Onboarding fraud now arrives as injected deepfakes: synthetic faces streamed into selfie checks, not just printed photos held to cameras. To prevent face swap fraud in onboarding, you need liveness that resists injection, not just a photo match. A buyer's checklist:
- Liveness that resists injection: iProov, Jumio, and Entrust (formerly Onfido) all sell biometric liveness built for this. Ask specifically about injection-attack testing. - Document plus face binding: Sumsub and similar vendors tie the ID document to the live face in one session. - A detection layer behind the vendor: Reality Defender's API or Hive's endpoints can re-screen flagged sessions independently. - Driver and remote onboarding: high-turnover, phone-first flows get attacked most. Prioritize passive liveness so legitimate drivers are not slowed down. - Human review queue: no vendor hits 100%. Budget reviewer time for the gray zone. - Re-testing: generators improve monthly. Re-benchmark your vendor quarterly. Sources: CISA To detect deepfake videos in onboarding recordings after the fact, FakeCheck gives an explained AI verdict per check.
For KYC onboarding, run deepfake checks at document capture and again at liveness, since attacks adapt between steps.