Jailbroken devices are amplifying deepfake fraud in identity checks

At a glance

What this is: This is an Incode analysis of how jailbroken iPhones and rooted Android devices are being used to support deepfake fraud during identity verification.

Why it matters: It matters because identity teams can no longer treat device trust and biometric liveness as separate controls when fraudsters can subvert both in the same session.

Context

Identity verification fails when the programme assumes the device environment is trustworthy while also assuming the camera feed reflects a live person. Incode's article argues that jailbreaking and rooting break both assumptions, because the attacker controls the device state and the video input at the same time.

For IAM and fraud teams, the problem is not just biometric spoofing. It is the combination of device tampering, synthetic media, and session-level deception that turns a normal onboarding flow into a fraud path. That makes multi-signal analysis a governance issue, not only a detection issue.

Key questions

Q: What fails when identity checks trust a jailbroken or rooted device?

A: The failure is that the device can no longer be treated as an honest source of trust signals. A compromised endpoint can spoof location, hide tampering, and support injected camera feeds, so the verification outcome reflects attacker-controlled telemetry instead of genuine device state.

Q: Why does deepfake fraud become more effective on tampered phones?

A: Tampered phones let fraudsters control both the presentation layer and parts of the device environment. That combination makes it easier to substitute synthetic video, disguise spoofing, and run repeated attempts until one onboarding flow passes.

Q: How can identity teams tell whether liveness checks are actually working?

A: Look for adversarial cases that still pass when motion is synthetic, partial, or replayed from a static image. Effective programmes test whether liveness outcomes remain stable when the same applicant reappears with different devices, names, or document data. If the control only succeeds in clean test conditions, it is not robust against fraud reuse.

Q: Should organisations block onboarding when device and camera signals conflict?

A: Yes. Conflicting signals usually mean the session cannot be trusted as a whole, even if one check passes. The right response is to pause automation, route the case for review, and require stronger evidence before account creation proceeds.

Technical breakdown

How jailbroken devices bypass identity verification signals

Jailbreaking on iPhone and rooting on Android remove operating system restrictions and give the user elevated control over the device. That control lets an attacker alter core files, spoof geolocation, hide device tampering, and run tools that would normally be blocked. In an identity flow, those changes matter because device integrity checks often feed risk scoring before a biometric decision is made. If the device layer is compromised, the verification stack may accept a synthetic session as trusted long before the selfie check is evaluated.

Practical implication: Treat device integrity as a first-class identity signal, not a background telemetry feed.

Why camera injection defeats live selfie checks

Camera injection works by intercepting the camera stream and substituting a pre-recorded or generated video for the live feed. The article describes attacks that hook into camera APIs, use malicious libraries, or rely on virtual camera tools to maintain the illusion of a real session. This is especially effective against identity checks that trust the camera channel once the app has launched. The issue is not the quality of the deepfake alone, but the attacker's ability to control the input path before the liveness decision is made.

Practical implication: Validate the integrity of the capture path, not only the realism of the image.

How multi-angle fraud combines device, camera and behaviour abuse

The article places jailbreaking inside a broader multi-angle fraud pattern where deepfakes, device tampering, fake documents, and bot-like behaviour reinforce each other. That matters because a single control can look effective in isolation while the overall session is still fraudulent. Fraud rings can automate onboarding at scale, reuse synthetic identities, and vary tactics until one signal passes. In practice, this means identity assurance has to correlate multiple weak signals into one decision rather than trusting any single proof point.

Practical implication: Correlate device, camera, and behaviour signals into one fraud decision rather than one-off checks.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Device trust assumptions collapse once the user controls the execution environment: The article shows that jailbreaking and rooting are not just policy violations, they invalidate the premise that the handset can be treated as a trustworthy verifier. When the attacker can modify the device, hide tampering, and present a synthetic camera feed, the identity system is judging evidence from an adversary-controlled endpoint. Practitioners should treat device state as part of identity assurance, not as a separate mobile-security concern.

Camera liveness is necessary but not sufficient for identity assurance: The central failure mode here is not weak biometrics alone, but a trusted camera channel that can be replaced before the verification engine sees it. That is why rootless jailbreaks, virtual cameras, and API interception matter operationally: they let the attacker preserve the appearance of a live session while changing the underlying source. The implication is that liveness controls must be paired with capture-path integrity checks.

Multi-angle fraud is the right mental model for modern identity abuse: Deepfake fraud increasingly succeeds by combining device tampering, synthetic media, spoofed telemetry, and bot automation in one onboarding attempt. Identity assurance boundary: The old separation between device trust, biometric proofing, and behavioural analytics was designed for cleaner attack paths. That separation fails when fraudsters orchestrate all three dimensions together, so practitioners need to rethink where one control ends and the next begins.

Fraud teams need to govern the session, not just the identity document: The article's strongest signal is that a legitimate-looking onboarding flow can be fully synthetic from device boot to camera output. That means the control objective is no longer merely to validate who the applicant claims to be, but to understand whether the session itself is trustworthy. Teams should focus on the integrity of the full interaction chain, not just the final identity assertion.

From our research library:

• Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.

What this signals

Identity programmes that separate device integrity from biometric verification are now exposed to blended fraud paths. The practical shift is toward session-level assurance, where trust is established only when the device, camera, and behaviour signals agree.

Identity assurance boundary: The useful distinction is no longer between onboarding and fraud review, but between evidence gathered from a trustworthy endpoint and evidence gathered from an endpoint the attacker controls. That boundary should shape policy, escalation, and exception handling.

For practitioners

• Strengthen device integrity checks Score jailbroken, rooted, emulator, and fingerprint-anomalous devices as high risk before allowing biometric proofing to continue.
• Validate camera capture integrity Detect virtual cameras, API interception, and feed substitution attempts so the verification flow can distinguish live capture from injected video.
• Correlate multiple fraud signals Combine device, camera, geolocation, and behaviour telemetry into one decision path so a passing selfie cannot override a compromised endpoint.
• Escalate suspicious sessions for review Route sessions with mixed trust signals into step-up review or blocked state instead of allowing automated approval to complete onboarding.

Key takeaways

• The core problem is not just deepfakes, but deepfakes delivered through devices that fraudsters can tamper with before verification begins.
• Incode's article ties jailbreaking and rooting to camera injection, spoofed device signals, and multi-angle fraud that can defeat single-point controls.
• Practitioners need to move from isolated checks to correlated assurance across device integrity, camera trust, and behaviour signals.

Key terms

• Jailbroken Device: A jailbroken device is an iOS device whose built-in protections have been bypassed, often to allow unauthorized software or deeper system access. For defenders, this matters because the app may run in an environment where normal operating system safeguards are weakened, increasing exposure to tampering and malware.
• Rooted Android Device: A rooted Android device is one where the user has gained administrator-level access to the operating system. Rooting removes normal platform protections, allowing deeper control over system files, settings, and application behavior. From a fraud and security perspective, that expanded control also increases the chance of tampering, malware installation, and data exposure.
• Camera Injection Attack: A fraud technique that feeds synthetic, replayed, or intercepted video into a liveness or verification control. The control may appear to be working, but the sensor input is not coming from a live subject. This matters because assurance fails when the capture path is not trusted.
• Multi-Angle Fraud: Multi-angle fraud is a blended attack that combines several deception methods in one session, such as device tampering, synthetic media, fake documents, and bot-like behaviour. The goal is to make each individual signal look plausible while the overall identity event is fraudulent.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.