Merchant Onboarding Fraud and KYB Controls: Where Deepfakes Get In and How to Stop Them

What merchant onboarding fraud looks like

Merchant onboarding fraud is any attempt to get a merchant account, payment facilitator sub-account or business loan under false pretences. Acquirers, payment service providers, marketplaces and business lenders all see the same core patterns.

Front merchants present a legitimate-looking business to process payments for something else, a practice usually called transaction laundering. Bust-out merchants process normally for a while, then run a burst of fraudulent or refundable transactions and disappear with the settlement funds. Synthetic businesses are registered shells whose owners and directors are themselves synthetic or borrowed identities. Impersonation cases use a real company's details with an applicant who is not authorised to act for it.

Every pattern needs at least one person to pass identity checks. That is where generative AI helps the fraudster and where deepfake detection helps the reviewer.

The KYB control layers and where deepfakes attack each

Good KYB treats the business, its owners and its applicant as three separate things to verify. A registry entry proves a company exists; it says nothing about whether the person holding the phone is its director.

For banks in the United States, FinCEN's CDD Final Rule sets the ownership baseline: covered institutions must identify and verify the beneficial owners of legal entity customers, meaning any individual owning 25 percent or more and one individual with significant control. Payment and lending firms that are not covered often apply similar thresholds through card scheme rules or their own risk policy. Marketplaces carry parallel duties: the US INFORM Consumers Act and Article 30 of the EU Digital Services Act require them to collect and verify identity, bank and tax or registration details from the sellers they host.

Where deepfakes enter merchant onboarding

The representative selfie is the most common entry point. Many acquirers and payment facilitators run a consumer-style identity check on the person submitting the application. A face swap of a stolen identity, or a generated face matching a generated ID, passes a weak liveness check and gives the fraudster a verified applicant. The workflow on KYB authorised representative verification goes deeper on proving authority, not just identity.

Owner identity documents come next. FinCEN's November 2024 alert reports criminals using generative AI to alter or create images for driver's licences and passports, and combining them with stolen or fake personal data. For a business with three listed owners, each ID image is a separate opportunity.

Video calls are the third entry point. Higher-risk merchants are sometimes interviewed by video, and the FBI warned in December 2024 that criminals use real-time video to impersonate executives and other authority figures. A deepfaked director who answers questions confidently can be more persuasive than any document.

A merchant onboarding review workflow with deepfake checks

Run these steps for every new merchant above your low-risk threshold. Keep each result in the application record, and do not let a strong business check compensate for a weak people check.

For merchants in high-risk categories, add a live video interview and analyse the recording as well as the selfie. Ask questions only the real director would know from your own records, not from public filings.

• Verify the business in the official registry and confirm the tax ID, trading address and website match the declared activity.
• Identify every owner at or above your ownership threshold and one control person, and screen each against sanctions lists.
• Capture a selfie and liveness video from the authorised representative and run deepfake and manipulation analysis on both.
• Check owner and representative ID documents with document verification, and compare the representative's live face with their ID photo.
• Confirm authority to act, such as a board resolution or registry listing as director, through a channel you verify independently.
• Confirm the settlement bank account belongs to the business, then set the merchant's risk tier, reserves and monitoring rules.

Monitoring after onboarding: catching what got through

Bust-out and front merchants are designed to look clean at onboarding. FinCEN's alert lists indicators that apply directly to new merchant accounts: high volumes of chargebacks or rejected payments, rapid transactions on an account with little history, high payment volumes to higher-risk payees and withdrawals made immediately after deposits in ways that are hard to reverse. FinCEN also notes that accounts opened with generative AI identities have been used as funnel accounts.

When those indicators appear, re-open the onboarding file. Re-screen the representative's selfie and video with current models, check whether the same face or device appears on other merchant applications, and hold settlement while the review runs. The workflow on payment chargeback evidence review covers the dispute side.

How NeuroVerify fits KYB and merchant onboarding

NeuroVerify covers the people layer. One request analyses a representative's or owner's face image, video or audio across six signals, including Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis and AI Pixel-Level Manipulation, and returns a unified risk score with signal-level evidence. Eligible image requests complete in under 200 ms p95 under defined test conditions, so the check fits inside a self-serve signup.

The models build on ARCAS 1B, Neural Defend's own detection model. On the public VendorBench-100 benchmark of 100 adversarial still images, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor; one benchmark author also co-authored the ARCAS paper, and the corpus is public.

NeuroVerify does not analyse ID documents, registry certificates or bank statements. For suspected AI-edited business documents, analysts can upload them into a NeuroDetect case for forensic review alongside the representative's media. Deployment runs from managed cloud to on-premises and air-gapped, with ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications.