When visual review is the only control, sophisticated synthetic media can pass as a real person and unlock fraud paths that should have been blocked. That can lead to ghost fraud, new account fraud, synthetic identity fraud, and benefit or pension abuse. Organisations need proof of presence and real-time identity assurance, not just a convincing image or video.
Why visual review fails as an authentication control
Visual review is a weak control because authentication needs evidence, not resemblance. A face on a screen, a voice clip, or a live video feed can be fabricated well enough to satisfy a human reviewer, especially when the reviewer is under time pressure or only has a short interaction. That is why photo matching alone is not a reliable boundary for access decisions.
Deepfake attacks exploit the gap between “looks like the person” and “is the person, here, now, with the right proof.” In practice, the control fails when organisations treat a convincing image as sufficient assurance and skip stronger checks such as proof of presence, possession of a device, or a phishing-resistant factor. The real problem is not realism, it is the absence of verifiable identity evidence.
A useful comparison is modern account sign-in guidance, which treats phishing-resistant authentication as a different category from simple visual or knowledge-based checks. NIST SP 800-63 Digital Identity Guidelines emphasise assurance levels and authenticators that can be verified by the relying party, not just judged by an operator. For that same reason, organisations need a control that can survive synthetic media, not one that merely passes a human plausibility test.
What fraud paths open when synthetic media is enough to pass
Once visual review becomes the only gate, attackers can use deepfake media to create or take over accounts, impersonate applicants, or bypass step-up checks during sensitive transactions. That can turn a weak enrolment flow into ghost fraud, new account fraud, synthetic identity fraud, and payment or benefits abuse. The issue is not limited to onboarding, it also affects account recovery, claimant verification, and any workflow where a human reviewer is expected to spot deception.
At that point, the fraud path often becomes a process problem as much as a technical one. Reviewers may approve cases because the interaction appears authentic, even when the underlying evidence is entirely synthetic. Access Reviews and Certification Guide is useful here because it reinforces the broader governance lesson: decisions that grant or restore access need context, not rubber-stamped judgement. The same principle applies to identity proofing, where the stakes are often higher than a routine entitlement review.
For practitioners, visual-only checks also create a scale problem. The more approvals are handled by a small reviewer pool, the more likely attackers are to find a consistent weakness in tone, process, or exception handling. A convincing deepfake does not need to beat every control, it only needs to succeed once in the right workflow.
What to replace visual-only review with
Real-time identity assurance should combine proof of presence, liveness or anti-spoofing controls, and a second factor that is bound to the legitimate user or device. In higher-risk workflows, the best approach is to use multiple signals that are hard to forge together, such as device binding, session continuity, cryptographic authentication, and out-of-band verification tied to a trusted channel. The objective is to reduce the decision to evidence that is much harder to synthesize than a face or voice.
That is why phishing-resistant sign-in and recovery matter more than ever. Passwordless and Passkeys Guide supports the move away from visually mediated trust by showing how passkeys and FIDO2 shift assurance onto cryptographic proof. In the same way, Workforce Identity Security Guide is relevant because it treats account recovery, help desk resets, and step-up authentication as high-risk moments that need stronger verification than a face check.
Where the workflow involves high-value payments, benefits, or customer account changes, the control should force escalation when the claimed identity cannot be tied back to a trusted authenticator or recent verified presence. If a process can move money, change payees, or restore access, it should not depend on the operator’s ability to spot AI-generated deception.
Risk and Threat Considerations
Deepfake-enabled impersonation is attractive because it bypasses a control that humans tend to overtrust. Once an organisation accepts a convincing image or voice as sufficient, attackers can route fraud through the weakest reviewer, the least scrutinised exception path, or the highest-pressure workflow. The result is not just a bad verification decision, it is a repeatable attack surface across onboarding, recovery, and benefit administration.
Failure mechanism: The reviewer confuses realism with proof, so synthetic media satisfies the approval step even though no trustworthy identity evidence was established.
Impact: Attackers can open accounts, recover accounts, redirect payments, or claim benefits under a false identity, and the organisation may only discover it after the fraud has been completed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Deepfake-resistant authentication depends on assurance levels and verifiable authenticators. |
| Recommendation — Use phishing-resistant authenticators and proofing aligned to the required assurance level. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Visual-only review is a weak substitute for authenticated user identity checks. |
| IA-8 — Identification and Authentication (Non-Organizational Users) | Customer and external-user verification is directly affected by deepfake impersonation risk. | |
| IA-5 — Authenticator Management | Safe identity flows depend on managing authenticators, recovery, and credential lifecycle. | |
| Recommendation — Require strong identification and authentication before granting access or approving recovery. Apply stronger identity proofing and authentication controls for external-user access. Rotate, protect, and recover authenticators through controlled lifecycle processes. | ||
| OWASP ASVS | V6 — Authentication | Authentication assurance must withstand spoofed media and replayed identity claims. |
| Recommendation — Verify sign-in and recovery use strong, phishing-resistant authentication factors. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Deepfake success often reflects weak or spoofable authentication paths. |
| NHI-07 — Long-Lived Secrets | Fraud paths worsen when stolen or persistent secrets remain usable after impersonation. | |
| Recommendation — Strengthen authentication so identity proof cannot be satisfied by synthetic media alone. Shorten secret lifetime and rotate exposed credentials promptly. | ||
Practitioner Guidance
What to prioritise: Treat any workflow that can create, restore, or materially change access as high risk if it relies on human visual judgement alone. Replace that decision point first, before tuning reviewer scripts or adding more manual oversight.
What to verify: Before trusting an identity check, verify that the claimant proved presence through a mechanism the attacker cannot cheaply replay, and that the proof is bound to the live session or authenticated device. If the process cannot produce that evidence, it is still vulnerable even when the video looks convincing.
Practitioner takeaway: The right question is not whether the image seems real, but whether the identity evidence would still hold up if the media were synthetic, replayed, or generated on demand.
Related resources from NHI Mgmt Group
- What happens when organisations rely on traditional security controls alone against deepfakes, sponge attacks, and AI-assisted impersonation?
- What happens when organisations rely on visual identity alone and a deepfake gets through?
- What breaks when organisations rely on phishing awareness alone against DPRK-linked attacks?
- What breaks when organisations rely on package review alone to stop supply chain attacks?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
