9 deepfake red flags to watch for at account opening
FinCEN’s deepfake alert lists nine red flags for AI-generated IDs, faces and video. Here’s what each one means and how to catch deepfake fraud at onboarding.
Deepfake fraud at account opening is when someone uses media made or altered with generative artificial intelligence (AI) — a fake ID image, a synthetic face, pre-recorded or generated video — to pass a remote identity check under an identity that isn’t theirs or doesn’t exist. The Financial Crimes Enforcement Network (FinCEN) warned about exactly this in Alert FIN-2024-Alert004, issued November 13, 2024, which lists nine red flag indicators.
FinCEN said that beginning in 2023 and continuing in 2024 it saw an increase in suspicious activity reports (SARs) describing suspected deepfake media in fraud schemes, and that these schemes often involve altered or fake identity documents used to get around identity verification. The alert is written for banks, credit unions and other financial institutions, but the red flags apply to any business that verifies customers remotely. Below are the nine indicators in the alert’s own terms, how criminals use deepfakes to open accounts, and the controls that help.
What is deepfake fraud?
The alert defines deepfake media as synthetic content that uses AI or machine learning to create “realistic but inauthentic videos, pictures, audio, and text.” FinCEN notes that generative AI (GenAI) tools have “greatly reduced the resources required” to produce this content, and that it can now be hard to tell apart from real, unmodified media.
Deepfake fraud is the use of that content to deceive a business or a person into handing over money, access or an account. It overlaps with deepfake identity theft: a criminal can put a stolen person’s details behind a generated face, or alter that person’s real ID photo.
Types of deepfake fraud
Based on the FinCEN alert and the FBI’s December 2024 public service announcement on generative AI fraud (I-120324-PSA), the main types are:
- AI-generated or altered ID images. FinCEN says some institutions reported criminals using GenAI to “alter or generate images” for documents such as driver’s licenses and passport cards and books, either by modifying a real source image or creating a synthetic one. The FBI says criminals generate fake driver’s licenses and credentials for identity fraud and impersonation.
- Synthetic faces. An identity photo that is entirely generated — FinCEN notes such photos sometimes match an online gallery of GenAI-produced faces.
- Pre-recorded or generated video. FinCEN warns that third-party webcam plugins “can let a customer display previously generated video rather than live video” during a live check.
- Voice and video impersonation. Both agencies describe deepfake voices and videos used to impersonate family members, executives or trusted contacts. The FBI also says criminals have accessed bank accounts using AI-generated audio clips of the account holder.
- Generated text. One of FinCEN’s red flags is GenAI text in a customer’s profile or in their answers to prompts.
The money at stake is growing. Deloitte’s Center for Financial Services predicts (May 2024) that generative AI could enable U.S. fraud losses to reach $40 billion by 2027, up from $12.3 billion in 2023.
The 9 red flags in the FinCEN deepfake alert
FinCEN stresses that no single red flag is necessarily a sign of illicit activity. You should consider the surrounding facts before deciding something is suspicious. We’ve grouped the nine indicators by where you would see them.
Red flags in the identity evidence
- The customer’s photo is internally inconsistent or doesn’t fit their other details. FinCEN’s examples: the photo shows visual tells of being altered, or the date of birth says the person is much older or younger than the photo suggests.
- The customer presents multiple identity documents that are inconsistent with each other. For example, a name or date of birth might differ between two documents.
- A reverse-image lookup or open-source search of the identity photo matches an image in an online gallery of GenAI-produced faces.
- The customer’s photo or video is flagged by commercial or open-source deepfake detection software.
- GenAI-detection software flags possible GenAI text in the customer’s profile or in their responses to prompts.
Red flags during live verification and from device data
- The customer uses a third-party webcam plugin during a live verification check — or tries to change communication methods during the check because of excessive or suspicious technical glitches.
- The customer declines to use multifactor authentication (MFA) to verify their identity.
- The customer’s geographic or device data is inconsistent with their identity documents. For example, an applicant’s ID might show a Texas address while their device reports a far-off time zone and a masked network.
Red flags after the account is open
- A newly opened account, or one with little transaction history, shows a pattern of rapid transactions, high payment volumes to potentially risky payees such as gambling websites or digital asset exchanges, or high volumes of chargebacks or rejected payments.
Other warning signs FinCEN mentions
Separately from the nine red flags, the alert lists signs that a document deserves extra scrutiny: inconsistencies among multiple identity documents, a customer who can’t satisfactorily authenticate their identity, source of income or another part of their profile, and inconsistencies between the ID and the rest of the customer’s profile. After opening, it also points to logins from an IP address that doesn’t fit the customer’s profile, coordinated activity across multiple similar accounts, and withdrawing funds right after deposit in ways that are hard to reverse.
How deepfakes are used to open accounts
According to FinCEN’s analysis of Bank Secrecy Act (BSA) data, criminals have used GenAI to create falsified documents, photographs and videos to get past financial institutions’ customer identification and customer due diligence (CDD) controls. Three patterns stand out:
- Synthetic identities. Criminals have combined GenAI images with stolen personally identifiable information (PII) or entirely fake PII to create synthetic identities. If that term is new to you, see our explainer on synthetic identity fraud.
- Accounts that receive and launder other fraud. FinCEN says criminals have successfully opened accounts with suspected GenAI identities and used them to receive and launder proceeds of scams, check fraud, credit card fraud, authorized push payment fraud, loan fraud and unemployment fraud.
- Funnel accounts. Accounts opened with GenAI-created identity documents have also been used as funnel accounts, which collect deposits from many locations for a criminal network.
FinCEN also notes that institutions often find deepfake documents by re-reviewing a customer’s account opening documents, and that some have found them through enhanced due diligence on accounts that showed other signs of suspicious activity.
Deepfake fraud prevention at onboarding
FinCEN names two best practices directly: MFA, including phishing-resistant MFA, and live verification checks in which a customer is prompted to confirm their identity through audio or video. It notes that criminals may be able to respond to live prompts with synthetic audio or video, but their responses may reveal inconsistencies — which is why people using deepfake identities may try to avoid or get around live checks. The alert also mentions examining an image’s metadata and using deepfake detection software, and reminds institutions that rely on outside identity verification providers to manage that third-party risk.
In practice, deepfake fraud protection works best as layers, so that beating one check doesn’t beat the whole process:
- Randomized active liveness. Asking the person to perform head movements they can’t predict in advance makes pre-recorded or pre-generated video far less useful.
- Cross-checks between sources. Comparing what’s printed on an ID with the barcode on the back of a U.S. driver’s license and with what the applicant typed into your application can surface the kinds of inconsistencies described in red flags 1 and 2.
- Capture and device signals. Flagging photos of screens, printouts, edited or old photos, VPNs and location mismatches gives reviewers context for red flag 8.
- Duplicate detection. A face or document already seen under another name can point to the kind of coordinated activity among similar accounts that FinCEN lists as a warning sign.
- Human review. A trained reviewer who sees the ID, selfie, scores and extracted data side by side can weigh the surrounding facts, as the alert asks.
- An audit trail. If you file a SAR, FinCEN asks you to include the key term FIN-2024-DEEPFAKEFRAUD in SAR field 2 (“Filing Institution Note to FinCEN”) and in the narrative, and to include any key terms for the underlying typology in the narrative. Having evidence and decision history in one place makes that easier.
How identity verification helps against deepfakes
Securely Verify’s identity verification combines several of these layers: active liveness with random head movements that change every time, a selfie-to-ID face match, anti-spoofing checks for screens, printouts and masks, barcode reading on U.S. driver’s licenses, and fraud signals for duplicate faces and documents, risky devices and networks, and edited or old photos. These features are on every plan. If you run a community bank or credit union, our page for banks and credit unions explains how this fits remote account opening. No tool stops every attack, and you should confirm with your compliance team how any vendor fits your own customer identification program.
FAQ
What is the FinCEN deepfake alert?
It is FinCEN Alert FIN-2024-Alert004, issued November 13, 2024. It explains how criminals use generative AI to create fake identity documents, photos and videos, lists nine red flag indicators, and asks financial institutions to use the key term FIN-2024-DEEPFAKEFRAUD when filing related suspicious activity reports.
Is deepfake identity theft the same as synthetic identity fraud?
Not exactly. Deepfake identity theft uses AI-generated or altered media to pose as a real person. Synthetic identity fraud combines real and fake personal information to create a person who doesn’t exist. FinCEN says criminals have combined the two by pairing GenAI images with stolen or fake personal information.
Can liveness detection stop deepfakes?
It helps, but no single check is enough. FinCEN recommends live verification checks and notes that people using deepfake identities may try to avoid or get around them. Randomized prompts, anti-spoofing, document cross-checks, device signals and human review work better together than any one of them alone.
Do the red flags apply only to banks?
The alert is addressed to financial institutions covered by the Bank Secrecy Act. FinCEN’s news release lists sectors from depository institutions and money services businesses to casinos, insurance and securities firms. The same signals show up in any remote onboarding. Any business that checks IDs and selfies online can watch for them.
If you want to try this on your own customers, start a 7-day free trial — 20 verifications, no card required.
Related guides
Sources: FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions, FIN-2024-Alert004 (FinCEN, November 13, 2024); FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (FinCEN news release, November 13, 2024); Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud, I-120324-PSA (FBI Internet Crime Complaint Center, December 3, 2024); Generative AI is expected to magnify the risk of deepfakes and other fraud in banking (Deloitte Center for Financial Services, May 29, 2024). This article is general information, not legal or compliance advice.
