AI Fraud Is Turning Onboarding Into a Forensic Problem
A man opened 46 bank accounts using deepfakes and stolen IDs.
The IDs were harvested through a fake rental posting and social media. The scammer generated images that resembled the photos on stolen IDs, and the bank’s automated system compared the images, found a match, and approved the accounts.
This is not just a “deepfake passed KYC verification” story.
It is a warning about what happens when onboarding systems are optimized for matching, but not for evidence.
1. The missing layer between KYC and investigation
A face match can tell you whether two images look similar. It can’t always tell you whether the person is real, present, and participating in the session.
That is where liveness checks matter. It helps determine whether the submitted face is coming from a live human interaction, a replayed image, a manipulated video, an injected feed, or synthetic media designed to satisfy the matching system.
But liveness alone is not enough either. For fraud, compliance, and investigation teams, onboarding media can no longer be treated as a one-time verification input. It has to be treated as evidence.
Attackers are not relying on one tactic. They are combining stolen IDs, synthetic faces, manipulated files, replay attacks, and gaps in automated workflows. That means the question cannot stop at “did the selfie match the ID?” or even “did the user pass liveness?”
‘’What evidence do we have that this onboarding attempt was legitimate?’’
That evidence should include the signals behind the decision: liveness indicators, manipulation artifacts, metadata inconsistencies, file lineage, reuse patterns, device and submission anomalies, and logs that can be reviewed after the fact.
Because when fraud is discovered later, a pass/fail result is not enough. Teams need to understand what happened, why the system approved it, and whether the same pattern is appearing elsewhere.
2. Where Cyberette Adds the Forensic Layer
At Cyberette, we see AI fraud detection as an evidence problem, not just a classification problem.
A score can be useful, but teams need clear forensic indicators that explain what was detected, where the risk appears, and how the evidence can be reviewed by an expert.
That is why an evidence-first approach matters.
For onboarding, this means examining the media and the context around it. From the face appearing live, to the file shows signs of manipulation, whether metadata is inconsistent; the same media or identity patterns appear across multiple submissions, and the decision can be traced through reproducible logs.
As AI-generated and manipulated media become part of fraud operations, onboarding systems need to move beyond simple matching. They need to produce evidence that can stand up after the moment of approval.
3. Approval is no longer the finish line
AI fraud is turning onboarding into a forensic problem.
The organizations that adapt fastest will be the ones that stop treating selfies, ID scans, and onboarding videos as temporary verification inputs.
They will treat them as evidence.
That shift changes the standard from “did this look close enough to pass?” to “can we prove what happened here?”
And in an environment where synthetic media, stolen identities, and automated fraud are converging, that evidence trail may become the most important part of the onboarding decision.
Have questions? Reach out at info@cyberette.ai