When Verification Can't Be Trusted

Digital onboarding rests on two assumptions: the document in the image is real, and the face in front of the camera is a live person. Generative AI has made both assumptions forgeable at scale and at almost no cost.

Injection attacks now feed synthetic video straight into the capture pipeline, past the presentation attack detection built to stop them, and the federal identity-proofing standard itself says live capture and PAD are not sufficient to stop every case. This paper sets out how the attacks work, why detection has a floor, where the missed attacks turn into losses, and why onboarding should be treated as an underwriting decision with the residual loss transferred.

Written for heads of fraud, onboarding and KYC leaders, CROs and CFOs at banks and fintechs.

What’s inside

1. Both KYC assumptions are now forgeable
2. The attack that never faces the camera
3. Detection has a floor, and the standard says so
4. Every miss becomes an account, then a loss
5. What supervisors already expect
6. Stop verifying identities. Start underwriting them
7. Five moves for the next budget cycle