Identity fraud is entering a new phase. For as long as governments have issued identity documents, scammers have looked for ways to reproduce them convincingly enough to pass as genuine. As Maksim Karandashov, CTO of X-faces, notes, what has changed is not the motive, but the technology available to fraudsters.
Today, the incentives haven’t changed but the technology has. Cameras, synthetic media and artificial intelligence can now be combined to generate a face, reproduce a voice and create a convincing video of someone who isn’t even present. Tools that once required specialist technical skills are increasingly available off the shelf, lowering the cost and complexity of identity fraud.
For remote digital verification, this creates a fundamental problem. Even highly accurate document verification and facial matching are only as trustworthy as the image or video entering the system. If an attacker can manipulate the capture process, replay prepared media or inject a synthetic feed before that material reaches the matching engine, downstream checks may be analysing fabricated evidence.
This is why identity fraud prevention increasingly needs to begin at the point of capture.
“The technical gap is increasingly about how the incoming media reaches the verification system,” says Maksim Karandashov, CTO of X-faces, a KYC and fraud prevention platform developed for the iGaming industry. “Facial matching can tell you whether two faces appear to belong to the same person. But that is a different question from whether the video stream itself represents a real person who is physically present at that moment. If manipulated or pre-recorded media enters the process upstream, everything that happens afterwards is analysing compromised input.”
The iGaming sector, where X-faces began, is becoming an increasingly important battleground for digital identity fraud. The battle has intensified with the arrival of AI. In its 2026 risk assessment, the UK Gambling Commission reported an increase in both the scale and sophistication of attempts to bypass KYC and customer due diligence checks using false documentation, deepfake videos and AI-generated face swaps.
The trend extends well beyond gambling. UK government data shows that reports of suspected AI-enabled fraud increased by 469% between 2023 and 2025, while the Government Office for Science estimates that around eight million deepfakes were shared in 2025, compared with just half a million two years earlier. The barriers to entry are falling too. INTERPOL’s 2026 Global Financial Fraud Threat Assessment reports that Deepfake-as-a-Service is already being offered on dark web marketplaces, alongside ready-made synthetic identity kits combining AI-generated video, cloned voices and biometric data.
Underestimating these attack vectors brings significant financial and regulatory consequences. 2026 research by IBM found that AI-driven attacks increased by 56%, with deepfake impersonation among the leading forms of AI-enabled attack. The global average cost of a data breach reached $4.99 million, up 12% from the previous year and the highest level recorded by the study. These events serve to underline the importance of securing cameras as the first layer of security for a company.
Rebuilding the identity capture layer
The growing sophistication of identity fraud exposes a fundamental limitation in remote verification. A system must be able to trust not only the identity evidence it analyses, but also the way that evidence enters the verification process.
Anybody who uses the internet is familiar with the ubiquitous “I’m not a robot” checkbox. What’s less known is that security isn’t provided by checking the box itself, but by how the system measures human behaviour. Systems assess a wide range of behavioural and contextual signals to determine whether an interaction is likely to be human. This adds an effective layer of defence because it evaluates how the action happens, rather than simply looking at the outcome.
X-faces applies the same principle by combining biometric analysis with controls over how media is captured and submitted. The aim is to increase confidence in the input before downstream matching begins.
“There’s still a mindset out there that says what you see is what you get – you’ve checked the person using a camera, so it’s watertight, right?” says Maksim Karandashov. “But we inherently know that’s not true. This is the cognitive dissonance that we see as a gap for us to address. What we’re trying to get across is that if the feed to the camera is manufactured or injected before it hits your system, all your downstream logic is just processing fiction. We realised we had to secure the entry point first.”
“Preventing spoofing means controlling the media acquisition process directly within the user workflow,” says Maksim Karandashov. “So, instead of relying on external file uploads, X-faces can require live, real-time capture and pair it with liveness checks. The system analyses subtle movements and facial expressions, including gaze direction and head position, in real time. This helps establish that a living person is physically present during capture.”
Securing this entry point requires closing the loopholes that commonly exist in open web environments. On desktop browsers, bad actors can easily route deepfakes using virtual camera software or extensions. X-faces eliminates this vector by transferring the verification session from desktop to a mobile camera via a dynamic QR code. Mobile operating systems enforce strict hardware sandboxing and native camera permissions that make media injection drastically more difficult.
These controls can also be adjusted to the operator’s needs. X-faces allows desktop uploads to be blocked and Live Capture Only to be enabled when stronger capture controls are required. This gives operators a way to raise the level of assurance without imposing the same verification flow in every case.
The commercial imperative of camera security
The advent of deepfake technology should serve as a wake-up call for organisations which have been relying on legacy biometric tools. Once a synthetic identity passes verification, the cost is rarely confined to the onboarding stage. It can surface later as payment fraud, account abuse, manual investigations or regulatory exposure. By pushing authentication upstream to the camera, organisations eliminate fraud vectors before they enter the pipeline, thereby protecting genuine customers while insulating the business against catastrophic financial loss and regulatory scrutiny.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Related reading
- Nexus Marketplace Grows Live: 400K IDs Added Daily [2026]
- Citrix NetScaler Bug Hits CISA KEV: 22,000 Exposed [2026]
- Oracle Patches 800+ Bugs, 104 Critical in Sept. 2026 CSPU
