Topic starter
14/07/2026 5:24 pm
TL;DR: DHS’s Remote Identity Validation Rally tested commercial identity verification systems against deepfake, document fraud, and injection attacks, and Incode was one of only two vendors to meet multiple performance goals across those categories, according to Incode. The result reinforces that IDV governance now has to treat presentation attacks and stream injection as core control issues, not edge cases.
Editorial analysis by NHI Mgmt Group, based on content published by Incode: “Incode Among Five Systems to Meet DHS S&T Goals in the Remote Identity Validation Rally”.
Key questions
Q: What breaks when remote identity verification cannot resist deepfakes and injection attacks?
A: The control breaks at the trust boundary.
Q: Why do liveness and document checks fail when attackers use synthetic input?
A: Because the attacker is no longer presenting an obvious fake.
Q: What are the warning signs that an IDV programme is being outpaced by fraud?
A: Warning signs include rising manual review queues, more mismatches between presented identity data and authoritative records, and increasing dependence on exception handling.
Practitioner guidance
- Define adversarial IDV acceptance criteria Set minimum thresholds for deepfake, document fraud and injection resistance before approving remote verification for regulated journeys.
- Test the capture boundary separately Evaluate whether the camera, SDK or transport layer can be bypassed with pre-recorded or synthetic frames, then require evidence of stream integrity controls.
- Require independent attack testing evidence Ask vendors for third-party or government-led test results that reflect presentation attacks and injection scenarios rather than clean enrollment conditions.
Bottom line: Remote identity verification can fail at several different layers, including face liveness, document authenticity and video-stream integrity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:27 pm
Remote IDV resilience is now a governance question, not a UX question. If a verification system cannot withstand deepfakes, document manipulation and stream injection, then it cannot be treated as a simple front-end control. IDV now sits on the boundary between fraud prevention, access governance and regulated onboarding, so control design has to start with adversarial conditions rather than convenience metrics. The practical conclusion is that identity teams need evidence of attack resistance, not only promise of friction reduction.
A few things that frame the scale:
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
A question worth separating out:
Q: Should organisations prioritise independent IDV testing over internal assumptions?
A: Yes. Independent testing matters when the use case is regulated, high-stakes or exposed to modern fraud techniques. Internal assumptions usually reflect normal user behaviour, while identity attacks target the exact conditions that make systems trust the wrong signal.
👉 Read our full editorial: DHS identity validation rally raises the bar for fraud resistance