Deepfake Detection for Brokerage Account Opening: A Review Workflow for New Investor Accounts

Why Do Fraudsters Open Brokerage Accounts With Fake Identities?

A brokerage account is a place to receive money, convert it into assets and move it out again, often in larger amounts than a basic bank account allows. FINRA's Regulatory Notice 20-13 (5 May 2020) describes fraudsters using synthetic or stolen identities to open accounts, funding them with stolen bank details or diverted government benefits, and then withdrawing quickly. Regulatory Notice 20-32 (17 September 2020) adds a trading pattern: fraudulent accounts buying cheap options and selling them at inflated prices to accounts that have been taken over.

GenAI has made the identity part cheaper. FinCEN's alert FIN-2024-Alert004, dated 13 November 2024, reports that criminals used GenAI to alter or generate images on driver's licences and passports, combined them with stolen or fake personal data to create synthetic identities, and opened accounts that later served as funnel accounts or received the proceeds of scams.

Where Does Deepfake Detection Fit in Brokerage CIP?

The Customer Identification Program rule for broker-dealers, 31 CFR 1023.220, requires a written program that collects name, date of birth, address and an identification number, and verifies identity within a reasonable time before or after the account is opened, through documents, non-documentary methods or both. It also requires procedures for what happens when identity cannot be verified, including when to restrict or close the account and when to file a suspicious activity report.

Most online brokerages meet the documentary part with a photo of an ID and a selfie that is compared with it. That selfie step is where deepfakes enter: a face swap that matches the stolen ID portrait, a fully synthetic face that matches a fabricated ID, or pre-recorded video played through a virtual camera to beat the liveness prompt. FinCEN lists a photo or video flagged by deepfake detection software, and a third-party webcam plugin used during live verification, among its red flags.

A Review Workflow for New Brokerage Accounts

Combine identity, device and funding checks, and let a weakness in any one of them slow the account down rather than block it outright. Many legitimate applicants fail one check for innocent reasons; fraud tends to show up as several small mismatches together.

The early life of the account matters as much as the opening. FINRA 20-13 suggests confirming that source and destination bank accounts match the customer's identity, reviewing the IP address of transfer requests, imposing holding periods on rapid transfers of newly deposited funds to third-party accounts, and notifying customers of bank account changes. Those controls catch accounts that slipped through onboarding.

• Collect CIP data and run non-documentary checks against consumer reporting or public databases.
• Capture the ID and selfie inside your app SDK; screen the selfie for face manipulation, generative artefacts and virtual camera signs before the face match.
• Look across applications for repeated phone numbers, addresses, emails, devices or bank accounts, and for completion times that suggest scripting.
• Require the first funding account to be in the applicant's name and verify it.
• Hold transfers out, including outbound account transfers, for a period after the first deposit.
• Restrict automated approval of several accounts opened by one person.

Why Brokerages Use Neural Defend NeuroVerify at the Selfie Step

NeuroVerify checks a face image, video or audio for deepfakes and manipulation beyond liveness in one API call. It returns a unified risk score with evidence from six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. Eligible image requests complete in under 200 ms at p95 under defined test conditions, so it does not lengthen a mobile sign-up.

On the public VendorBench-100 benchmark of 100 adversarial still images covering face swaps, AI photo edits and avatar compositing, Neural Defend ranked first of 36 systems by MCC, 0.876 against 0.646 for Reality Defender in second place, with precision of 0.963 and recall of 0.987. One VendorBench author also co-authored Neural Defend's ARCAS 1B paper, so weigh that overlap; the corpus and results are public for any brokerage to rerun. The benchmark covers still images only.

NeuroVerify does not analyse ID documents, so it sits beside your document verification vendor rather than replacing it. Integration takes two lines through SDKs for Android, iOS, Flutter, Python, TypeScript, Go and Java, with deployment as a managed API, in a private cloud, on-premises or air-gapped.

Where Selfie Screening Stops Helping

Selfie screening catches manipulated faces. It does not catch a real person who opens an account in their own name and rents it to a fraud ring, or a synthetic identity that uses the fraudster's own genuine face with fabricated data. Funding checks, behavioural monitoring and cross-account link analysis cover those cases.

Opening is also the moment to collect a trusted contact person. FINRA Rule 4512 requires firms to make reasonable efforts to obtain the name and contact details of a trusted contact aged 18 or older for non-institutional accounts, and to tell the customer that the firm may contact that person about suspected exploitation. The trusted contact has no authority over the account, but gives the firm someone to call if a later instruction looks coerced or the customer becomes unreachable.

Record the decision trail for each new account: CIP data and verification results, the selfie risk score and model version, linked-application findings, funding verification, any holds placed, and the reason an exception was approved. When an account is later linked to fraud, that trail supports the suspicious activity report and shows examiners how the CIP worked in practice.