Know Your Customer in the Age of Deepfakes

Remote onboarding made financial services accessible to millions of people. It also made identity the front line of fraud. With generative AI, criminals can produce realistic documents, synthetic faces and cloned voices at low cost. Know-your-customer processes built for photocopies and selfies must evolve.

The new threats

• Forged documents: AI-generated identity cards and utility bills that pass a visual check.
• Synthetic identities: real and invented data combined into a person who does not exist.
• Deepfake selfies and video: faces injected into verification apps to defeat liveness checks.
• Account takeover: cloned voices used to convince call centres to reset access.

Layered defences

• Authoritative data checks: verifying identity numbers against government and bank databases, such as NIN and BVN in Nigeria.
• Advanced liveness detection: tools that detect injected video and manipulated images, not just static photos.
• Device and behaviour signals: how a person types, swipes and connects can reveal automation and fraud rings.
• Consistency analysis: checking that names, addresses, phones and emails tell a coherent story over time.
• Risk-based escalation: more checks for higher-risk customers and transactions.

Do not stop at onboarding

Synthetic identities often behave perfectly for months before borrowing heavily and disappearing. Ongoing monitoring of behaviour, linked accounts and repayment patterns catches what onboarding misses. In debt recovery work, we regularly trace "customers" whose details lead nowhere; the cost of weak KYC shows up later as unrecoverable debt.

Signals that reveal synthetic identities

• Identity details that exist in few or no independent data sources.
• Multiple applications sharing a device, address, phone number or bank account.
• Recently created email addresses and phone numbers.
• Rapid credit-building followed by a sudden increase in borrowing.
• Selfies or documents with visual artefacts typical of generated images.

Technology and its limits

Liveness detection, document authentication and biometric matching have improved, but attackers adapt quickly. Injection attacks, where fake video is fed directly into an app rather than through a camera, can bypass weaker systems. Providers should test their controls against current attack methods, use vendors that update models frequently and combine biometric checks with device intelligence and data consistency tests.

Governance of KYC programmes

Regulators expect a risk-based approach: stronger checks for higher-risk customers and products, documented reasoning and regular review. Track metrics such as fraud rates by onboarding channel, false rejection rates and time to onboard. A programme that blocks fraud but also rejects legitimate customers, often those with thin data files, undermines financial inclusion. The goal is to be hard for criminals and easy for honest customers.

A leader's view: own the trade-offs

Every KYC programme balances three goals that pull against each other: stopping criminals, welcoming genuine customers quickly and keeping costs manageable. Technology vendors sometimes promise all three without trade-offs. Leaders should be sceptical. Tightening checks reduces fraud but increases abandoned applications and complaints. Loosening them grows the customer base but invites losses and regulatory findings.

The right balance depends on the product and the customer. A low-limit wallet for everyday payments can use lighter checks with strict transaction limits, then step up verification as limits rise. A lending product or an account for high-value transfers deserves stronger checks from the start. This tiered approach is consistent with risk-based regulation and serves financial inclusion.

Leaders should insist on a few numbers every month: fraud losses by channel, approval and abandonment rates, manual review volumes and the time customers wait for a decision. Watching these together shows whether a change in controls is working or simply moving the problem elsewhere. They should also make sure fraud, compliance, product and customer service teams meet regularly. Fraudsters exploit gaps between departments, and the best defence is a single shared view of the customer journey and the risks along it.

Balance security and inclusion

Stronger checks must not exclude genuine customers without perfect documents. The goal is smarter verification, not more friction for everyone.

Common questions

What is KYC?

Know Your Customer is the process financial institutions use to verify a customer's identity, assess risk and meet anti-money laundering requirements.

Can deepfakes beat KYC checks?

Some weaker checks can be fooled. Layered verification with liveness detection, document authentication, device signals and data consistency tests is much harder to defeat.