TL;DR: Forrester evaluated 15 identity verification providers and highlighted deepfake detection, document verification, and government data integrations as key differentiators as synthetic fraud accelerates, according to Incode’s summary of the report. The real issue for practitioners is that identity assurance now has to hold up against AI-generated deception, not just conventional onboarding fraud.
At a glance
What this is: This is Incode’s summary of Forrester’s 2025 Identity Verification Wave, which says deepfake detection, document verification, and government data matching are central as synthetic fraud grows.
Why it matters: It matters because IAM and identity verification teams now need assurance controls that can resist AI-generated deception while still supporting onboarding and conversion.
By the numbers:
- Forrester evaluated 15 of the most significant identity verification providers in the Wave report.
- Incode says its government data integrations support deterministic verification across 42+ U.S. state DMVs and 10+ countries globally.
Context
Identity verification is no longer just an onboarding control. As synthetic media and deepfake-enabled fraud improve, the assurance problem shifts from checking a document or face once to deciding whether the claimed identity can withstand adversarial manipulation across the full verification flow.
Incode’s summary of Forrester’s Identity Verification Solutions Wave frames that shift clearly: vendors are being judged on deepfake detection, document verification, and government data integrations because those capabilities increasingly determine whether identity proofing is resilient enough for modern fraud conditions. The underlying issue is not speed alone, but trust under deception.
For IAM, KYC, and fraud teams, this is a governance problem as much as a technical one. The verification stack now has to balance user experience, false acceptance risk, and evidence quality in a landscape where AI can generate convincing impostors at scale.
Key questions
Q: What should teams do first when deepfake fraud is targeting identity verification?
A: Start with the highest-risk recovery and escalation paths, because those flows often accept weaker proof than initial login. Remove knowledge-based prompts, review call-centre scripts, and require stronger step-up checks wherever an attacker could socially engineer a support agent into resetting access.
Q: When does document verification become too weak on its own?
A: Document verification becomes too weak when the decision depends mainly on image quality or OCR output. If the process cannot confirm that the document data matches an authoritative source or a trusted secondary signal, AI-generated fraud can still pass.
Q: What are the warning signs that an IDV programme is being outpaced by fraud?
A: Warning signs include rising manual review queues, more mismatches between presented identity data and authoritative records, and increasing dependence on exception handling. Those patterns usually mean the control is validating appearances faster than it is validating trust.
Q: Should organisations prioritise deepfake detection or government data matching?
A: Organisations should prioritise both, but the balance depends on the risk model and available coverage. Deepfake detection addresses manipulated presentation, while government data matching strengthens the evidence behind the decision. The strongest programmes use both because they solve different parts of the same assurance problem.
Technical breakdown
Why deepfake detection is becoming part of identity verification
Deepfake detection is the use of models and signal analysis to identify synthetic or manipulated images, video, or voice during verification. In identity verification, that matters because the attacker is no longer limited to stolen documents or basic impersonation. The verification system has to evaluate whether the presented person, media, and supporting signals belong to the same real subject. That moves the control from simple credential checking to adversarial media assessment, where liveness, document scrutiny, and contextual signals all contribute to trust. Forrester’s emphasis on this capability reflects a wider shift in fraud patterns, not a niche feature request.
Practical implication: treat deepfake detection as an assurance layer in the IDV flow, not a standalone fraud toggle.
How document verification and OCR change the evidence model
Document verification checks whether identity documents are authentic, unaltered, and internally consistent. OCR, or optical character recognition, extracts structured data from the document so the system can compare fields against expected formats, templates, and reference sources. The control is only as strong as the evidence chain behind it. If the workflow stops at a document image, fraudsters can exploit template reuse, image editing, and document spoofing. If the workflow also checks document structure, metadata, and corroborating data sources, the verifier can detect inconsistencies that manual review would miss at scale.
Practical implication: require document verification to validate both the artifact and the data extracted from it.
Why government data integrations raise the assurance bar
Government data integrations connect an IDV workflow to authoritative records such as DMV or other state and national sources. That raises assurance because the system is no longer relying only on self-asserted evidence or a single uploaded document. Instead, it can perform deterministic matching against records that are harder to fake and easier to audit. Incode cites coverage across 42+ U.S. state DMVs and 10+ countries globally, which shows why these integrations matter for coverage and consistency. The governance question is whether the verification decision is backed by authoritative evidence or by presentation-layer confidence.
Practical implication: use authoritative data sources where available to reduce reliance on presentation-only identity checks.
Threat narrative
Attacker objective: The attacker aims to obtain accepted identity status so they can pass onboarding controls and use the resulting account or access for fraud.
- Entry occurs when a fraudster presents synthetic media or manipulated identity evidence through the verification channel.
- Credential access is attempted through forged documents, impersonated faces, or other proof artifacts that are meant to satisfy the verifier.
- Impact follows when the verifier accepts a false identity, allowing fraudulent onboarding, account creation, or downstream abuse.
Breaches seen in the wild
- iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Deepfake detection has become an identity assurance control, not a fraud add-on. Once synthetic media can convincingly mimic real users, identity verification is no longer just comparing a person to a document. The field has moved into adversarial proofing, where the verification system must test whether the evidence is human-origin, consistent, and correlated. Practitioners should treat this as a core IDV design requirement, not an optional enhancement.
Evidence quality now matters more than presentation quality. Document images, OCR output, and selfie checks each provide only partial assurance unless they are tied to authoritative data and consistency checks. That is why government data integrations matter: they reduce dependence on the user-provided artifact and increase the quality of the decision boundary. The implication for identity programmes is that verification policy must specify what counts as authoritative evidence, not just what looks credible.
Identity verification is becoming a governance problem about acceptable uncertainty. As fraudsters use AI to increase realism, organisations must decide how much residual risk they will tolerate in return for faster onboarding. That decision spans fraud, IAM, compliance, and customer operations, which means IDV is now a cross-functional control rather than a single-team workflow. Practitioners should define assurance thresholds explicitly, because vague confidence models will fail under AI-generated deception.
Deterministic verification is the named concept that best captures this shift. When identity proofing can match to authoritative government sources, the decision becomes less dependent on inference and more on verifiable records. That does not eliminate fraud, but it changes the control from subjective assessment to evidence-backed confirmation. The practical conclusion is that IDV programmes need stronger source-of-truth integration, not just better media analysis.
From our research library:
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
- Read next: Identity Proofing and KYC Guide
What this signals
Deterministic identity proofing is becoming a programme requirement. As deepfake fraud becomes more realistic, teams need to decide where their trust boundary sits: presentation-layer confidence, or evidence backed by authoritative records. That choice affects onboarding rules, exception handling, and how much manual review the programme can absorb.
Deepfake resilience should be measured at the decision layer. If fraud controls are only judged by conversion speed, they can miss the point. The better test is whether the identity programme can still reject synthetic applicants when media quality is high and supporting artifacts are designed to look credible.
For identity teams, the practical shift is from screening to corroboration. Verification flows that depend on one signal will be too brittle as AI-generated deception improves. The programme response is to make authoritative source checks, evidence correlation, and escalation logic part of standard IDV design.
For practitioners
- Tighten verification policy for synthetic media Define which checks must be present before an identity is accepted, including liveness, deepfake detection, document validation, and authoritative record matching.
- Separate evidence quality from user experience metrics Track false acceptances, manual review overrides, and document mismatch rates alongside conversion so fraud risk is visible in the same programme.
- Prioritise authoritative source integrations Where jurisdiction and coverage allow, connect IDV decisions to DMV or equivalent records instead of relying only on uploaded documents and selfies.
- Revisit step-up checks for higher-risk flows Use stronger verification thresholds for account creation, recovery, and payout-related journeys where deepfake fraud creates the highest downstream loss.
Key takeaways
- Deepfake-enabled fraud changes identity verification from simple onboarding validation into adversarial trust evaluation.
- Forrester’s 2025 Wave assessed 15 identity verification providers, which shows how central these capabilities have become to the market conversation.
- Teams should strengthen evidence quality by combining deepfake detection, document verification, and authoritative record matching in the same decision flow.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Identity verification here is about resisting manipulated proof during authentication and onboarding. |
| NHI-02 — Secret Leakage | The article’s fraud context overlaps with exposed identity evidence and reuse of weak proof artifacts. | |
| Recommendation — Strengthen verification flows to resist manipulated identity evidence and synthetic presentation attacks. Reduce reliance on reusable proof artifacts and revoke any exposed identity evidence promptly. | ||
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article is fundamentally about identity proofing quality during onboarding and verification. |
| Recommendation — Apply identity proofing requirements to raise assurance before accounts are issued. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Consumer and external-user verification is central to the article’s IDV discussion. |
| Recommendation — Use IA-8 to govern external-user identity verification and authentication assurance. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity verification affects whether access is granted to the right party. |
| Recommendation — Tie identity assurance to permission issuance so verified identity gates access decisions. | ||
Key terms
- Forensic Deepfake Detection: Forensic deepfake detection is the process of analysing media for signs of manipulation in a way that can support an evidentiary decision. It relies on repeatable methods, measurable signals, and clear reporting so experts can explain how a conclusion was reached. In legal contexts, transparency matters as much as accuracy.
- Identity verification: Identity verification is the process of confirming that a user, workload, or agent is the entity it claims to be before access is granted. In AI-heavy environments, that verification must include the requester, the system acting on its behalf, and the sensitivity of the action.
- Document Verification: Document verification is the process of checking whether an identity document is genuine, valid, and appropriate for the claimed user. In digital onboarding, it often combines template analysis, authenticity checks, and data extraction to support a trust decision before account creation.
- Deterministic Verification: A verification method that produces the same enforced result every time when the required proof is present, instead of relying on human judgement or probabilistic signals. It is useful for high-blast-radius access changes because it removes discretion from the decision point.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org