Topic starter
14/08/2026 6:34 pm
TL;DR: AI-generated IDs and deepfake injection attacks have made traditional document checks too easy to evade, while 40% of legitimate users abandon document-based flows, according to Incode. The core shift is from identity-only verification to session-aware trust controls that preserve conversion without widening fraud exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Incode: “When Identity Isn't Enough: Solving Fraud in the Age of Deepfakes and AI”.
By the numbers:
- 40% of legitimate users abandon document-based verification flows before completion, according to Incode.
- GovFaceMatch verifies legitimate users in just 10 seconds, on average, according to Incode.
- Deepsight and GovFaceMatch together deliver a 20% improvement in overall conversion rate, according to Incode.
Key questions
Q: What breaks when identity verification assumes there is always a human behind the session?
A: The model breaks when the subject is an AI agent or a synthetic identity that cannot be verified through conventional human attributes.
Q: Why do AI-generated fake IDs and deepfakes create such a sharp fraud risk in digital onboarding?
A: AI-generated documents and biometric spoofing reduce the quality gap that traditional verification once depended on.
Q: What are the warning signs that identity verification is too easy to spoof?
A: The main warning signs are heavy reliance on a single human-recognition cue, fast approvals for high-risk requests, and recovery workflows that can be completed during one conversation.
Practitioner guidance
- Map proofing controls to both identity and session assurance Review onboarding and step-up journeys to separate identity evidence from session integrity evidence, then define which controls prove each one.
- Reduce reliance on user-submitted artefacts Limit the weight given to uploaded document images when a stronger authoritative source or biometric binding is available.
- Add session-integrity checks to fraud workflows Use device integrity, camera integrity and behavioural signals to detect virtual camera injection, bot activity and manipulated video feeds.
Bottom line: AI-enabled fraud now succeeds by attacking both identity evidence and the live session, so a single verification layer is no longer enough.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:42 pm
Session authenticity is now part of identity governance, not an optional fraud add-on. Once attackers can fake the live interaction, proofing controls that stop at the document or selfie layer leave a governance gap. That gap matters because the system may be verifying evidence, not trust. Practitioners should treat the session as an identity control boundary, not just a transport detail.
A few things that frame the scale:
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
A question worth separating out:
Q: How should fraud and IAM teams decide whether to prioritise friction or stronger assurance?
A: They should prioritise whichever combination reduces overall risk without shifting the burden onto legitimate users. The decision should be based on conversion, fraud capture and assurance quality together, not on friction alone. If the architecture can verify both the person and the session in one flow, that usually outperforms adding extra manual steps.
👉 Read our full editorial: AI fraud now needs both identity and session authenticity controls