Notifications
Clear all
Topic starter
14/07/2026 4:27 pm
TL;DR: Fraud is shifting from selfie deception to pipeline compromise, with injection-style attempts exceeding 100,000 per month and SDK-based flows accounting for nearly 90% of rejections in 2025, according to Smile ID’s analysis of over 200 million identity checks across 35-plus countries. Visual verification alone is no longer enough; trust now depends on capture integrity, device signals, and cross-session intelligence.
NHIMG editorial — based on content published by Smile ID: analysis of how fraud is bypassing selfie verification in 2025
By the numbers:
- SDK-based verification accounted for nearly 90% of fraud rejections in 2025, up from 15% in 2023.
Questions worth separating out
Q: How should security teams handle identity verification when capture integrity cannot be proven?
A: Treat the identity event as untrusted until the device, environment, and capture path can be validated.
Q: Why do isolated KYC checks fail against modern fraud campaigns?
A: Because modern fraud is repeatable and cross-platform.
Q: What do security teams get wrong about API-only identity verification?
A: They assume the API response tells them enough about the trustworthiness of the input.
Practitioner guidance
- Instrument capture provenance at the device layer Require evidence that the image or document originated from a trusted device environment before it enters biometric scoring.
- Move high-risk flows to stronger re-authentication Apply additional checks at login, password reset, device change, and withdrawal approval, not just at onboarding.
- Correlate identity signals across attempts and platforms Build detection around repeated faces, repeated devices, repeated metadata patterns, and clustered retry behaviour across your own systems and trusted intelligence sources.
What's in the full report
Smile ID’s full analysis covers the operational detail this post intentionally leaves for the source:
- Regional breakdowns showing how fraud techniques differ across West, East, Southern, and Francophone Africa.
- Technique classifications for injection attacks, identity farming, document manipulation, and AI-assisted impersonation.
- Implementation detail on SDK versus API detection performance and where capture integrity checks change rejection rates.
- Network intelligence observations that connect repeated identity assets across millions of checks.
👉 Read Smile ID’s analysis of selfie bypass fraud and capture integrity risk →
Selfie verification and pipeline compromise: what teams must fix?
Explore further
14/07/2026 4:34 pm
Capture provenance has become the new identity trust boundary. Selfie verification assumed the submitted image could be treated as evidence. That assumption fails when the camera feed, device state, or submission path can be replaced before verification begins. The implication is that identity programmes must stop treating visual authenticity as sufficient and start governing evidence provenance as part of the assurance model.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared with nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: What should organisations do when fraud moves from onboarding into recovery and withdrawals?
A: Apply stronger controls at the moments that unlock value. Re-check identity during password resets, device changes, and withdrawal approvals, then combine biometric checks with device integrity and behavioural consistency. That is where attackers now concentrate because convenience controls are usually weaker than onboarding controls.
👉 Read our full editorial: Selfie verification is losing to pipeline-level fraud in 2026
