Notifications
Clear all
Topic starter
21/08/2026 4:53 pm
TL;DR: AI-powered phishing, deepfakes, and synthetic voice attacks are making passwords and SMS codes unreliable for proving who is really behind an authentication attempt, according to KOBIL. The practical issue is not just stronger login security, but identity verification that can withstand manipulated human, agent, and machine interactions.
NHIMG editorial — based on content published by KOBIL: AI-driven identity theft and the controls used to counter it
Questions worth separating out
Q: How should security teams reduce fraud when attackers use deepfakes and synthetic identities?
A: They should combine document validation, liveness detection, behavioural analytics, and risk-based step-up checks rather than relying on a single identity proofing event.
Q: Why do passwords and SMS codes no longer provide enough identity assurance?
A: Because they confirm a secret, not a real actor.
Q: How does identity governance change when AI identities enter the mix?
A: AI identities force governance teams to manage more subjects, more access paths, and more change than human-only programmes were designed for.
Practitioner guidance
- Strengthen high-risk human authentication flows Add liveness checks and phishing-resistant factors to executive access, finance approvals, and partner support paths where impersonation would have high impact.
- Reclassify trust decisions by actor type Separate human login assurance, NHI credential governance, and delegated process access so that one control model does not mask the risks of another.
- Instrument identity monitoring for synthetic deception Correlate login telemetry, device context, and behaviour anomalies so that deepfake-driven or bot-assisted attempts trigger step-up review before access is granted.
What's in the full article
KOBIL's full article covers the operational identity controls this post intentionally leaves at a higher level:
- Step-by-step guidance on combining biometrics, hardware tokens, and liveness checks in real authentication flows
- Examples of how context-based authentication can trigger step-up decisions without breaking user experience
- Integration considerations for audit logging, access monitoring, and compliance reporting across enterprise systems
- Practical deployment patterns for protecting employees, partners, and customers against AI-generated impersonation
👉 Read KOBIL's analysis of AI-driven identity theft and verification controls →
AI-driven identity theft: are your human identity controls keeping up?
Explore further
21/08/2026 5:10 pm
Passwords and SMS codes are now verification signals, not trust signals. AI-generated deception has reduced the evidentiary value of traditional authentication because a valid response no longer proves a legitimate actor. Deepfakes, synthetic voices, and automated phishing can all satisfy a login workflow without proving the claimant's real-world presence. For identity programmes, the consequence is plain: factor success is no longer enough to establish actor legitimacy.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, which leaves identity state exposed long after access should have ended.
A question worth separating out:
Q: What should organisations review when they add biometrics to authentication?
A: They should review enrolment, fallback, recovery, and exception handling as carefully as the biometric itself. Biometrics improve resistance to impersonation, but weak recovery can undo the benefit. The safest design couples biometrics with liveness checks, auditing, and tightly governed recovery paths.
👉 Read our full editorial: AI-driven identity theft is exposing human authentication gaps
