How Onfido battles deepfakes and helps protect multimillion-pound fraud
In 2024, a British professional services firm lost £20 million in one of the world’s largest identity theft scams to date.
Highly evolved deepfake technology allowed fraudsters to pose as the company’s chief financial officer, and it took just one email and a single videoconference for the scam to take place.
Later that year, cybersecurity firm KnowBe4 fell victim to another deepfake incident – this time internally. Despite conducting video interviews, background checks, and reference verifications on all new staff members, one new hire turned out to be a threat actor using identity theft and AI-enhanced photograph. Once inside the company, the fraudster began loading malware onto company devices.
These issues not only highlight the importance of rigorous security policies, but the importance of rigorous hiring checks. When up against sophisticated, fast-developing technology used in deepfake fraud and identity theft, background checks and reference verifications may no longer be enough to protect companies from the sort of attacks experienced by KnowBe4.
Having intelligent tools and meticulous processes in place to identify deepfake attacks is vital, particularly with the rise in remote hiring practices. It’s not only an important part of meeting your hiring regulations, but most importantly will protect your business, your employees, and your customers.
Combatting deepfake fraud and identity theft with Amiqus
Amiqus’ photo ID checks are powered by Onfido, market-leaders in this space. Onfido apply a multi-layered approach to combat the rising threat of deepfakes to commit fraud.
Our Photo ID checks include document verification and a motion liveness check with biometric verification, requiring your candidates to complete a ‘selfie’ video that includes turning their head from side to side. Our motion liveness check has been tested by iBeta to L1 and L2 (Motion). The results of those tests can be found on the iBeta website as “Onfido Liveness” (iBeta Quality Assurance conduct Presentation Attack Detection (PAD) testing in accordance with ISO/IEC 30107-3.)
This active liveness element defends against advanced attacks, raising the barrier of entry for fraud by enforcing a live capture that can analyse multiple frames to better detect anomalies that arise from deepfakes. On top of this, additional checks are carried out to further mitigate the risk of deepfakes by utilising additional data sources and signals gathered during the check process.
Document verification: Your candidates take a photo of their identity document, and highly sophisticated AI verifies the visual, data, and metadata elements of the document in seconds to confirm whether it’s a genuine or fraudulent document.
Biometric verification: A biometric step helps verify that an identity document belongs to the person presenting it, protecting businesses from stolen IDs and impersonation fraud. Candidates are required to record a video of their face, turning their head from side to side for a multi-dimensional capture, and we compare the photo on the ID to their biometrics.
Repeat fraud detection: Fraudsters tend to re-use information (such as names, document numbers, and faces) across different checks. We detect repeat information across documents, and check for duplicate faces within an organisation’s system to catch repeat fraudsters.
Data verification: Trusted data sources, including global databases (watchlist, sanctions, and PEPs lists) and automated proof of address, help build a more accurate picture of a candidate’s identity.
Passive signals: Device intelligence, geolocation, and repeat fraud signals work in the background alongside a document and biometric check to detect other fraud markers without impacting user experience.
The multi-layered process utilises a number of different steps to detect fraud, such as:
At the source (video input): Leveraging background signals to check for suspicious activity or specific patterns linked to the media or device submitting the check. Our motion checks can detect fake webcams, emulators, or network injection attacks where fraudsters try to subvert the live capture.
At presentation (video content): Enforcing real-time biometric capture experiences that require some form of dynamic interaction, and analysing that video content to detect anomalies or inconsistencies in the facial movement.
At submission (cross-comparing): Leveraging AI systems and machine learning (ML) to detect deepfakes if the deepfake has made its way into the back end. The unique AI micro-model architecture combines over 10,000 machine learning models designed to detect specific fraud markers. These micro-models analyse pixel-level variations in document colour, shape, and texture to accurately assess authenticity. With this type of approach, Onfido can automate fraud prevention, detecting up to 50% more document fraud than approaches using generalised models.
—
Identity theft can have devastating effects, but while it’s a powerful and ever-changing technology, protecting your business is easier than it seems. By conducting all of your onboarding and staff verification checks through Amiqus, you’ll gain access to some of the most rigorous security measures possible to protect your business from all risks, not just deepfake fraud.
Speak with our friendly team today to strengthen your hiring practices, and stay protected.
