of live capture; require a distinct control that verifies the image was captured in real time.
• Escalate fraud review on high-risk onboarding paths Apply stronger review or step-up verification to onboarding flows that handle money movement, financial services access, or other high-value identity binding.
• Update fraud metrics to track synthetic attempts Measure rejected deepfake or replay attempts alongside successful onboarding outcomes so governance teams can see whether the control is absorbing the actual attack pattern.

Key takeaways

• Deepfake fraud now targets the onboarding decision itself, where a live claimant can be mistaken for a legitimate customer or user.
• The article ties the threat to both rapid growth in attempts and major financial losses, showing that this is a scaled identity problem rather than an edge case.
• Liveness checks matter because they verify presence at capture time, which is the control point that can prevent a synthetic or replayed identity from being accepted.

Key terms

• Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
• Deepfake-Enabled Fraud: Deepfake-enabled fraud uses synthetic media, voice, or face manipulation to impersonate real people and bypass weak verification steps. It raises the bar for identity and fraud teams because traditional checks may not reliably detect fabricated presence, especially in high-volume digital onboarding and support channels.
• Proof of Presence: A verification approach that aims to establish that a real person is actively participating at the moment of authentication. It goes beyond matching a stored trait and instead looks for live, context-specific evidence that resists replay, cloning, and remote fabrication.
• Facial Anti-Spoofing: Facial anti-spoofing is the set of techniques used to detect whether a facial capture is genuine or a fake presentation such as a replay, mask, or synthetic image. It is a control layer for onboarding and verification systems that depend on face-based identity assurance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.