Risk · R-142 · Generative Content & Information Integrity
Deepfake impersonation and synthetic identity fraud
Generated voice, image, video or documents are used to impersonate customers or to create false identities, defeating verification and authentication.
- Severity
- Critical
- Audience
- Board · Heads-of · Practitioner
- Frameworks
- Article 50 · AML.M0034 · AML.T0088 · Information Integrity
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-11
What it is
Checks that a person is who they claim to be have long relied on things that were hard to fake: a voice on the telephone, a face on a video call, a photograph of a document. Generative models now produce convincing versions of all three, cheaply and in real time. Criminals use them to pass onboarding with an invented identity, to take over an existing customer's account, and to authorise payments. This entry concerns fraud against customers and against the organisation's verification processes. Impersonation aimed at the organisation's own staff is covered in AI-enabled social engineering of staff.
How it happens
- A cloned voice passes voice-based authentication or convinces a call handler.
- A generated face and document pass remote onboarding.
- A live video call uses real-time face replacement.
- Synthetic identities, built from real and invented details, are aged and then used.
- Detection tools tuned on older fakes miss newer ones.
Why it matters
Losses are direct and can be large. A customer whose account is taken over suffers real harm, and reimbursement rules place much of the cost on the firm. Onboarding fraud also breaches financial crime obligations. Every channel that treats seeing or hearing as proof is exposed.
Warning signs
- Voice or face alone is accepted as proof of identity.
- High-value instructions can be given by telephone or video with no second check.
- Fraud losses are rising in remote channels.
- Verification suppliers have not been asked how they test against generated media.
Who owns it
The head of fraud or financial crime is accountable. Security and the owners of each customer channel implement the controls. Operations train front-line staff and handle affected customers.
In practice
A fraudster calls a pension provider using a clone of a member's voice made from a short public recording. The voice passes the provider's voiceprint check and the caller changes the bank details for payment. The same pattern generalises to any process that authenticates by what a person looks or sounds like.
Mitigating controls
Primary controls
- Deepfake-resistant verification Preventive
- Makes identity and instruction checks robust to synthetic media. Identity and instruction verification never rests on voice, image or video alone, and high-value actions require confirmation through a separate, pre-agreed channel.
Supporting controls
- AI system monitoring and logging Detective
- Flags anomalous verification attempts. Every production AI system is instrumented to record its inputs, outputs, errors and usage, with thresholds that raise alerts to a named owner who must act.
- Customer remediation for AI errors Corrective
- Puts right customers who were defrauded. When an AI error is found, all affected customers are identified, told, and put back in the position they should have been in, whether or not they complained.
- Role-based AI training Directive
- Front-line staff learn the signs. Reviewers, developers, risk and assurance staff, approvers and front-line teams receive training specific to their AI responsibilities, with competence assessed and completion tracked.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| EU AI Act | Article 50 | Transparency and disclosure obligations Deepfakes must be disclosed. |
| MITRE ATLAS | AML.M0034 | Deepfake Detection Deepfake detection. |
| MITRE ATLAS | AML.T0088 | Generate Deepfakes Generation of deepfakes. |
| NIST Generative AI Profile (NIST AI 600-1) | Information Integrity | Information Integrity Information integrity. |
Sources
- EU AI Act: Regulation (EU) 2024/1689 European Union (EUR-Lex) · official text
- NIST Generative AI Profile NIST · framework
- MITRE ATLAS MITRE · framework
Related terms
How to cite
Axiom Verity (2026). Deepfake impersonation and synthetic identity fraud. Reference Library, R-142. https://axiom-verity.com/risks/deepfake-impersonation-and-synthetic-identity-fraud. Reviewed 2026-11-11.
Found an error or a better source? Report a correction.