How I Work a Suspected Deepfake Onboarding Case

Generative AI didn’t invent identity fraud. It industrialised it.

A face-swapped selfie that once needed a compositing artist and a few hours in After Effects now takes an app under a minute and costs less than a coffee. A forged utility bill that used to give itself away through font substitution now arrives with correct kerning, correct paper texture and a plausible address, first try. The economics changed. Volume followed.

For a KYC analyst this doesn’t mean abandoning the fundamentals. It means applying them faster, with a different set of red flags in view. What follows is the method I use to work a suspected AI-fraud case from first signal to filed decision.

The three vectors worth knowing cold

Before the steps, be precise about what “AI fraud” covers in an onboarding context, because the investigative approach differs for each:

• Synthetic identity documents. IDs, utility bills and bank statements generated or edited with GAN- or diffusion-based tools, sometimes stitched onto a real template lifted from a data breach.
• Biometric spoofing. Deepfake video or photo injected into a liveness check, either as a pre-recorded synthetic face presented to the camera or a real-time face swap running through a virtual camera driver.
• Synthetic identity fraud proper. A blended identity — real Social Security or national ID number, fabricated name, fabricated date of birth, AI-generated supporting documents — built to season an account over months before a bust-out.

Each leaves a different evidence trail. Which is why step one is never “run everything through the same check.”

The playbook

1. Recognise the signal. These cases rarely announce themselves. They arrive as a cluster of small anomalies, none of which would trigger review alone. A liveness confidence score that passed but sits near the threshold. A document OCR match that’s too clean, missing the natural extraction noise you’d expect from a photographed physical document. An applicant completing a multi-minute form in under twenty seconds. A selfie whose lighting direction doesn’t match the ambient light implied by an ID photo taken seconds earlier.

2. Freeze and preserve before you triage. The moment a case is flagged, stop every automated pipeline step that would re-encode, re-compress or overwrite the originals. Recompression destroys the compression-artefact and metadata evidence step three depends on. Hash the original files — SHA-256 is sufficient — and log the hash before anyone, human or model, touches them again. This is the most-skipped step in the whole playbook, and it decides whether your eventual SAR narrative is defensible or just an opinion.

3. Run document forensics triage. With originals preserved, hunt for the fingerprints generative tools leave: inconsistent font kerning or letter spacing under magnification, especially around variable fields like names and dates; shadow and lighting mismatches between a document photo and its supposed physical environment; compression ghosting around edited regions at high zoom; metadata either suspiciously empty, meaning stripped, or internally inconsistent, like an EXIF timestamp predating account creation or a device model incapable of that image resolution. Then reverse image search the document background and template. Synthetic documents get built from a small number of reused base templates surprisingly often, so the same watermark or table layout appearing across “different” applicants is a strong signal.

4. Cross-check the biometric layer independently of the document layer. Never let a passed liveness check close the loop by itself. Look for absent micro-motion: no visible pulse in the skin, no blink irregularity, unnaturally stable framing for a handheld phone capture. Passive liveness models score texture and depth cues, and a well-executed face swap can beat one signal while failing another, so if your stack checks only one, treat a borderline pass as inconclusive rather than clean. Then run the selfie through reverse image and face-similarity search against your own prior applicant pool. Face reuse across “different” identities is about the highest-precision indicator available to an analyst, for the simple reason that legitimate applicants essentially never share a face.

5. Correlate the network and velocity signals. Individual identity fraud leaves a lonely trail. Synthetic-identity rings and AI-fraud farms leave a crowded one. Pull device fingerprint, IP/ASN and referral-path data across the flagged case and its near neighbours in time. Shared devices or emulators across “unrelated” applicants. IP clustering on residential proxies or VPN exit nodes inconsistent with the claimed address. Submission cadences too regular to be human — form fills spaced at near-identical intervals are the signature of scripted or semi-automated tooling.

6. Make the escalation decision against a written threshold, not a feeling. Have a pre-agreed decision tree so the call doesn’t depend on who is on shift. Outright reject only where document forensics and biometric signals both fail independently. Route to Enhanced Due Diligence where one channel is ambiguous and the other is clean. File a SAR with the NCA under POCA 2002 where the fact pattern meets the suspicious-activity threshold, whether or not the account was ever opened. And read FinCEN’s November 2024 alert on this typology, FIN-2024-Alert004, regardless of jurisdiction. It cites a case from earlier that year where fraudsters used deepfake video to impersonate a multinational’s CFO on a video call, convincingly enough that a finance employee wired $25 million. No document was forged. No liveness check was beaten in the traditional sense. The entire attack happened after onboarding, on a live video call. Which is the lesson most teams miss: deepfake exposure doesn’t end at KYC. Test generative-AI defences only at the onboarding gate and you have secured the door while leaving the window open.

7. Write the narrative like it will be read by someone with no context. A defensible SAR narrative states, in plain chronological order, what was observed, what tool or check produced the observation, and why that observation met the suspicious-activity standard rather than resting on suspicion alone. “Applicant’s selfie video showed no observable blink over 8 seconds of passive liveness capture; reverse image search matched facial embedding to two prior applications under different names submitted within 48 hours” is defensible. “Seemed like a deepfake” is not.

8. Close the loop on the typology, not just the case. Every confirmed AI-fraud case is training data for your programme, whether or not you touch a model directly. Log the indicator combination that caught it. Update the red-flag registry. Flag the pattern to whoever owns rule tuning or model retraining. This category evolves fast precisely because the tooling is shared across attackers, so a typology that worked against you this month will circulate, and the next hundred attempts will be slightly better at evading whatever caught the last one.

Fighting generative fraud with agentic defence

The technology producing the attack is increasingly what catches it.

An agentic AI system — one that independently runs the reverse-image search, pulls the device-fingerprint cross-reference, checks document metadata and assembles the findings into a draft case file — executes steps 3 through 5 of this playbook in the time it takes a human analyst to open the first tab. A genuine capability shift rather than hype, and not a coincidence: the forensic checks above are exactly the bounded, well-defined, repeatable tasks agentic tools handle well.

Which is also exactly why step 6 stays human.

An agent can build the evidence chain. It should not be deciding whether that chain clears the threshold for rejection, escalation or a filed SAR. The moment an AI system’s output becomes the basis for a regulatory filing without a person checking it, you have traded one class of fabrication risk, the applicant’s, for another, the agent’s. A hallucinated “match” inside an AI-assembled case file triggers a bad decision just as effectively as a well-forged document does. Use agentic AI to compress the investigation. Keep a person on the decision.

Why the fundamentals still do the heavy lifting

None of this replaces CDD, EDD or a properly risk-rated customer profile. It sits on top of them.

The core discipline of KYC has always been one question: does the evidence in front of me actually corroborate the identity being claimed, and can I explain why in writing? Generative AI raised the production quality of what an attacker can fabricate. Agentic AI is raising the speed at which a defender can answer. The analyst’s job hasn’t changed at all. The burden of proof on “corroborate” simply got heavier, which is why a preserved, hashed, well-documented case file matters more now than it did five years ago.