TL;DR: Deepfakes are making it easier to impersonate real people during digital onboarding, and Prove Identity says selfie-based checks and liveness detection are increasingly poor fits for that fraud pattern. The assumption that visual identity signals remain trustworthy at onboarding is collapsing, so verification has to shift to stronger possession and network signals.
At a glance
What this is: This is a deepfake and onboarding-fraud analysis arguing that visual verification is no longer a reliable control for digital identity proofing.
Why it matters: It matters because IAM, fraud, and customer onboarding teams need verification methods that resist synthetic media without creating more friction for legitimate users.
By the numbers:
- 66% of cybersecurity professionals reported encountering deepfake attacks within their organizations in a 2023 study cited by Prove Identity.
- 92% of finance security leaders expressed deep concern about the impact of deepfakes.
- Deepfake-related fraud cases surged 10 times globally between 2022 and 2023, according to Sumsub research cited by Prove Identity.
- North America experienced a 1740% increase in deepfake fraud.
Context
Deepfake-enabled onboarding fraud is what happens when synthetic audio, video, or images are used to pass identity checks that were designed around human visual trust signals. The problem is not just fraud volume, but the mismatch between fast customer acquisition workflows and the identity assurance needed to stop impersonation.
Prove Identity frames this as a collision between frictionless onboarding and a fraud technique that is specifically built to defeat selfie and liveness-based verification. For identity teams, the question is no longer whether deepfakes exist, but whether the current proofing model still assumes visual signals are reliable enough to establish trust.
That assumption is increasingly fragile across consumer IAM, fraud operations, and digital onboarding programmes. The article argues that verification has to move toward stronger possession and behavioural evidence rather than over-relying on images or video alone.
Key questions
Q: What breaks when remote onboarding still relies on document and selfie checks?
A: The control breaks when the verification path assumes visible evidence is enough to prove identity. Deepfakes, forged documents, and injection attacks can all satisfy a weak front-end check while a fraudulent customer still enters the KYC perimeter. The failure is not onboarding itself, but the trust model behind it.
Q: Why do AI-generated fake IDs and deepfakes create such a sharp fraud risk in digital onboarding?
A: AI-generated documents and biometric spoofing reduce the quality gap that traditional verification once depended on. When attackers can create realistic passports, IDs, faces, and supporting data at scale, basic KYC controls may accept fraudulent identities as legitimate. The risk is highest where onboarding is fast, review is shallow, and verification is not tuned to detect synthetic patterns across documents, devices, and user behaviour.
Q: How can security teams tell whether onboarding verification is too easy to spoof?
A: Look for controls that accept visual evidence without requiring device-linked or network-linked corroboration, especially in high-risk journeys. If an attacker can pass the flow with only a synthetic face or voice, the assurance model is too shallow for current fraud conditions.
Q: Should organisations move from selfie-based onboarding to phone-centric verification?
A: For higher-risk onboarding, yes, because phone-centric verification ties trust to device possession and stronger contextual signals rather than to a fabricated image. The right design is usually risk-based, where stronger evidence is required only when the exposure justifies it.
Technical breakdown
Why deepfake onboarding fraud defeats selfie-based proofing
Selfie-based proofing assumes that a live camera image, video, or voice sample provides a trustworthy signal of personhood. Deepfakes break that assumption by generating content that looks and sounds plausible enough to satisfy weak or overfitted checks. Liveness detection helps against simple replay attacks, but it is not a complete identity proofing model when synthetic media can be created at scale and tailored to the target. The core technical failure is that a presentation check is being treated as an identity assertion. Practical implication: move away from visual-only proofing paths for high-risk onboarding flows.
Practical implication: redesign onboarding so visual signals are supplementary, not the primary proof of identity.
Phone-centric verification as a possession-based control
Phone-centric verification shifts the trust anchor from appearance to device possession and telemetry. Instead of asking whether a face or voice looks real, the control evaluates whether the claimant controls a known device, can produce network-linked signals, and behaves consistently across sessions. That makes impersonation harder because the attacker has to reproduce several correlated signals, not just synthetic media. This is closer to identity proofing than image matching because it binds the onboarding event to a device and communication path. Practical implication: use possession-based signals as a stronger gate for digital onboarding decisions.
Practical implication: require device-linked evidence for higher-risk registrations and account openings.
Why user experience and fraud resistance must be designed together
Deepfake fraud forces a trade-off that is usually handled poorly: teams either add friction everywhere or rely on weak controls to preserve conversion. The better design pattern is to concentrate stronger checks only where risk justifies them and eliminate target points that attackers can easily imitate. That means reducing dependence on static visual cues and using layered evidence that is harder to fabricate in real time. For IAM and fraud teams, the technical goal is not simply to detect deepfakes after the fact, but to remove the easiest impersonation path from the onboarding flow. Practical implication: treat onboarding design as a fraud-control architecture problem, not a UX-only problem.
Practical implication: place stronger controls at the exact steps attackers can most easily spoof.
Threat narrative
Attacker objective: The attacker wants to pass identity proofing, create trust in a false persona, and use that trust to open accounts, move money, or enable downstream fraud.
- Entry occurs when an attacker uses synthetic audio, video, or images to impersonate a legitimate applicant during onboarding or a high-trust interaction.
- Credential or account creation is enabled when selfie and liveness checks accept the fabricated presentation as authentic, allowing the fraudster to pass proofing.
- Impact follows when the false identity gains access to financial transfers, accounts, or other trusted workflows that depend on onboarding assurance.
Breaches seen in the wild
- Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Visual trust has become an identity assumption, not an identity control: Selfie and video-based onboarding only work when the presentation layer remains a dependable proxy for personhood. Deepfakes break that proxy by manufacturing believable evidence on demand. The result is not just more fraud, but a collapse in the assumption that appearance can carry proofing decisions, which forces identity programmes to re-centre assurance on stronger signals.
Deepfake onboarding fraud exposes an assurance gap between speed and confidence: Frictionless acquisition workflows were built to minimise user drop-off, not to withstand synthetic media crafted for impersonation. That gap is now operational, not theoretical, because attackers can target the exact steps designed to maximise conversion. Practitioners should treat onboarding assurance as a governed risk boundary, not a UX compromise.
Phone-linked evidence creates a more defensible trust anchor than presentation cues alone: Device possession, network context, and behavioural consistency are harder to forge than a face or voice sample. This does not eliminate fraud, but it changes the burden on the attacker from one synthetic asset to multiple correlated trust signals. The practical conclusion is that identity proofing should privilege evidence that is bound to a device and session, not a visual likeness.
Deepfake fraud is forcing identity teams to separate proofing from presentation: Many onboarding programmes still assume that what the user shows is enough to establish who the user is. That assumption now fails under adversarial conditions because presentation can be fabricated faster than manual review can respond. The implication for practitioners is to redesign onboarding around verifiable possession and risk-based step-up controls, not around image confidence alone.
From our research library:
- Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
What this signals
Deepfake onboarding risk changes the trust model for identity teams: Fraudsters no longer need to defeat a human reviewer if the control stack still treats visual evidence as decisive. Programmes should assume that synthetic media will reach the proofing edge and design for corroboration, not recognition.
Identity proofing should be reweighted toward possession and context: The practical shift is away from asking whether a face looks real and toward asking whether the claimant controls a trusted device and consistent session context. That makes onboarding less vulnerable to presentation attacks without turning every journey into a manual review.
Deepfake fraud is a governance problem as much as a detection problem: Teams need to decide which onboarding paths can tolerate weaker evidence and which ones require stronger proof before trust is extended. That decision belongs in IAM and fraud policy, not only in product design.
For practitioners
- Replace visual-only proofing for high-risk onboarding Remove self-attested selfies and standalone liveness checks as decisive controls in flows where account opening or funds movement is high impact. Keep them, if at all, only as secondary signals inside a broader risk decision.
- Bind onboarding to device possession Use device-linked evidence, such as registered phone ownership and network signals, to anchor identity assurance before granting trust.
- Add step-up checks for risky claims Trigger stronger verification when onboarding details, behavioural signals, or transaction intent do not align with prior trust history or expected patterns.
- Map fraud paths through onboarding workflows Identify the exact screens and checks that an impersonator would target first, then redesign those steps so a single synthetic media asset cannot satisfy the control.
Key takeaways
- Deepfake-enabled onboarding attacks exploit the gap between fast digital acquisition and the level of assurance needed to prevent impersonation.
- The article cites a 2023 study in which 66% of cybersecurity professionals reported encountering deepfake attacks, underscoring how widespread the problem has become.
- Organisations should stop treating selfies and liveness checks as decisive proof and shift higher-risk onboarding to device-linked and risk-based verification.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Selfie and liveness-based onboarding can be bypassed by synthetic media that impersonates a legitimate user. |
| NHI-10 — Human Use of NHI | The article focuses on human onboarding flows where identity assurance depends on proofing people, not workloads. | |
| Recommendation — Treat visual-only onboarding as insecure authentication and require stronger corroborating evidence before trust is granted. Reassess onboarding journeys where humans are proving identity through controls that attackers can spoof with deepfakes. | ||
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article is fundamentally about enrollment assurance and the weakness of visual proofing signals. |
| Recommendation — Apply identity proofing requirements that bind enrollment decisions to stronger evidence than a single visual presentation. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Customer onboarding is an external-user authentication and proofing problem. |
| Recommendation — Use external-user identification and authentication controls that do not rely on easily fabricated presentation cues. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Onboarding determines whether a new identity receives access, so assurance quality affects authorisation decisions. |
| Recommendation — Align onboarding assurance with entitlement decisions so weak proofing cannot directly grant access. | ||
Key terms
- Deepfake onboarding fraud: A fraud pattern in which synthetic audio, video, or images are used to defeat identity proofing during account opening or similar trust-establishing journeys. The goal is to create a convincing false identity that passes controls designed for legitimate users.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
- Phone-Centric Verification: Phone-centric verification uses phone possession, number reputation, and ownership signals to assess whether the person creating an account is legitimate. It is useful when speed matters because it adds a continuity signal that forms alone cannot provide.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org