Topic starter
30/07/2026 11:23 pm
TL;DR: Deepfake defence is an early-detection problem, targeting presentation attacks and injection attacks at the point of verification or authentication, with its technology also positioned against account takeovers, identity theft, bot attacks, and SIM swaps, according to Yoti. The identity lesson is that verification controls now have to assume manipulated inputs, not just weak users.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “On the threat of detecting deepfakes”.
Key questions
Q: What breaks when biometric identity proofing is exposed to deepfakes?
A: The assumption that a biometric sample proves a live, genuine person breaks down.
Q: Why do deepfakes make traditional authentication weaker?
A: Deepfakes weaken traditional authentication because they imitate the human signals that many approval processes still trust, including voice and video.
Q: How do security teams know if their verification controls are actually working?
A: They work if high-risk requests cannot be completed through a single channel and if helpdesk or approval attempts leave a clear audit trail.
Practitioner guidance
- Harden verification entry points Require liveness and spoof-resistance checks wherever identity evidence is first captured, especially in onboarding and step-up flows.
- Separate direct and indirect attack paths Map presentation attacks and injection attacks to different control layers so teams can test sensor trust, channel integrity, and bot resistance separately.
- Review high-trust workflows for fake-input exposure Prioritise account recovery, remote onboarding, and authentication exceptions because these workflows turn a single accepted assertion into durable trust.
Bottom line: Deepfake defence is becoming a source-control issue because manipulated media can now enter identity workflows as if it were genuine proof.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 11:25 pm
Deepfake defence is becoming a source-control problem, not a media-quality problem. Identity systems fail when they assume the submitted image, voice, or video is a trustworthy representation of a person. Once generative AI can fabricate convincing proof, the control point shifts to where the signal is captured and validated. Practitioners should treat source integrity as part of identity assurance, not as a separate fraud concern.
A few things that frame the scale:
- Deepfake scams now account for nearly $12 billion in fraud losses globally.
A question worth separating out:
Q: How should security teams handle deepfake risk in identity workflows?
A: Security teams should treat deepfakes as a trust and verification problem inside identity workflows. The right response is to require out-of-band verification for high-risk actions, separate request initiation from approval, and harden help-desk and finance procedures so a convincing voice or video cannot authorize access on its own.
👉 Read our full editorial: Deepfake detection moves identity verification toward source control