The posts are often very specific, detailing the step-by-step approach required to bypass the security controls of a particular bank, fintech, or crypto platform.  The forums are active with responses delivered within minutes of a post. Often the response will include an offer to sell a solution.  Who new fraudsters would be so community minded!

AI Faces To Bypass User Verification 

One of the popular threads on Telegram fraud forums is AI-generated deepfake videos. The videos show human heads rotating up and down and side to side. The threads offer AI tools that convert a single photo into a convincing video that can fool liveness checks included in Know Your Customer (KYC) checks used by fintechs and banks.  These ‘deepfake’ tools are offered as solutions to multiple steps in the verification process including:

• AI-generated ID documents
• AI-splicing of face onto stolen ID documents
• AI-generated ‘selfie’ images and videos
• AI-generated supporting documents such as bank statements and pay slips
• AI-generated images of ‘evidence’ used for insurance claims

In all these use cases, the AI-generated outputs are hyper-realistic and it’s impossible for an expert human reviewer to distinguish between an authentic original specimen and the falsified AI version.

Thousands of companies and their customers fall victim to these attacks every month. The impact is massive and escalating rapidly. A recent report by SIFT estimated the cost of Account TakeOver (ATO) at US$635b in 2023 and growing at triple digit rates!  More than one third of consumers have been impacted directly by these attacks and the problem is getting worse as fraud syndicates adopt AI tools at scale.

The Solution

The only strategy for stopping these attacks is to use identity verification and Multi-Factor Authentication solutions that are specifically designed to mitigate the risk of deepfake attacks and verify the actual person behind the screen. In addition, by adding verification technologies like device intelligence, AI models for deepfake generation, and behavioral biometrics, organizations can further reduce the risk of identity fraud. Finally, invest in solutions that protect your multi-factor authentication (MFA) and password recovery processes: this is a primary attack vector and a key vulnerability that companies often overlook.

Attackers have seen huge success using AI deepfakes for injection and presentation attacks – which means we’ll only see more of them. The key to stopping this threat is to develop a multi-layered approach that combines PAD, injection attack detection (IAD), and image inspection. This strategy forms the basis for companies to navigate the “cyber pandemic” we face and onto a more secure, trusted future.