Deep dive: AI fraud and digital IDs

AI fraud and digital IDs

My verdict as of October 2026: the AI fraud is real and growing, the regulators have moved toward cryptographic credentials, and almost nobody can present one online yet. I'd build in layers, treating the document as one weak signal among many, and get ready for signed credentials without waiting for them.

What's real

• FinCEN's November 2024 alert. From 2023 into 2024, FinCEN saw more reports of deepfakes: AI-altered or AI-generated images on driver's licences and passports, combined with stolen or invented personal data to build synthetic identities that "successfully opened accounts" and then moved money for criminals. The detail that matters for product: most were caught on re-review after the account showed odd behaviour rather than at onboarding. FinCEN flagged third-party webcam plugins and applicants claiming "technical glitches" to dodge live checks.
• Forgery as a service. An online service sold AI-generated ID images for $15 in early 2024, and journalists used one to pass a crypto exchange's check.
• Injection attacks. Instead of holding a mask to the camera, the attacker replaces the camera feed with a virtual camera and plays a deepfake. Entrust, whose latest report covers over a billion verifications, says deepfake selfies rose by more than half in 2025 and are about one in five biometric fraud attempts. Vendors' percentages are measured on their own traffic, so they tell you the direction more than the size.
• Uneven accuracy. In the US Department of Homeland Security's tests of remote identity checks, reported in 2026, only 5 of 16 selfie-to-ID systems met all its goals. For the median system, an impostor who looked similar to the real person was about 11 times more likely to be wrongly accepted than a random one.
• Mules and takeovers. These come after onboarding. In the UK, Cifas counted 78,000 account takeover cases in 2025, almost a fifth of its database, and mule cases rose by about two-thirds in the first half of 2026.

What's not there yet

• Mobile driver's licences. 21 states and Puerto Rico issue them, with over 8 million credentials, and about 45% of Americans live where one is available. Few states let people present them online, and the Northeast, Texas and Florida don't issue them yet.
• The EU wallet. Every member state must offer one by December 24, 2026, and banks must accept it on request about a year later. One consultancy expects only 8 to 12 of the 27 to be ready by the end of 2026.
• The UK. It dropped plans for a mandatory national digital ID for right-to-work checks in January 2026; digital checks are still coming, through certified private providers.
• Losses. Onboarding fraud is a slice. The FBI logged about $21B of reported internet crime losses in 2025, and investment scams were about half of scam losses.

Where the rules moved

Biometric privacy

A selfie check collects biometrics, and that has its own law. Illinois requires written consent before you collect and a published retention schedule (see Liability allocation). Texas lets only the attorney general sue, but Meta and Google settled for well over a billion dollars each. Colorado and Washington have laws too. If an applicant refuses a selfie, which business owners often do, you need another path: data checks with manual review, a document only, or a digital credential.

Questions to ask an identity vendor

1. Which attacks was your liveness tested against: masks and printouts, or injected camera feeds too?
2. How do you defend web capture, where injection is easiest?
3. What are your false-reject rates by age, skin tone and camera quality, and who measured them?
4. Can you read a mobile driver's licence or a passport chip, and in which flows?
5. Where are images and templates stored, and for how long?