Topic starter
19/08/2026 4:00 pm
TL;DR: Manipulated capture paths, deepfakes, and reused evidence are driving identity fraud in KYC flows, according to Jscrambler. Browser, SDK, and media-layer protection now has to be treated as part of the identity control surface.
Editorial analysis by NHI Mgmt Group, based on content published by Jscrambler: “Prevent KYC Data Breaches: What Businesses Miss (And Hackers Don’t)”.
By the numbers:
- 3 in 5 businesses have seen an increase in identity fraud attempts in the last year.
- Fraud attempts have surged by 80% over the last three years.
- Identity fraud attempts have risen by 74% over the last three years.
Key questions
Q: Why do deepfakes create more risk than ordinary identity fraud?
A: Deepfakes compress the time needed to impersonate a real person and make the attack look legitimate at the exact moment trust is granted.
Q: How should organisations reduce repeated KYC checks without weakening compliance or fraud controls?
A: Organisations should design identity flows that reuse verified data only with explicit consent, strong auditability, and clear policy boundaries.
Q: What breaks when KYC verification can be manipulated in the browser or SDK?
A: The verification decision becomes unreliable because the capture channel itself can be altered before the evidence reaches the matcher.
Practitioner guidance
- Harden the client-side capture path Protect browser and mobile identity flows against script injection, monkey patching, virtual camera bypass, and runtime tampering that alter verification inputs.
- Separate biometric assurance from channel assurance Treat liveness detection, media authenticity, and session integrity as distinct controls so a convincing face or voice does not imply a trustworthy capture path.
- Reduce reuse value of identity evidence Minimise storage and exposure of passport scans, driver’s licence images, biometric templates, and onboarding artifacts that can be resold or repurposed for fraud.
Bottom line: Identity fraud is increasingly driven by manipulated capture paths, deepfakes, and reused evidence, not just by better fake documents.
Glossary terms: Activation Trust Gap, Synthetic Identity Document Fraud, Liveness Detection, Client Side Tampering
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:37 pm
KYC fraud is now a channel-integrity problem, not just an identity-check problem. The article shows that attackers are not limited to submitting better false documents. They are manipulating the browser, the SDK, and the verification flow itself, which means the control boundary has moved. For identity teams, that shifts the question from “did the applicant pass?” to “was the evidence path trustworthy end to end?”
A few things that frame the scale:
- Veriff's 2026 Identity Fraud Report documented a 300X increase in digitally presented media that was either entirely AI-generated or otherwise altered.
A question worth separating out:
Q: What should teams do after identity evidence cannot be reconstructed for an incident?
A: They should treat the missing evidence as a control failure, not only an investigation problem. The immediate follow-up is to identify which identity records, logs, or lifecycle steps broke the chain, then restore a governed evidence trail for access, revocation, and review before the next audit cycle.
👉 Read our full editorial: Browser and mobile layers now shape KYC fraud outcomes
This post was modified 1 day ago by NHI Mgmt Group