Fintech Neobanks, wallets, payments, lending, crypto
Fraud scales at the speed of your sign-up flow.
Account farms, mule recruiters and synthetic identities use the same instant onboarding, step-up and recovery your customers choose you for, with a deepfake selfie or injected video in place of a real face. NeuroVerify checks that face inside the flow in under 200 ms at p95, so honest customers never notice and fakes meet your policy.
The problem, in numbers
Fraud is no longer a person. It is an operation that opens accounts.
- 49m
online accounts created through one SIM-farm service: 1,200 SIM boxes running 40,000 SIM cards. Europol also reports fraudsters abusing neo-bank onboarding to register a continuous stream of new accounts.
Europol, IOCTA 2026 - 42%
of 3.8 million US suspicious activity reports in 2021 were identity-related, describing $212 billion in suspicious activity. Circumventing verification is one of three core exploits.
FinCEN Financial Trend Analysis, Jan 2024 - 1 in 5
biometric fraud attempts involved a deepfake. Deepfaked selfies rose 58% in 2025 and injection attacks 40% year on year. Vendor data from identity verifications Entrust processed.
Entrust 2026 Identity Fraud Report, Nov 2025 - $16bn
reported lost to fraud by US consumers in 2025, a record and about 25% more than 2024. Imposter scams alone took $3.5 billion, with bank impersonators causing the highest losses among business imposters.
FTC, 15 Jun 2026
Where deepfakes hit fintech
Six moments where a face is the only proof.
Each is fast by design and remote by default. Each turns on an image, a video or a voice that nobody at your company will ever see in person.
- Neobanks · wallets
Instant account opening
One operator runs dozens of phones and a stack of stolen or fabricated identities. Each application carries a face-swapped selfie built from the ID photo, so the face match passes by construction.
NeuroVerifyDigital account openingScores the onboarding selfie or video for face manipulation and generation before the account exists.
- Payments · neobanks
Mule account enrolment
Accounts opened with GenAI-made identities receive and move the proceeds of scams, including authorised push payment fraud. FinCEN reports exactly this in suspicious activity filings.
NeuroVerify + NeuroDetectMule enrolment with synthetic mediaNeuroVerify at sign-up. NeuroDetect when an investigator re-reviews the onboarding media of a suspected mule network.
- Lending · BNPL
Credit and BNPL applications
A synthetic identity pairs real and fake personal data with a generated face that belongs to nobody. It builds a thin, clean history, draws every line of credit, then disappears.
NeuroVerifyDigital lending platformsAI Generative Model Analysis looks for the traces of a face that was generated, not photographed.
- Crypto
Exchange KYC and withdrawals
Exchange accounts are the exit for laundered funds and transfers are hard to reverse. FinCEN lists high payment volumes to digital asset exchanges among its deepfake red flags.
NeuroVerifyCrypto exchange KYCChecks the KYC selfie at sign-up and the face again at withdrawal-address or limit changes.
- All fintech
Step-up on a new device
A face re-check guards device binding and limit changes. The attacker replays a recorded or real-time-swapped video of the genuine customer through a virtual camera instead of the phone’s lens.
NeuroVerifyWallet enrolment and recoveryLive Presence Verification and Face Manipulation Detection score the re-check in the same flow.
- All fintech
Account recovery and support
A “lost phone” claim moves the account to the attacker’s device. The proof is a selfie video or a cloned voice on a support call, built from the customer’s public posts.
NeuroVerify · NeuroCall (Beta)Claims, refunds and recoveryNeuroVerify checks the recovery face or recorded voice. NeuroCall, in Beta, analyses the voice on a live call.
Why your controls pass it
Every check in the stack trusts the face it was handed.
A fintech stack verifies the document, the device, the number and the money. The face is compared, timed and counted, but never examined for whether it is real.
Document check
Is this ID genuine and unaltered?
A real stolen ID. The fraud is in the face presented with it, which this check never examines.
Face match
Does the selfie match the ID photo?
A face swap built from the ID photo. It is designed to match, so a higher match score is no comfort.
Liveness
Is a person in front of the camera?
Injected video never passes through the camera. A real-time swap blinks and turns on cue.
Device and SIM signals
Is this a real phone and number we trust?
Farms that run real handsets and bulk SIM cards. Europol describes SIM farms used to bypass KYC at scale.
Velocity and duplicate checks
Have we seen this identity or device before?
A synthetic identity is new by definition, and a generated face is unique to each account.
Transaction monitoring
Is this money movement unusual?
Nothing until the account is open and money is moving. A fresh mule account looks quiet first.
NeuroVerify
Is this face real, live and unaltered?
One risk score from six signals with the evidence behind it, returned inside the flow in under 200 ms at p95 on eligible image requests.
NeuroDetect
What exactly was manipulated, and can we show it?
Region, frame and audio-segment findings and a forensic report for the case file, the SAR narrative or a dispute.
For the product rows, the last column is what the check adds.
An invisible control
Six requests, one budget. Only the fakes feel it.
Every request is checked inside the same latency budget. Clear results continue with no added step. Flagged ones are routed by the policy you wrote for that flow.
- Account openingNeobank · selfieiOS SDKAll six signals clearAccount opened
- Account openingNeobank · selfieAndroid SDKFace Manipulation DetectionHold · fraud review
- Limit increaseWallet · step-up selfieFlutter SDKAll six signals clearLimit raised
- Account recoveryNew device · selfie videoiOS SDKLive Presence VerificationBinding frozen · call back
- Credit applicationBNPL · selfieRESTAI Generative Model AnalysisDecline path · review
- Account openingCrypto exchange · selfieAndroid SDKAll six signals clearAccount opened
What to do with the result
Friction only where the score says so.
Write the route for each answer before go-live. A fraud ring learns from every rejection message, so say less than you know.
Clear
All signals below your threshold.
The customer continues with no added step. The score is logged against the session for later review.
Flag at onboarding
The selfie or video scores above your threshold before the account exists.
Do not open on the score alone, and do not hard-decline on it either. Ask for a fresh capture or send the application to review. Never say which signal fired.
Flag at step-up or recovery
The face on a new device, limit change or recovery request scores above threshold.
Freeze the device binding or the change. Contact the customer on a channel already on file, not one the requester supplied.
No result
Unusable capture, timeout or unsupported media.
Retry once, then fall back to review or another proofing route. A missing result is never treated as a pass.
Regulation and guidance
Regulators now name the injected face.
What each text says, in plain terms. None of it is a compliance claim for Neural Defend. Your compliance team decides what applies to your licence.
- FinCEN · United States
Alert FIN-2024-Alert004, 13 Nov 2024
Names deepfake identity schemes against financial institutions. Red flags include a customer using a third-party webcam plugin during live verification and a photo or video flagged by deepfake detection software. SARs should carry the key term FIN-2024-DEEPFAKEFRAUD.
Read the text - EBA · European Union
Remote onboarding guidelines, EBA/GL/2022/15
Applies since 2 October 2023. In unattended onboarding, the photo or video must be taken at the time of verification and liveness detection must be performed. Injection attacks target exactly that requirement.
Read the text - EU AML Regulation 2024/1624
Applies from 10 July 2027, supervised with AMLA
Article 22(6) allows identity verification through eIDAS electronic identification at “substantial” or “high” assurance. Article 76(5) requires meaningful human intervention when an automated or AI-driven process decides whether to onboard a customer.
Read the text - NIST · United States
SP 800-63A-4, final July 2025
Section 3.14 covers digital injection prevention and forged media detection. It describes attacks that insert forged media between the capture device and the system doing the comparison.
Read the text - FATF · Global
Guidance on Digital ID, March 2020
Non-face-to-face onboarding that relies on a reliable digital ID with appropriate risk mitigation may present a standard, or even lower, level of risk. The reliability of the remote evidence is the condition.
Read the text
In the EU, eIDAS digital identity wallets will change what remote proofing looks like. eIDAS and EUDI wallet identity proofing
Integration
Built for teams that ship weekly.
Add the SDK to your capture screen
Android/Kotlin, iOS/Swift or Flutter, on the selfie or video step you already run.
Call it from your backend
Python, TypeScript/Node, Go, Java or REST. One call per face, image, video or audio sample.
Route in your decision engine
Continue, recapture, step up or hold, on thresholds you set per flow and segment.
Send escalations to NeuroDetect
Investigators open flagged media in a case workspace and export the forensic report.
SDK-first integration
One API.
Every stack.
Native SDKs for the capture screen on Android, iOS and Flutter, and Python, TypeScript, Go and Java for your backend. Two lines to integrate; live in under 24 hours.
Sign in for API access$ npm install @neuraldefend/sdk
import { NeuroVerifyClient } from "@neuraldefend/sdk"
const result = await new NeuroVerifyClient().detectImage("selfie.jpg")Mobile SDKs
Native capture apps- KAndroid (Kotlin)
- SiOS (Swift)
- FFlutter
Backend SDKs
Server-side checks- PyPython
- TSTypeScript / Node.js
- GoGo
- JJava
REST API
For everything elseAlready have capture? Send the image to POST /detect/image and get every signal back in one JSON response.
AI agents
MCP serverGive approved AI assistants bounded image and video authenticity tools, with API keys kept outside prompts.
Two lines to integrate<200 ms p95Live in under 24 hours
NeuroVerify ranked #1 of 36 systems on VendorBench-100 (MCC 0.876 vs 0.646 next best). ISO/IEC 27001 · 27701 · 42001 · SOC 2 Type II.
Knowledge centre
Read next, by the team that owns the problem.
Sources
Read the evidence yourself.
Third-party publications. None of them evaluates or endorses Neural Defend. Vendor research is labelled as such.
- EuropolInternet Organised Crime Threat Assessment (IOCTA) 2026
Neo-bank onboarding abused to register a continuous stream of accounts; a SIM-farm service of 1,200 devices behind more than 49 million online accounts.
- FinCENIdentity-Related Suspicious Activity: 2021 Threats and Trends
Jan 2024. About 1.6 million of 3.8 million BSA reports in 2021 were identity-related, totalling $212 billion in suspicious activity.
- FinCENAlert on Fraud Schemes Involving Deepfake Media (FIN-2024-Alert004)
13 Nov 2024. GenAI identities used to open accounts that launder scam proceeds; red flags including third-party webcam plugins.
- Entrust (vendor report)2026 Identity Fraud Report
18 Nov 2025. Deepfakes in one in five biometric fraud attempts; deepfaked selfies up 58%; injection attacks up 40%. Based on Entrust’s own verification traffic.
- US Federal Trade CommissionImposter-scam and 2025 fraud loss data
15 Jun 2026. About $16 billion in reported fraud losses in 2025; $3.5 billion to imposter scams. Self-reported US data.
- European Banking AuthorityGuidelines on remote customer onboarding (EBA/GL/2022/15)
Applies from 2 Oct 2023. Capture at the time of verification and liveness detection in unattended onboarding.
- European UnionRegulation (EU) 2024/1624 (AMLR)
Applies from 10 Jul 2027. eIDAS-based remote verification (Art. 22(6)); human intervention in automated onboarding decisions (Art. 76(5)).
- NISTSP 800-63A-4: Identity Proofing and Enrollment
Final July 2025. Section 3.14, digital injection prevention and forged media detection.
- FATFGuidance on Digital ID
March 2020. Risk-based reliance on digital ID for remote customer due diligence.
Questions
What fintech fraud and product teams ask.
Compare the top 5 deepfake detection APIsDeepfake detection companies for fintechWill it add a step or slow down sign-up?
No new step. NeuroVerify analyses the selfie or video your flow already captures, and returns eligible image requests in under 200 ms at p95 under defined test conditions. Honest customers never see it. Only a flagged result adds friction, and your policy decides what that friction is.
Does it replace our identity verification vendor?
No. NeuroVerify does not analyse ID documents. It sits beside your document check and face match and answers the question they do not ask: is the face itself real, live and unaltered? Adding it to an existing KYC stack
What about injected video and virtual cameras?
Live Presence Verification is one of NeuroVerify’s six signals and checks whether the capture shows a live presentation. Face Manipulation Detection and AI Generative Model Analysis look at the face itself. Keep your device-integrity and emulator checks too. They catch different parts of the same attack.
Can a score decline a customer automatically?
Your policy decides, not the score. We recommend recapture or review rather than a silent decline. In the EU, Article 76(5) of the AML Regulation will require meaningful human intervention in automated onboarding decisions from July 2027. Your counsel decides how that applies to you.
Which platforms are supported?
Android/Kotlin, iOS/Swift and Flutter on the device; Python, TypeScript/Node, Go and Java on the server; plus REST and an MCP server. Two lines to integrate, live in under 24 hours.
How is customer data handled?
Neural Defend holds ISO/IEC 27001, 27701 and 42001 certifications and a SOC 2 Type II report. Retention and processing details are on the data handling page. Product data handling
See it on your own traffic
Find the farm in the accounts you already opened.
Bring onboarding selfies, step-up captures and recovery videos, including the ones you later confirmed as fraud. See what NeuroVerify scores, how fast, and where your policy would have routed each one.