Identity verification in iGaming is colliding with AI fraud

At a glance

What this is: This report examines how AI fraud is changing iGaming identity verification, with SumSub highlighting doubled fraud, a Brazil deepfake surge, and verification dropout risk.

Why it matters: It matters because iGaming teams have to balance onboarding friction, fraud resistance, and compliance while AI-enabled deception makes identity proofing less reliable.

By the numbers:

• Up to 30% of players could skip full verification, according to SumSub.

Context

iGaming identity verification is not just a compliance checkpoint. It is the control point where regulated access, fraud prevention, and player experience collide, and AI-generated impersonation makes that collision harder to manage.

The core problem is that verification flows were built for earlier fraud patterns. Deepfakes, synthetic identities, and high-volume attack campaigns now try to break trust at enrollment, step-up checks, and recovery paths, where hesitation or friction can become a security weakness.

For iGaming operators, this is a governance problem as much as a fraud problem. The question is whether identity proofing, risk scoring, and escalation rules can absorb AI-assisted deception without creating blind spots or driving legitimate users away.

Key questions

Q: What breaks when AI deepfakes enter iGaming verification flows?

A: What breaks is the assumption that identity proofing can reliably separate real users from synthetic ones at onboarding. Once a forged identity passes, downstream controls inherit false trust, which can lead to bonus abuse, payment fraud, and compliance exposure before the issue is detected.

Q: Why do synthetic identities create a compliance risk for regulated gaming platforms?

A: Synthetic identities can pass weak onboarding checks and then use trusted access to commit fraud or evade monitoring. In regulated gaming, that creates both financial loss and regulatory exposure because the operator has admitted a user whose identity was never properly assured.

Q: What are the signs that AI fraud controls are failing?

A: Weak controls usually show up as rising scam volume, more difficult-to-spot fraudulent content, higher account takeover rates, and customers abandoning the brand after suspicious interactions. Another warning sign is overreliance on rigid rules that create false positives while missing adaptive attacks. If fraud teams cannot distinguish trusted behavior from AI-assisted manipulation, the detection model is not keeping pace.

Q: What should operators do when fraud and user friction conflict?

A: Operators should treat verification design as a risk decision, not a conversion exercise. The goal is to place stronger controls where deception is most likely, while keeping low-risk users moving through the flow without unnecessary delay. That requires risk-based escalation, not one static onboarding path.

Technical breakdown

Why deepfakes stress iGaming identity proofing

Deepfakes work by making a person appear credible at the point where identity evidence is being checked, often through video, selfie, or document-based flows. In iGaming, that matters because onboarding decisions are made quickly and often under pressure to keep conversion rates high. When synthetic faces, forged documents, or manipulated liveness checks look convincing enough, the control no longer validates identity. It validates the attacker’s ability to mimic the expected pattern. The failure is not just at one step. It can cascade into account opening, bonus abuse, mule activity, or payment fraud if the initial proofing decision is wrong.

Practical implication: Treat proofing failures as access decisions, not just fraud events, and tighten step-up checks where impersonation risk is highest.

Synthetic identities and the verification trust model

Synthetic identity fraud combines real and fabricated attributes to create an identity profile that can pass superficial checks. That makes it harder than simple credential theft because the record may look internally consistent even when the person behind it is not real or not entitled to access. In regulated gaming, that can undermine KYC-style checks, age verification, sanctions screening, and bonus controls at the same time. The deeper issue is trust inheritance: once one weak identity signal is accepted, downstream systems often treat the account as legitimate. That creates an abuse path that is difficult to unwind after registration.

Practical implication: Correlate onboarding evidence across documents, device, payment, and behavioural signals before granting account trust.

Why verification friction becomes a governance issue

Verification friction is not only a user-experience problem. In high-volume consumer identity flows, too much friction can increase abandonment, but too little can widen exposure to fraud and compliance failure. That trade-off becomes sharper in iGaming because operators must prove they are verifying users effectively while still sustaining acquisition and retention. AI fraud changes the boundary conditions: attackers can scale faster, adapt faster, and probe weak points in a way static rules struggle to absorb. The result is that verification policy has to be governed as a dynamic risk control, not a fixed onboarding script.

Practical implication: Recalibrate escalation thresholds and manual review triggers as risk controls, not just conversion levers.

Threat narrative

Attacker objective: The attacker wants to create a trusted player account that can be monetised for fraud, abuse, or laundering while appearing legitimate to the operator.

1. Entry begins when fraudsters use AI-powered deepfakes or synthetic identities to enter player onboarding and verification flows.
2. Credential and identity evidence is harvested or fabricated through manipulated selfies, documents, or video interactions that satisfy weak proofing checks.
3. Escalation follows when the fraudulent account is accepted as genuine and can proceed into deposits, bonuses, or regulated gameplay.
4. Impact is realised through fraud loss, compliance exposure, and higher false acceptance rates that weaken the trust model for future onboarding.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI fraud is collapsing the assumption that identity proofing can reliably distinguish real from synthetic applicants at onboarding. That assumption was built for a slower fraud environment where human review and static checks had time to work. SumSub’s report shows the problem is now adversarial and adaptive, so the verification model itself becomes part of the attack surface. Practitioners need to treat proofing as a continuously contested trust decision, not a one-time gate.

In iGaming, verification failure is both a fraud problem and an access-governance problem. Once a player is admitted on the basis of deceptive evidence, downstream controls inherit that false trust. That is why onboarding, bonus eligibility, and account recovery cannot be governed as separate silos. The important question is whether the trust established at entry is defensible enough to support later decisions.

Deepfake pressure creates a new governance concept: verification latency. This is the time gap between a synthetic identity passing checks and the organisation detecting that the trust decision was wrong. The longer that latency, the more time the attacker has to monetise the account, abuse incentives, or pass through linked controls. In practice, the control objective shifts from perfect detection to reducing how long a bad identity can remain trusted.

Fraud controls in regulated gaming now have to be measured against adversarial adaptability, not just false-positive rates. A system that blocks too many legitimate players can be just as operationally damaging as one that misses synthetic identities. The field needs to move from fixed verification pathways to governed escalation logic that can absorb new fraud patterns quickly. Practitioners should review whether their current risk model can keep pace with AI-enabled deception.

Brazil’s deepfake pressure is a regional warning, not an isolated anomaly. When a market experiences concentrated attack activity, it often exposes gaps in proofing logic, document handling, and manual exception handling that exist elsewhere but have not yet been exploited at the same scale. The lesson for the wider sector is that identity fraud is now a dynamic governance problem, and regional spikes can become global control gaps if they are ignored.

What this signals

Verification latency is the metric most teams are not tracking. If a synthetic identity can pass checks and remain trusted long enough to monetise an account, the control has already failed in operational terms. Teams should measure how quickly suspicious profiles are downgraded, not only how often they are blocked.

The practical lesson for iGaming is that identity assurance must be adaptive, not procedural. Static onboarding rules cannot absorb fast-changing fraud patterns when attackers can generate convincing evidence on demand.

For practitioners

• Tighten step-up verification at high-risk decision points Apply stronger challenge logic when an applicant changes device, jurisdiction, payment method, or identity evidence mid-flow. Use step-up verification to catch synthetic identities before they become trusted accounts.
• Correlate onboarding signals before trust is granted Combine document, device, payment, and behavioural data before the account is marked low risk. Single-signal approval is too easy for deepfake and synthetic identity attacks to exploit.
• Tune manual review for fraud-adaptive cases Reserve analyst time for edge cases where AI fraud is likely to defeat automation, including repeat attempts, inconsistent liveness results, and conflicting identity evidence.
• Measure verification latency as a risk metric Track how long suspicious accounts remain trusted before detection or intervention. That measure shows whether the verification programme is reacting quickly enough to adversarial fraud.

Key takeaways

• AI-enabled fraud is pushing iGaming identity verification beyond static proofing and into continuous trust management.
• The main risk is not just higher fraud volume but false acceptance, where synthetic identities become trusted accounts.
• Operators need adaptive escalation, stronger signal correlation, and faster downgrade paths to keep verification meaningful.

Key terms

• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• Deepfake-Enabled Fraud: Deepfake-enabled fraud uses synthetic media, voice, or face manipulation to impersonate real people and bypass weak verification steps. It raises the bar for identity and fraud teams because traditional checks may not reliably detect fabricated presence, especially in high-volume digital onboarding and support channels.
• Verification latency: The time between a claimed fix and independent confirmation that the exposure is actually gone. Long verification latency creates a false sense of closure and extends the period in which teams may think risk has been removed when it has not.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.