Topic starter
14/08/2026 6:34 pm
TL;DR: Fraud now reaches both identity evidence and the live session, with Incode reporting that 40% of legitimate users still abandon document-based flows. Session checks and authoritative record binding can cut impersonation risk without pushing more real users out of onboarding.
Editorial analysis by NHI Mgmt Group, based on content published by Incode: “When Identity Isn't Enough: Solving Fraud in the Age of Deepfakes and AI”.
By the numbers:
- 40% of legitimate users abandon document-based verification flows before completion, according to Incode.
- GovFaceMatch verifies legitimate users in just 10 seconds, on average, according to Incode.
- Deepsight and GovFaceMatch together deliver a 20% improvement in overall conversion rate, according to Incode.
Key questions
Q: Why do AI-generated fake IDs and deepfakes create such a sharp fraud risk in digital onboarding?
A: AI-generated documents and biometric spoofing reduce the quality gap that traditional verification once depended on.
Q: What are the warning signs that identity verification is too easy to spoof?
A: The main warning signs are heavy reliance on a single human-recognition cue, fast approvals for high-risk requests, and recovery workflows that can be completed during one conversation.
Q: What breaks when identity verification assumes there is always a human behind the session?
A: The model breaks when the subject is an AI agent or a synthetic identity that cannot be verified through conventional human attributes.
Practitioner guidance
- Map proofing controls to both identity and session assurance Review onboarding and step-up journeys to separate identity evidence from session integrity evidence, then define which controls prove each one.
- Reduce reliance on user-submitted artefacts Limit the weight given to uploaded document images when a stronger authoritative source or biometric binding is available.
- Add session-integrity checks to fraud workflows Use device integrity, camera integrity and behavioural signals to detect virtual camera injection, bot activity and manipulated video feeds.
Bottom line: AI-enabled fraud now succeeds by attacking both identity evidence and the live session, so a single verification layer is no longer enough.
Glossary terms: Session Authenticity, Authoritative Source Binding, Deepfake Injection Attack, Identity Assurance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
14/08/2026 6:42 pm
Session authenticity is now part of identity governance, not an optional fraud add-on. Once attackers can fake the live interaction, proofing controls that stop at the document or selfie layer leave a governance gap. That gap matters because the system may be verifying evidence, not trust. Practitioners should treat the session as an identity control boundary, not just a transport detail.
A few things that frame the scale:
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
A question worth separating out:
Q: How should fraud and IAM teams decide whether to prioritise friction or stronger assurance?
A: They should prioritise whichever combination reduces overall risk without shifting the burden onto legitimate users. The decision should be based on conversion, fraud capture and assurance quality together, not on friction alone. If the architecture can verify both the person and the session in one flow, that usually outperforms adding extra manual steps.
👉 Read our full editorial: AI fraud now needs both identity and session authenticity controls