Picture a recording from the onboarding queue of a payments app. A young man holds up a passport, turns his head on request and smiles at the camera. Every KYC check passes. The face belongs to nobody alive. A generative model built it from a stolen document photo in a few minutes.
That scenario is no longer hypothetical, and it changed how I think about digital identity. For fifteen years, payments companies trusted a simple rule: if a real face matches a real document, the customer is real. Deepfake fraud has broken that rule, and most KYC flows still behave as if it holds.
My name is Vladyslav Kolodistyi, and I work on the plumbing behind digital payments. In this piece I explain what changed, which controls still hold and where digital identity is heading next.
Short answer from Vladyslav Kolodistyi: a selfie and a document scan are no longer proof of identity on their own. Payments firms need layered digital identity checks, strong liveness detection and continuous KYC after sign-up.
Why identity verification fails against deepfake fraud
The numbers moved faster than most KYC teams in payments expected. The Entrust 2026 Identity Fraud Report, built on more than a billion digital identity checks, found that deepfakes now appear in one in five biometric fraud attempts. Deepfaked selfies rose 58% in a single year. Injection attacks, where criminals feed synthetic video straight into the verification app, grew 40%. For payments providers, those are the headline numbers.
Deepfake fraud indicators from the Entrust 2026 Identity Fraud Report. Chart by Vladyslav Kolodistyi.
Injection attacks worry me most. Classic identity verification asks the phone camera for a live image. An injection attack skips the camera entirely. The KYC system receives a perfect video stream and never learns that no lens captured it. Deepfake fraud at this level beats any human reviewer.
“When the attacker controls the camera feed, the selfie proves nothing. Digital identity has to start from signals a generative model cannot fake.”
Vladyslav Kolodistyi
Payments are the prize. A synthetic customer who clears KYC opens an account, receives stolen payments and moves the money on through instant payments before anyone looks twice. Mule networks now buy verified payments accounts in bulk. Every weak digital identity check in payments becomes a product on a criminal marketplace.
So where do payments teams start? This is the order I recommend for any KYC stack under pressure from deepfake fraud:
- Read the chip. NFC reading of the passport or ID card chip checks a cryptographic signature from the issuing state, the strongest digital identity signal a physical document offers. A deepfake cannot forge that signature.
- Use passive liveness with injection detection. The system should check the device, the camera driver and the video stream itself, not only the face.
- Match the digital identity to the device. A new account on a rooted phone with an emulator deserves more questions than one on a years-old handset.
- Watch behaviour after KYC. First payments, login patterns and payee choices reveal synthetic customers that passed onboarding.
- Accept verified credentials. Government-issued digital identity wallets give payments firms data that a state has already checked.
“KYC used to be a gate you pass once. In the deepfake era, digital identity is a signal you earn every day you use a payments account.”
Vladyslav Kolodistyi
Where deepfake fraud hits payments hardest
Onboarding is only one target. Deepfake fraud also attacks payments that honest customers make. In 2024, engineering firm Arup confirmed that an employee in Hong Kong sent around $25 million after a video call in which the other participants were deepfakes of senior colleagues. No KYC check failed. The digital identity of the executives on screen was simply borrowed.
The same trick scales down. In voice-based deepfake fraud, cloned voices call finance teams and ask for urgent supplier payments. Fake support agents talk customers through “security” payments to a new account. Each case abuses digital identity inside the payments flow, long after onboarding has finished.
My view is that payments firms need digital identity checks at the moment of risk, not only at sign-up. A large first payment to a new payee, a change of phone number or a request to raise limits should trigger a fresh digital identity signal, such as a passkey prompt or a wallet confirmation.
“A deepfake can borrow a face for ten minutes. It cannot borrow the customer’s device, history and payments pattern at the same time.”
Vladyslav Kolodistyi
eKYC onboarding with the EU Digital Identity Wallet
The fifth step is where Europe is moving fastest. Under the revised eIDAS framework, every EU member state must offer citizens a European Digital Identity Wallet by the end of 2026. The wallet stores verified digital identity data on the phone and shares only what the user approves. The Commission also lists payments among the wallet’s intended uses, so the same digital identity credential may one day confirm high-value payments as well as onboarding.
For eKYC onboarding, this flips the model. Today a payments provider collects images and tries to prove they are genuine. With a wallet, the provider receives signed attributes: name, date of birth, nationality. The issuing state vouches for them. A deepfake face has nothing to attack, because no face match decides the outcome.
How three eKYC onboarding methods compare against deepfake fraud. Assessment by Vladyslav Kolodistyi.
| Method | What the provider checks | Deepfake fraud exposure | Customer effort |
|---|---|---|---|
| Document photo plus selfie | Image quality and face match | High, especially with injection attacks | Medium |
| Chip read plus passive liveness | State signature and live presence | Low, if injection detection runs | Medium |
| Digital identity wallet credential | Signed attributes from the issuer | Very low | Low |
I do not expect wallets to replace other KYC routes overnight. Rollout timelines vary by country, and many payments customers will come from outside the EU. But eKYC onboarding built on signed credentials raises the cost of deepfake fraud dramatically. It also cuts drop-off, because a customer who taps “share” finishes in seconds and can start making payments straight away.
“The best defence against a fake face is a flow that never needs to trust a face. Signed digital identity credentials give payments firms exactly that.”
Vladyslav Kolodistyi
A layered digital identity stack for payments onboarding. Diagram by Vladyslav Kolodistyi.
Conversion is a security feature
Compliance teams in payments often treat friction as proof of safety. I see it differently. Every extra KYC step pushes honest customers away, while professional fraudsters simply automate it. Deepfake fraud rings run scripts that retry a failed selfie a hundred times without complaint.
Good digital identity design puts the friction where the risk sits. A customer who opens an account from a known device, reads a passport chip and makes small domestic payments deserves a smooth path. A new account that tries to send large cross-border payments within an hour deserves a second look. Risk-based KYC keeps both groups where they belong. Speed matters for revenue too. A customer who drops out of KYC never makes their first payments, and a competitor collects the fees on those payments instead.
“Honest customers leave when KYC feels like an interrogation. Fraudsters stay, because friction is just a cost line in their business plan.”
Vladyslav Kolodistyi
Know your business as well as your customer
The same logic applies to merchant onboarding. Deepfake fraud now targets business KYC too. Criminals fake video calls with company directors and submit synthetic utility bills. Payments providers that onboard merchants need digital identity checks on every beneficial owner, not only on the account opener.
Merchant fraud hurts payments providers twice. A fake merchant accepts stolen card payments, collects the settlement and disappears before chargebacks arrive. The acquirer then covers the losses on those payments. Director checks combined with close payments monitoring in the first weeks of processing catch much of this bust-out fraud.
Instant payouts shrink that window even further. When a platform settles to merchants in seconds, a synthetic business can cash out on its first day of processing, a risk I unpacked for EUbusiness in a piece onwhat instant payouts change for merchants. Director checks have to finish before the first payout, because nothing comes back after it.
Registries strengthen digital identity checks here. Company data from official registers, verified director identities and bank account ownership checks together give a clearer picture than any single document. When the merchant starts processing payments, transaction monitoring completes the KYC story.
What I would do this quarter
If you run KYC for a payments business, audit your flow against injection attacks first. Ask your identity verification vendor how it detects virtual cameras and emulators. Add a chip-based digital identity option wherever your customers carry chipped documents. Prepare your systems to accept wallet credentials as they launch across the EU. Review the digital identity signals you use before large payments, too.
Then measure digital identity outcomes after onboarding, not only at the door. Track which verified accounts later receive fraudulent payments. That feedback loop shows you where deepfake fraud slipped through and which KYC signals actually predict risk.
“Seeing is no longer believing. Verifying is.”
Vladyslav Kolodistyi
I’m Vladyslav Kolodistyi, and I will keep sharing what works as digital identity, KYC and payments regulation evolve. Connect with me on LinkedIn if you are working on the same problems.
