Remote onboarding and digital payments were built on a set of assumptions. A selfie matched to an ID document proves a person is present. A voice on the phone that sounds like the finance director probably is the finance director. A clean application with consistent details is probably a real customer.
Generative tools weaken all three. Realistic faces, cloned voices and convincing documents can now be produced cheaply. Synthetic identities — combinations of real and invented details built up over time — can pass checks designed to catch obvious fakes.
The answer is not one better detector. It is defence in depth across the whole journey.
Two related threats
It helps to separate them:
- Deepfakes impersonate a real person — a face in a liveness check, a voice on a call, a video in a meeting
- Synthetic identities create a person who does not exist, often seeded with some genuine data and nurtured until they look established
Deepfakes tend to target high-value moments: account recovery, payment approval, executive instructions. Synthetic identities target onboarding and credit, then cash out later.
Onboarding controls
No single check is enough. Combine:
- Document verification that inspects security features, not only text extraction
- Liveness detection that resists replayed and injected video, including checks on the capture device and camera feed
- Device and session signals — emulators, virtual cameras, unusual configurations, automation
- Data consistency checks — does the identity have a plausible history across sources?
- Velocity and linkage — shared devices, addresses, phone numbers or documents across many applications
Linkage analysis matters especially for synthetic identities. One application can look perfect. A cluster of applications sharing subtle attributes tells a different story.
Payment and instruction controls
For payments, the riskiest moment is often a convincing request rather than a technical breach. Controls that hold up:
- Out-of-band confirmation for changes to beneficiary details and large or unusual payments, using contact details already on file
- Clear rules that voice or video alone never authorises a payment
- Behavioural signals on the session — how the user types, navigates and pauses
- Transaction monitoring that considers the payee, amount, timing and history together
- Step-up authentication tied to risk, not applied to everything
Process design matters as much as technology. If staff are allowed to bypass a callback when an executive sounds urgent, the control does not exist.
Detection models need care
AI models help score risk, but they come with obligations:
- Train and evaluate on realistic attack data, including new generation techniques
- Watch for drift — attackers adapt faster than quarterly retraining
- Measure false positives, because blocking genuine customers has real cost
- Check for unfair outcomes across customer groups
- Keep a human review queue for borderline cases, with feedback into the model
Treat deepfake detectors as one signal among many. Their accuracy against yesterday’s tools says little about tomorrow’s.
Respond and learn
When fraud gets through, the investigation should feed controls quickly. Confirmed cases become test cases. New patterns update rules and linkage logic. Shared intelligence with industry bodies and partners, where allowed, shortens the time attackers can reuse a method.
Logging needs to support this: which checks ran, which signals fired, who approved what.
Where to start
- Map onboarding and payment journeys and mark where identity is assumed rather than verified
- Add device, session and linkage signals alongside document and liveness checks
- Require out-of-band confirmation for payment detail changes and high-risk instructions
- Build an evaluation set for fraud models that includes generated media
- Set up a feedback loop from investigations to rules and models
Incubics builds layered fraud controls for onboarding and payments, with evaluation and monitoring included from the first release.