9 deepfake red flags to watch for at account opening
FinCEN’s 2024 alert lists the warning signs of deepfake identity fraud. Here’s what they look like in a remote onboarding flow — and how to respond.
In November 2024, the Financial Crimes Enforcement Network (FinCEN) issued Alert FIN-2024-Alert004, warning that criminals are using generative AI to create fake identity documents, photos and videos to open accounts. FinCEN said it had seen an increase in suspicious activity reports describing suspected deepfake media.
The alert is written for banks and credit unions, but the red flags apply to any business that verifies customers remotely. Below are the identity-related indicators from the alert, and what each one tends to look like in practice.
Red flags in the identity evidence
- A photo that looks altered or doesn’t fit the other details. For example, an ID portrait that looks far younger or older than the date of birth suggests.
- Identity documents that conflict with each other. A name or date of birth that differs between the front of a license and its barcode, or between two documents.
- Documents that conflict with the rest of the customer’s profile. An address, age or name that doesn’t match what the applicant entered.
- A customer who can’t satisfactorily verify their identity, source of income or other profile details when asked.
- Images flagged by detection tools, including reverse-image searches that match galleries of AI-generated faces.
Red flags during live verification
- A third-party webcam plugin used during a live check — a common way to inject pre-recorded or synthetic video.
- Switching communication methods after “glitches” during live verification.
- Declining multifactor authentication.
- Device or location data that conflicts with the identity documents — for example, a network or time zone inconsistent with the stated address.
What FinCEN recommends
The alert points to practical controls: multifactor authentication, live verification checks such as audio or video prompts, re-reviewing account-opening documents when deepfakes are suspected, checking image metadata, and managing the risk of any third-party identity verification provider you rely on.
How this maps to a modern verification flow
- Randomized live prompts. Asking the person to perform head movements they can’t predict in advance makes pre-recorded video far less useful.
- Cross-checking sources. Comparing what’s printed on an ID with its barcode and with what the applicant entered surfaces conflicting details automatically.
- Capture and device signals. Flagging screen photos, editing software in image metadata, VPNs and mismatched time zones gives reviewers context.
- Duplicate detection. A face or document already seen under another name is one of the strongest signals of organized fraud.
- A clear audit trail. If you do file a suspicious activity report, FinCEN asks institutions to reference the key term FIN-2024-DEEPFAKEFRAUD; having the evidence and decision history in one place makes that much easier.
No single check stops every attack. The goal is layered evidence that a real, present person matches a real document — and a reviewer who can see why a case was flagged.
Source: FinCEN, Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (November 13, 2024). This article is general information, not legal or compliance advice.
