The assumptions that quietly stopped holding

A lot of identity verification, especially for high-stakes moments like a wire transfer approval, a password reset for an executive account, or new-employee onboarding, relies on signals that were reliable for decades and aren't anymore. A voice on a phone call. A face on a video call. A scanned photo ID that looks correctly formatted. Generative AI tools have made convincing fakes of all three cheap and fast to produce, which means processes that treat those signals as sufficient proof are now a genuine liability, not just a theoretical one.

This isn't a distant risk. Real incidents involving deepfake video calls used to authorize fraudulent transfers, and AI-generated documents used to pass identity checks during onboarding, are already happening across industries. The organizations getting caught out are the ones whose verification process hasn't changed since before these tools existed.

What actually holds up

  • Out-of-band verification for high-stakes requests. A request to change payment details or approve an unusual transfer should be confirmed through a second, independent channel, a callback to a known number, not a reply to the same channel the request arrived on. This defeats most deepfake and impersonation attempts by design, because the attacker doesn't control the second channel.
  • Cryptographic proof over visual inspection. A hardware-backed passkey or a verified digital credential is much harder to fake than a face or a voice. Wherever possible, shift high-stakes verification away from "does this look and sound right" toward "does this cryptographically check out."
  • Process resistance to urgency. Most successful impersonation fraud leans on urgency to short-circuit verification steps. A process that makes exceptions under time pressure is a process that will eventually get exploited under time pressure. Build the verification steps to hold even when someone insists there's no time for them, especially then.
 verification signal strength
// weak: easily synthesized today
["voice on a call", "face on video", "scanned ID photo"]

// strong: cryptographic, out-of-band, or both
["hardware passkey challenge", "callback to verified number", "signed digital credential"]
A useful test

Look at your highest-stakes verification step today, the one guarding a wire transfer, an executive password reset, or a new-hire's first system access, and ask whether it would catch a well-produced deepfake. If the honest answer is no, that's the step to fix first.

Verification has to evolve as fast as the fraud does

This isn't a one-time fix. As generative tools improve, the specific signals worth trusting will keep shifting, which means identity verification needs to be treated as a program that gets revisited, not a policy that gets written once. The organizations staying ahead of this are the ones building verification around principles, independent channels, cryptographic proof, resistance to urgency, rather than around specific tells that today's fakes happen to miss and tomorrow's won't.

Identity verification is core to our Identity Management engagements, built to hold up against the fraud techniques organizations are actually seeing now, not the ones from five years ago.

Want a second look at how your highest-stakes verification step would hold up?

Start an assessment today
Identity Verification Deepfake Fraud Identity Management Out-of-Band Verification