Topic starter
19/08/2026 4:00 pm
TL;DR: Identity fraud attempts have surged by 74% over three years and deepfakes now account for 6.5% of fraud attempts, according to Jscrambler, as generative AI and organized criminal groups accelerate forged documents, account takeovers, and biometric bypasses. The governance problem is no longer just verification accuracy, but how to protect the full identity flow across browser, mobile, and data handling paths.
Editorial analysis by NHI Mgmt Group, based on content published by Jscrambler: “Prevent KYC Data Breaches: What Businesses Miss (And Hackers Don’t)”.
By the numbers:
- 3 in 5 businesses have seen an increase in identity fraud attempts in the last year.
- Fraud attempts have surged by 80% over the last three years.
- Identity fraud attempts have risen by 74% over the last three years.
Key questions
Q: What breaks when KYC verification can be manipulated in the browser or SDK?
A: The verification decision becomes unreliable because the capture channel itself can be altered before the evidence reaches the matcher.
Q: Why do deepfakes create more risk than ordinary identity fraud?
A: Deepfakes compress the time needed to impersonate a real person and make the attack look legitimate at the exact moment trust is granted.
Q: How should organisations reduce repeated KYC checks without weakening compliance or fraud controls?
A: Organisations should design identity flows that reuse verified data only with explicit consent, strong auditability, and clear policy boundaries.
Practitioner guidance
- Harden the client-side capture path Protect browser and mobile identity flows against script injection, monkey patching, virtual camera bypass, and runtime tampering that alter verification inputs.
- Separate biometric assurance from channel assurance Treat liveness detection, media authenticity, and session integrity as distinct controls so a convincing face or voice does not imply a trustworthy capture path.
- Reduce reuse value of identity evidence Minimise storage and exposure of passport scans, driver’s licence images, biometric templates, and onboarding artifacts that can be resold or repurposed for fraud.
Bottom line: Identity fraud is increasingly driven by manipulated capture paths, deepfakes, and reused evidence, not just by better fake documents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:37 pm
KYC fraud is now a channel-integrity problem, not just an identity-check problem. The article shows that attackers are not limited to submitting better false documents. They are manipulating the browser, the SDK, and the verification flow itself, which means the control boundary has moved. For identity teams, that shifts the question from “did the applicant pass?” to “was the evidence path trustworthy end to end?”
A few things that frame the scale:
- Veriff's 2026 Identity Fraud Report documented a 300X increase in digitally presented media that was either entirely AI-generated or otherwise altered.
A question worth separating out:
Q: What should teams do after identity evidence cannot be reconstructed for an incident?
A: They should treat the missing evidence as a control failure, not only an investigation problem. The immediate follow-up is to identify which identity records, logs, or lifecycle steps broke the chain, then restore a governed evidence trail for access, revocation, and review before the next audit cycle.
👉 Read our full editorial: KYC and biometric fraud are outpacing identity verification controls