AI Identity Fraud and Its Implications
With the advancements in AI, the risk of AI identity fraud is also advancing. A service called “OnlyFake” claims to use “neural networks” to create realistic fake IDs. For just $15, customers can get ID documents that pass the KYC (Know Your Customer) checks. This blog will talk about AI-powered identity fraud, the possible implications, and an experiment by the Keesing team to see whether the fake document will pass the verification solution.
The Site
Since the site claims to generate over 20,000 IDs, this would mean a revenue of $300,000 daily at full capacity. The site creates fake driver’s licenses and passports from 26 countries including the United States, Canada, Britain, and some European Union countries, according to 404 Media who first ran this story. The documents generated appear to be taken in different backgrounds, such as a bed cover, car seat, or carpet, which make it appear that the picture is taken in real life.
Source: 404 Media
This can have a substantial impact on crime & cybersecurity as it can help scammers in their mission. Despite disclaimers in its terms of service, which state that it only supplies templates for “movies, TV shows, web illustrations,” the website has gone underground.
The Implications of This AI Identity Fraud
The rise of AI fraud prompts a re-evaluation of identity verification practices. The customer market will start seeking more information to better understand the level checking that better fits their business – such as the difference between a light compliance check and a more rigorous anti-fraud check.
In the competitive market only some mobile solution providers will have sufficient anti-fraud technology to counter increasingly common attacks. The solutions being offered may require more device components which can mean higher development costs and more complex integration for customers. Performance characteristics such as speed are also likely to be adversely affected. With only a few viable suppliers and these higher costs then this may mean higher end prices for customers. Therefore, this will change the competitive landscape and the pricing in the market.
High-risk businesses/organisations (e.g., banks, cryptocurrency trading, etc.) who need higher fraud mitigation may switch to doing a deep face-to-face check, as this is an “anchor” check, or they may rely upon independent notary services.
While biometric authentication sounds promising, forcing the remote use of it to bind the presented document to the holder may not always be a welcome idea owing to privacy concerns. After all, it cannot be assumed that a “private” person should give up more private data because the service is not performing well with checking the provided document. This is a challenge on balancing between security and individual rights.
Supporters of RFID chip verification may advocate for combining chip data with biometrics as the most effective way to combat identity fraud. However, the approach still falls short of covering a wide range of documents. As a result, remote access to services may be restricted to documents containing a chip, and then only those where the chip data can be checked successfully.
An Experiment
Our team of developers tested an ID made from the OnlyFake site by running it through a remote identity verification provider solution, then through Keesing’s solution. The result? It passed the other IDV (Identity Verification) provider as authentic. However, the Keesing Helpdesk recognized the document as fake, thus causing it to fail the check.
Source: Keesing Technologies
We can expect similar inconsistencies in the future, but such contrasts highlight the risks that some customers are taking by putting their KYC procedures exclusively in the hands of mobile users.
With Keesing AuthentiScan, you can verify someone’s ID Document through a photo of an eligible ID document, such as an ID card, driver’s license, or passport. To fortify the solution’s accuracy, we added biometric identity proofing to our cutting-edge ID document verification technology. This unique formula not only gives you assurance that a checked ID is authentic, but also that the person presenting it is its real owner.
In the event of a failed check, the Keesing Helpdesk undertakes manual verification procedures. Our Document Helpdesk team is trained by former members of the Dutch Identity Fraud and Documents Centre of Expertise (ECID), supplemented by rigorous in-house training. They assist customers by answering document-specific questions, inspecting questionable IDs, and helping companies decide whether to accept or decline presented documents.
This may just be the start of a new wave of change in the market, but it is a timely reminder of the ongoing technology race between fraudsters and security companies. As technology keeps evolving, it is crucial for organisations to prioritize trusted solutions to mitigate the risks posed by identity fraud.
