Deepfakes and adversary-in-the-middle attacks increase account takeover risk because they can impersonate legitimate users and interfere with authentication flows at scale. When fraudsters can mimic identity signals or intercept sessions, banks must rely on stronger verification, behavioural checks, and adaptive controls. Static checks are easier to bypass, while layered authentication makes it harder for attackers to reuse stolen or synthetic identity data.
Why deepfakes and AiTM attacks change the banking ATO equation
Deepfakes and adversary-in-the-middle attacks both weaken the bank’s confidence that the person, device, or session being evaluated is genuinely the account owner. Deepfakes target the human verification layer, while AiTM attacks target the live authentication and session layer. Together, they reduce the value of static identity checks and make takeover attempts much more scalable.
In practice, the risk is not just impersonation. It is the combination of convincing presentation, credential capture, and session theft, which can defeat controls that assume the bank is seeing a stable, trustworthy interaction. That is why controls built around one-time checks or knowledge-based verification have become a weaker defence path than layered, adaptive verification and session monitoring.
Banks should treat this as a trust-boundary problem, not only a fraud problem. The attacker may never need to “break” the authentication mechanism if they can insert themselves into it, reshape it, or persuade a human reviewer that a synthetic signal is real. For a banking perspective on identity compromise patterns, the 52 NHI breaches Report and the SonicWall VPN Mass Breach via Stolen Credentials both show how stolen or abused access can scale once the attacker is inside the trust path.
What makes these attacks effective against banking controls
Deepfakes are effective because they imitate high-confidence identity cues, such as voice, face, or conversational behaviour, that many organisations still treat as proof. AiTM attacks are effective because they let an attacker proxy the victim’s real login flow, capture tokens or session material, and reuse the authenticated session without necessarily knowing the full password again. In banking, that matters because transaction approval, password reset, and customer support workflows often rely on the same trust assumptions.
The core failure mode is that the control verifies an interaction, not the underlying trustworthiness of the actor. If the bank authenticates a session but does not bind that session tightly to device state, channel integrity, or behavioural continuity, an attacker can ride the session after initial login. If the bank verifies a caller or customer using a deepfake-friendly signal alone, the attacker can satisfy the process without owning the true identity.
That is why layered controls matter. Behavioural analytics, step-up verification, device reputation, transaction risk scoring, and out-of-band confirmation work better together than any single check. Banks also need to reduce exposure to replayable factors and avoid treating a successful login as proof that downstream actions are safe. For complementary control framing, MITRE ATT&CK Enterprise Matrix helps map credential access and session abuse patterns, while CIS Controls v8 reinforces account management, access control, and logging discipline.
The practical implication is that banks must assume the attacker may control part of the conversation, not just steal a password. A robust response therefore depends on detecting anomalies in the entire path, from enrolment and recovery to authentication and high-risk transaction approval.
Risk and Threat Considerations
These attacks raise takeover risk because they compress the time between initial deception and account control. Deepfakes can support social engineering, support-desk fraud, and account recovery abuse, while AiTM tooling can steal live sessions, bypass MFA prompts, and enable follow-on fraud before the victim notices. In banking, that creates direct exposure to unauthorised transfers, payment changes, customer data access, and delegated fraud at scale.
Failure mechanism: The attacker either convinces a human verifier with synthetic identity signals or sits between the user and the bank to capture and replay the authenticated session, defeating controls that rely on a static trust decision.
Impact: account takeover becomes more likely even when passwords or MFA are present, because the attack targets the trust path around them, not only the secret itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1110 — Brute Force | AiTM often enables credential reuse and login abuse against banking accounts. |
| T1528 — Steal Application Access Token | AiTM frequently captures tokens or sessions that bypass password reuse. | |
| Recommendation — Map login abuse patterns to T1110 and alert on repeated, automated authentication attempts. Hunt for token theft paths and invalidate sessions after suspicious authentication transitions. | ||
| CIS Controls v8 | 6 — Access Control Management | Banking ATO risk is reduced by constraining account and session authority. |
| 8 — Audit Log Management | ATO detection depends on visibility into authentication and session anomalies. | |
| Recommendation — Apply access control rules that limit account authority and require step-up checks for sensitive actions. Centralise and review authentication logs for proxying, replay, and unusual session behaviour. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | Deepfakes and AiTM directly undermine identity proof and access decisions. |
| Recommendation — Strengthen identity proofing and access decisions with adaptive, risk-based authentication controls. | ||
Practitioner Guidance
What to prioritise: Focus first on the points where banking processes convert identity proof into account authority, especially password reset, call-centre verification, device enrolment, and payment approval. Those are the places where deepfakes and AiTM attacks most often convert deception into durable access.
What to verify: Confirm that high-risk actions require more than a successful login, such as transaction-specific verification, channel binding, or a second independent signal that is harder to proxy in real time. Banks should also verify that step-up rules are risk-based rather than triggered only by a failed password or obvious anomaly.
Practitioner takeaway: The winning control pattern is not stronger static identity proof, but stronger resistance to replay, proxying, and synthetic presentation across the full customer journey.
For financial-sector governance and operational resilience context, banks can also align the control model with DORA and the PCI Security Standards Council document library, both of which reinforce access control, monitoring, and resilient authentication practices.
Related resources from NHI Mgmt Group
- Why do man-in-the-middle attacks create such high account takeover risk?
- Why do adversary-in-the-middle attacks create such high risk for cloud account access?
- Why do reused passwords still create account takeover risk in digital banking?
- Why do GenAI-driven social engineering attacks increase account takeover risk?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
