How Do I Assess Deepfake Exposure Across a KYC Journey? A Risk Assessment Method

How do you assess deepfake exposure across a KYC journey?

You assess deepfake exposure the same way you assess any fraud risk, applied to one question: at which steps could AI-generated or manipulated face, video or voice evidence be accepted as genuine, and what would that cost? The method below has four steps: inventory, score, test and act.

There is a regulatory reason to do it formally. NIST SP 800-63A-4, published in July 2025, says identity proofing providers shall evaluate the risks associated with each identity proofing option they offer, and shall run a fraud management program with fraud identification, detection, investigation, reporting and resolution. It also requires them to monitor the performance of their fraud checks and recommends periodic independent testing such as red teaming. A documented deepfake assessment feeds directly into that program.

The scope is the whole journey, not just onboarding. Attackers who fail the front door move to account recovery, device rebinding and limit increases, where checks are often lighter.

Step 1: Inventory every touchpoint that accepts biometric evidence

Walk the journey end to end and list every step where a customer submits a face image, video or voice sample, or where an agent sees or hears them. For each, record the capture channel (native app, mobile web, desktop web, agent video call, phone), whether a person watches in real time, which vendor and model version runs each check, and what passing the step gives the customer access to.

The table shows the touchpoints most KYC journeys have and the questions to ask at each. Add any your journey has that this one does not, such as merchant or business onboarding.

Step 2: Score each touchpoint for likelihood and impact

Score likelihood from how the step is built, and impact from what passing it gives an attacker. Keep the scale simple (low, medium, high) so the assessment is repeatable and different reviewers reach the same answer.

Likelihood rises with unattended capture, web flows that accept any camera device, apps without attestation, straight-through decisions with no review, and checks limited to presentation attack detection. Industry data supports weighting injection heavily: Gartner reported a 200% increase in injection attacks in 2023, and iProov recorded a 255% rise in digital injection attacks against mobile web platforms and a 353% rise in emulator use between the first and second halves of 2023.

Impact rises with what the step grants: an instant credit line, payout capability, high transfer limits, or an account that can receive third-party funds. FinCEN's November 2024 alert reports accounts opened with suspected AI-generated identities being used to receive and launder proceeds of other frauds, so an account with no credit can still carry high financial crime impact.

Multiply the two into a priority, then note existing controls and residual risk. A high-likelihood, high-impact step with only presentation attack detection is your first target. The error cost model helps translate residual risk into expected losses and review costs.

What should we check first if we suspect our onboarding is exposed to deepfakes?

Check the accounts you have already opened before redesigning anything. FinCEN notes that financial institutions often detect AI-generated content in identity evidence by re-reviewing account-opening documents, and that reverse image searches can match an identity photo to an online gallery of AI-generated faces. Start with a look-back over the period you are worried about.

Preserve evidence first: raw media, session and device identifiers, app version, timestamps and decision logs, before any retention job deletes them. Then work through the checks below, roughly in this order.

• Run onboarding selfies and videos from the suspect period through a deepfake detector in batch and review the highest scores by hand.
• Search for the same face across different names, and for different faces on the same device, IP range or payout account.
• Check capture logs for virtual camera device names, emulator fingerprints and rooted or jailbroken devices.
• Look for FinCEN red flags: a third-party webcam plugin during live verification, requests to switch channel after repeated claimed glitches, and device or location data inconsistent with the ID.
• Review post-onboarding behaviour of flagged accounts for rapid pass-through, high chargebacks or payments to higher-risk payees.
• Map confirmed cases back to the touchpoint and channel they used, which tells you where Step 2 scores were too low.

Step 3: Test the highest-risk steps with attack media

A score on paper is a hypothesis; testing confirms it. Build a test set of genuine captures from your own customer population and attack media for each path you scored: face swaps, generated faces, reenacted video, replayed genuine recordings and cloned voices. Deliver each through every route the step exposes, including the genuine app camera, a virtual camera, an emulator and a direct API call.

Record results per attack type and per route. NIST SP 800-63A-4 requires automated image analysis to be tested against available attack artifacts, with false negative rates documented and made available to relying parties on request. For injection, CEN/TS 18099:2024, valid since 16 December 2024, gives guidance on creating test plans for injection attack detection; presentation attack testing stays with ISO/IEC 30107.

Retest whenever a vendor model, app version or capture SDK changes. A control that passed last quarter can regress after an update without anyone noticing.

Step 4: Close the gaps and set reassessment triggers

Match each confirmed gap to the control that owns it. Manipulated or generated faces need media analysis on every submission. Injected streams need device attestation, virtual camera checks and session binding. Replayed genuine media needs freshness checks and duplicate search. Weak review needs signal-level evidence and clear thresholds for reviewers.

Keep the assessment as a living register with an owner for each touchpoint. Reassess when you add a channel, change a vendor or model, see a new attack tool in threat intelligence, or confirm a deepfake case. The World Economic Forum's January 2026 report found that only a few of 17 face-swap tools offered genuine real-time swapping, but those are the ones organised groups use, and the set changes quickly.

How NeuroVerify supports the assessment and the fix

NeuroVerify is useful at two points. During the assessment, it can score historical selfies, videos and voice samples in batch through the same API you would use in production, so the look-back and the test plan produce signal-level evidence instead of a single yes or no. After the assessment, it becomes the media-analysis control on each touchpoint you flagged.

One request runs six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. Eligible image requests return in under 200 ms p95 under defined test conditions. On the public VendorBench-100 still-image benchmark, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor; one benchmark author also co-authored Neural Defend's ARCAS 1B paper, and the corpus is public for anyone to rerun.

NeuroVerify does not analyse ID documents or detect emulators and virtual cameras, so the assessment should still assign those gaps to document verification and device tooling. Deployment can be managed cloud, private cloud or VPC, secure container, on-premises or air-gapped, which matters when historical customer media cannot leave your environment.