Executive summary Deepfakes mean identity has become synthetic, scalable and weaponizable. Deepfakes – artificial intelligence (AI)-generated audio and visual media that convincingly imitate real people – have rapidly evolved from entertainment tools into a material threat to digital identity systems.1 Their misuse in know- your-customer (KYC) and remote verification processes now creates financial, operational and systemic risks for any institution that relies on digital trust. Face-swapping attacks already span three levels: • Individual: Fraudsters can open accounts, take out loans or conduct transactions using synthetic identities, while manipulated media can be used to damage reputations. • Organizational: Attackers can bypass onboarding and KYC controls, impersonate staff or executives, steal data and trigger high-value kinds of fraud (such as unauthorized wire transfers). • Systemic: At scale, these attacks erode confidence in digital commerce, weaken regulatory compliance and threaten the stability of broader financial ecosystems. An analysis of 17 face-swapping tools and related camera injection techniques confirms a clear shift: while many tools remain imperfect, a subset already deliver real-time, high-fidelity impersonation capable of undermining digital KYC. Threat actors increasingly combine stolen or AI-generated identity documents, high-quality face- swap media and camera injection methods to defeat live verification. Over the next 12–15 months, five trends will accelerate risk: widespread access to advanced AI tools, increased targeting of financial services and cryptocurrency, higher-fidelity face swaps, growth of scalable injection attacks and fragmented global regulation. This paper outlines concrete recommendations for three key stakeholder groups: • KYC providers: Invest in stronger liveness and injection attack detection, synthetic media forensics and real-time anomaly monitoring. • Fraud and risk teams: Shift to risk-based monitoring that correlates identity signals across channels, incorporate threat intelligence feeds on emerging deepfake tooling, and regularly stress-test verification pipelines. • Financial institutions: Establish governance frameworks that mandate resilience testing, ensure procurement standards reflect modern AI-driven threats and coordinate with regulators to accelerate convergence on deepfake- aware controls. Deepfakes mark a turning point in cybercrime: identity itself has become synthetic, scalable and weaponizable. Sustaining trust in digital identity systems will require coordinated action, innovation and a shared commitment to security standards. The institutions that adapt early will be best-positioned to protect customers, safeguard digital ecosystems and preserve the integrity of global financial infrastructure. Unmasking Cybercrime 3

Unmasking Cybercrime Strengthening Digital Identity Verification against Deepfakes 2026