AI-generated fraud and fake IDs

A fake ID used to be a physical object. Someone had to print it, laminate it, and hand it over while standing in front of another human. Every step carried cost and risk, which kept identity fraud artisanal. Online onboarding changed the medium — services began accepting photographs of documents — and generative tools changed the economics. A document image with plausible layout, typeface, microprint texture and a synthetic portrait can now be produced by anyone, at effectively no cost, and submitted to a thousand services in an afternoon.

The same applies to the face itself. Verification flows that ask for "a selfie holding your ID" were designed to bind a document to a person. When both the document image and the selfie can be generated to match each other, that binding is theatre. Fraud has industrialised; inspection has not.

Any check that examines a submitted image is playing a losing game, because the attacker controls everything about the image. Detection models can spot common generation artefacts, and they matter as one layer — but they are locked in an arms race in which each detector improvement trains the next generator. A verification system whose only defence is "our model can tell fakes from real" is making a promise that decays.

Robust systems change the game instead of playing it better. They stop asking "is this image real?" and start asking questions the attacker cannot answer by generating pixels: can you respond to a challenge in real time? Can your device prove its integrity? Does your evidence carry a cryptographic chain back to a verifiable event?

No single layer is unbeatable; the design assumption is that each layer multiplies the attacker's cost. The mobile wallet implements this full stack, and the network's scoring model combines the signals into a composite score rather than a single pass/fail that one bypass could flip.

• Active liveness. The capture flow issues unpredictable challenges — blink, turn your head, smile — and requires the response live. A generated video prepared in advance cannot answer a prompt it has not seen. This is why the wallet's selfie step is a challenge sequence, not a photo upload.
• Guided capture, not file upload. The wallet's document step uses the camera directly with edge detection and glare checks — the evidence is produced inside the session, not selected from disk, which removes the easiest injection path for generated images.
• Hardware-backed biometrics. At higher verification levels, fingerprint or iris capture happens inside the phone's secure hardware. Generating an image does not help an attacker who needs to defeat a physical sensor.
• Device integrity attestation. Google Play Integrity and Apple App Attest let the device prove the app is genuine and the operating system untampered — blocking the emulators and instrumented devices that industrial fraud depends on.
• Cross-checks between evidence types. Document OCR, face matching between document portrait and live selfie, and scoring across all signals mean a fraudster must defeat every layer simultaneously and consistently.

Anti-fraud design has a second obligation that is easy to forget: it must not turn honest users into collateral. Systems that respond to fraud by hoarding evidence create breach risk for everyone; systems that respond with opaque bans create Kafkaesque appeals. The wallet's approach is to make verification strong at the moment it happens, keep the evidence encrypted and out of services' hands, and record outcomes — not raw biometrics — on the network.

A failed check is also not an accusation. Most failures are practical — lighting, glare, an expired document — and the flow is designed for retry without penalty, as the if verification fails guide explains.

If your service still verifies identity by accepting uploaded document photos, you are accepting evidence that is now trivially synthesisable. The practical alternative is to rely on a verification layer that performs challenge–response capture and hands you a cryptographically verifiable result — a tier, a score threshold, a yes/no proof — rather than media you must judge. That is precisely the interface described in the integration overview, and the path to using it starts at becoming a verifier.