7. Environment-calibrated models – Develop model packs optimized for real-world conditions (e.g. mobile front cameras, low-light environments, low bandwidth) to reflect actual customer scenarios. This reduces false positives and improves detection rates in challenging conditions. 8. Policy integration hooks – Offer flexible APIs to trigger additional verification (e.g. document checks or human reviews) based on detection outcomes. 9. Sandbox testing frameworks – Provide a safe test suite to A/B test prompts, thresholds and device policies. This serves as a staging lab for liveness tuning and helps teams adjust configurations and quantify trade-offs before rollout. Fraud teams (risk engines and monitoring units) Fraud teams are responsible for operational monitoring and analytics-based risk assessment. The following practices enhance detection depth and accuracy: 1. Trusted camera source control – Allowlist native device cameras, and log or block sessions initiated from virtual or swapped sources. This policy and telemetry ensure trusted capture paths and prevent synthetic feeds from entering undetected.2. Timing correlation and latency analysis – Record prompt timestamps and measure user reaction latency to detect non-human response patterns. 3. Contextual signal correlation – Gather device, browser and encoder metadata to identify anomalies linked to synthetic or automated environments. 4. Step-up verification frameworks – Define pre-approved escalation actions when risk thresholds are exceeded (e.g. additional document checks or human reviews). This converts risk signals into controlled friction only when needed. 5. Post-compression artefact analysis – Inspect the ingested video stream for compression-level artefacts indicative of manipulation. 6. Standardized case taxonomy – Establish consistent labelling (e.g. “suspected face swap,” “timing anomaly”) to enable model feedback loops and analytical consistency. 7. Threat chain correlation – Combine camera anomalies, timing data and transaction risk metrics to identify multi- stage attack sequences. This helps uncover combined attacks that single checks might miss. 8. Closed-loop feedback to vendors – Regularly provide verified outcomes to KYC vendors to improve model performance and reduce false detections. Unmasking Cybercrime 17

Unmasking Cybercrime Strengthening Digital Identity Verification against Deepfakes 2026