Topic starter
11/06/2026 10:48 pm
TL;DR: Readily available face-swapped imagery injection can evade mobile KYC liveness checks, creating a practical path to impersonation and fraudulent account access in financial services, banking, and cryptocurrency, according to iProov’s MITRE ATLAS case study. The finding underscores that identity verification now needs continuous, attack-aware controls, not static proof-of-presence tests.
Editorial analysis by NHI Mgmt Group, based on content published by iProov: “MITRE ATLAS™ Publishes Critical Vulnerability in the KYC Identity Process Discovered by iProov”.
Key questions
Q: What breaks when mobile KYC relies on liveness checks alone?
A: Liveness checks break when the verifier assumes the camera feed is trustworthy.
Q: Why do deepfake attacks create a different identity risk than ordinary phishing?
A: Deepfakes reduce the value of human judgment because the attacker can imitate a familiar person, tone, and emotional state in real time.
Q: How can security teams test whether mobile KYC controls are actually working?
A: They should run adversarial tests that use synthetic video, camera substitution, and streaming overlays against the full proofing journey.
Practitioner guidance
- Strengthen capture-path validation Test whether the mobile proofing flow can detect virtual camera substitution, replayed video, and injected media before the liveness decision is made.
- Red-team the onboarding path Recreate the attack chain using public face-swapping tools, streaming software, and unmanaged Android camera substitution to measure how the control fails in practice.
- Map proofing to adversarial AI tactics Align mobile KYC threat models with AI-generated media abuse, injection attacks, and identity proofing bypass scenarios rather than generic fraud assumptions.
Bottom line: AI-generated deepfake video can defeat mobile KYC liveness checks when the proofing channel itself is not trusted.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 7:08 am
Identity proofing now has an attack-path problem, not just an assurance problem: The control is being judged on whether a live user is present, but the real question is whether the evidence path itself can be trusted. When a virtual camera can replace the handset feed, liveness becomes a mediated signal rather than direct proof. Practitioners need to treat media provenance as part of identity assurance, not a peripheral technical detail.
A question worth separating out:
Q: Should organisations treat identity proofing as part of AI threat modelling?
A: Yes. If AI-generated media can influence onboarding decisions, identity proofing is already inside the AI attack surface. Teams should evaluate the proofing path as an adversarial system with injection, manipulation, and evasion risks, then align controls to that reality instead of assuming traditional fraud testing is sufficient.
👉 Read our full editorial: AI-driven deepfake attacks expose mobile KYC liveness gaps