The New Anatomy of Identity Fraud

How fraud is evolving

Identity fraud in remote onboarding used to be crude: a photographed borrowed ID, or a scan edited in an image editor. Those attempts still happen, but they are no longer the whole picture.

Attackers now combine techniques. A forged or altered document is paired with a face that matches it, generated or swapped with readily available tools. The image is fed into the verification session in a way that bypasses the phone camera entirely. Personal data comes from earlier breaches, so names, addresses and dates of birth look consistent with other records.

Single-check flows are no longer enough. A flow that only reads a document, or only compares two photos, has one point of failure, and organised fraud finds that point and repeats the attack across many accounts.

Document attacks

Document fraud falls into a few broad groups, and each leaves different traces.

• Counterfeits. A document produced from scratch to look like a real one. Quality varies widely, from obvious fakes to well-made templates sold online.
• Altered genuine documents. A real document with changed fields, usually the name, date of birth, expiry date or portrait. The physical card is genuine, which is what makes this type convincing.
• Stolen or borrowed documents. Unaltered and genuine, but presented by someone other than the holder.
• Reused documents. The same document, or the same image of it, submitted across several accounts or services.

Verification catches these in different ways. Template and security feature checks compare the document against what the issuer actually produces. The machine-readable zone carries check digits that must agree with the printed data, so a careless edit often breaks them. Where the document has a chip, NFC verification reads data signed by the issuing authority. An attacker can alter the printed card but cannot produce a valid signature for altered chip data. Reuse is found by comparing new submissions against ones already seen.

A stolen but genuine document passes all of these. That is why the document check is never the last step.

Image and presentation attacks

Fake IDs, screen replays, and synthetic faces target weak verification steps. Layered checks raise the cost of each attempt.

On the face side, the oldest technique is the presentation attack: holding something in front of the camera that is not a live person. That might be a printed photo, a photo or video on a second screen, a cut-out with the eyes removed, or a mask. The aim is to make the selfie match the document portrait without the real holder being present.

Screen replays are common because they are cheap: a video of the victim, often taken from social media, is played on a tablet held up to the phone. Moiré patterns, screen edges, reflections, unnatural depth and the lack of small involuntary movements are typical signals that liveness detection looks for.

Morphing is a quieter variant. Two faces are blended into one portrait so that the resulting document can be used by either person. A face match against a morphed portrait may succeed for both, which is why morph detection is treated as a separate check rather than left to the matching threshold.

Injection attacks and deepfakes

An injection attack skips the camera. Instead of pointing a device at a screen, the attacker feeds images or video directly into the verification session, through a virtual camera, a modified app, an emulator or a manipulated browser.

This matters because many presentation attack checks assume the image came from a real lens looking at a real scene. If the feed itself is fabricated, the content can be a deepfake that moves, blinks and turns its head on request. Asking the user to smile or look left does not help much when the face is generated in real time. Spotting a good one by eye is harder than most people expect: try our real or deepfake quiz.

Defending against injection is therefore about the capture channel as much as the image. Typical signals include whether the camera is a physical device, whether the session shows signs of emulation or tampering, and whether frame timing and image statistics look like a real sensor. These checks sit alongside liveness, not instead of it.

Synthetic and recycled identities

A synthetic identity is built rather than stolen. It mixes real data, such as a valid address or a real person's identifier, with invented details. Over time it may build a credit history or a trail of accounts that make it look established.

Synthetic identities are hard to catch with data checks alone, because each individual field may be plausible. They become harder to sustain when onboarding requires a physical document that is genuine, a face that matches it and proof that a real person is present. The attacker then needs a real document for an identity that does not exist, which is a much higher bar.

Where verification helps

Document authenticity, face match, and liveness each close a different gap. Together they make large-scale fraud harder to run.

No layer is perfect on its own. The point of layering is that an attacker who defeats one check still has to defeat the next, and the cost of doing so at scale rises quickly. To see what fraud and manual reviews cost your own business today, try the fraud cost calculator.

What to decide for your flow

Before choosing tools or thresholds, it helps to agree internally on a few points.

1. Which attacks you actually see. Review past fraud cases. A crypto exchange and a parking operator face different patterns.
2. Which checks are proportionate. A large withdrawal may justify a stricter flow than account sign-up.
3. What happens to uncertain cases. Decide which results go to manual review and who handles them.
4. How you learn from rejects. Track why sessions fail, to tell an attack pattern from a usability problem.
5. How long you keep evidence. Fraud investigation needs some data, but keeping images longer than necessary creates its own risk.

secuveri runs document checks with NFC chip reading where available, face matching, liveness detection and fraud signals for tampered and reused documents, screen replays, synthetic faces and injected or deepfaked feeds. You choose which checks run in each flow, and each result comes back as approve, review or reject. Data is processed and stored in Switzerland, with on-premise deployment as an option.