AI-generated deepfakes have changed the game. The 2026 data makes the case plainly: a single identity check is no longer enough — verification has to be layered.
Quick answer
Identity fraud has changed shape in 2026: AI-generated deepfakes now account for roughly one in five biometric fraud attempts, and standalone identity checks are no longer considered reliable on their own. The clear industry consensus is that single-check onboarding is failing — effective verification now layers document checks, biometrics, liveness detection and screening, treating identity as an ongoing control rather than a one-time gate.
The way criminals attack onboarding has fundamentally shifted. Cheap, convincing AI tools mean a fraudster no longer needs a stolen document — they can generate a synthetic face, a deepfaked selfie, or inject fake video straight into a verification flow. For any firm that verifies identity as part of onboarding, 2026’s fraud data is a wake-up call.
The numbers that matter
1 in 5
biometric fraud attempts now involve a deepfake (Entrust 2026)
+58%
increase in deepfaked selfie attempts in 2025 (Entrust)
+40%
year-on-year rise in injection attacks (Entrust)
Entrust’s 2026 Identity Fraud Report — based on analysis of over a billion identity verifications across 195 countries — found deepfakes linked to one in five biometric fraud attempts, deepfaked selfies up 58% in a year, and injection attacks (where fake data is fed directly into a system) up 40% year-on-year.[1] Other 2026 reporting points the same way: Gartner has noted that a large share of enterprises will stop treating standalone identity verification as reliable, precisely because of AI-generated deepfakes.[2]
Why single-check onboarding is failing
The core lesson from the 2026 data is blunt: if your onboarding relies on a single check, attackers will eventually learn to bypass it.[3] A lone selfie match, or a document scan on its own, is now a soft target. The response that security researchers converge on is multi-layered verification — no single check catches everything, so document verification, biometrics, liveness detection, database checks and AML screening each catch a different type of risk.[3]
Key takeaway
Treat identity as a layered, ongoing control, not a one-time gate. Point solutions that only verify at sign-up leave gaps; the strongest approach makes a synthetic input beat several independent checks at once — document, biometric, liveness and screening together.
The ‘More Than ID’ connection
There’s a strategic point here for regulated firms. The 2026 fraud data is the clearest possible argument for not treating onboarding as a single ID check bolted onto a form. When identity verification sits inside a complete onboarding journey — alongside document collection, AML/KYC, PEP and sanctions screening and a full audit trail — you get exactly the layered defence the research recommends. The check isn’t the whole journey; it’s one hardened component within it.
Add expert quote before publishing
“A single selfie match was never going to hold the line against AI-generated fraud. The firms that stay ahead are the ones treating identity as one layer inside a wider onboarding journey — document, biometric, liveness and screening working together — rather than a single gate a deepfake only has to beat once.”
— Suggested placeholder for a quote from Osman Ismail (founder input, OnBoardNow / DPS Software). Replace with a real, approved quote, or remove.
The cost of getting it wrong — and the pressure to get it right
The stakes are rising on both sides. UK financial-services compliance spend has reached an estimated £38.3 billion a year, up 12%, and the vast majority of businesses have adopted or plan to adopt AI and machine-learning tools for financial-crime screening.[3] At the same time, onboarding friction remains a real business cost — reports put average identity-verification abandonment around a third of users — so the answer isn’t simply “more checks,” it’s smarter, layered checks that stay fast for the genuine client.
Statistics are drawn from the cited third-party reports and reflect those providers’ own verification data; they may not mirror the whole market. Verify against the primary source before quoting.
What to do about it
- Don’t rely on a single check. Combine document verification, biometrics and liveness detection so no one bypass defeats the whole process.
- Add liveness and injection-attack defence. These are specifically what deepfakes and injection attacks target.
- Layer screening into onboarding. AML, PEP and sanctions checks catch risks identity alone can’t.
- Keep it fast for genuine clients. Friction drives abandonment — the goal is layered but smooth.
- Keep an audit trail. Evidence of a robust, multi-layer process is itself a control.
Layered identity verification, inside a complete onboarding journey
OnBoardNow combines document capture, a liveness-checked biometric match and AML/PEP/sanctions screening in one guided journey — the layered defence the 2026 fraud data calls for, with a full audit trail. That’s onboarding that’s More Than ID.Book a demo →
Frequently asked questions
How common are deepfakes in identity fraud now?
2026 reporting from Entrust links deepfakes to around one in five biometric fraud attempts, with deepfaked selfie attempts up 58% in a year — a sharp rise driven by cheap AI tooling.
Is a selfie check enough to verify identity?
Increasingly, no. Industry research indicates standalone selfie or document checks are no longer considered reliable in isolation because of AI-generated deepfakes; layered verification is now the recommended approach.
What is an injection attack?
An attack that feeds fake or manipulated data (such as a deepfake video) directly into a verification system, bypassing the camera. Reports show these rising sharply, which is why liveness and injection defences matter.
How do I protect onboarding against AI fraud?
Layer your checks — document verification, biometrics, liveness detection and AML screening together — so a synthetic input has to defeat several independent controls at once, ideally within one onboarding journey.
Leave a Reply