1. One man, one phone, 47 bank accounts
On 17 June 2026, the Amsterdam District Court sentenced a 34-year-old man to 30 months in prison, six of them suspended. Between March and November 2025 he had opened 47 accounts at ABN AMRO in other people's names. Every account was opened online, through the bank's remote onboarding, in front of a phone camera.
The judgement describes three methods. In some applications he used deepfake software to blend a victim's facial features into the selfie. In others he pasted an existing photo onto an identity document. In a third variant he blended his own face into the passport photo on another person's ID.
On his phone, investigators found an image advertising a "Jumio KYC Bypass Method" and questions he had put to ChatGPT, including whether a verification program might fail to recognise him if he changed his face with make-up. The court read those searches as evidence of intent and ordered him to pay the bank €13,100. The judgment does not say whether the advertised method worked, and it does not accuse Jumio of anything.
The case is small. The weakness it exposes is not. In the space of a few years, the selfie and the photo of an ID card have become the front door of digital finance. In the EU, the European Banking Authority's guidelines on remote customer onboarding have applied since 2 October 2023. They ask firms using unattended checks to perform "liveness detection verifications" and to confirm that the document image "has not been displayed on a screen".
Neither "deepfake" nor "presentation attack" appears in that text, which was finalised in November 2022. The fraud data says this door is where the pressure is highest. TransUnion found that 8.3% of digital account-creation attempts in 2025 were suspected of fraud, "making it the highest risk stage across the consumer lifecycle". ENISA, the EU's cybersecurity agency, put it bluntly in 2024: "identity proofing is the most-targeted element of digital identity."
2. Front one: a $15 document
In February 2024, 404 Media reported on OnlyFake, an underground site that sold photos of fake identity documents generated with what it called "neural networks". Each image cost $15. The operator claimed the site could produce up to 20,000 documents a day, and its Telegram channel announced that "the era of rendering documents using Photoshop is coming to an end".
404 Media said it used one of the images to pass the identity check of the crypto exchange OKX, which told reporters it was investigating with an external partner. On 26 February 2026, Yurii Nazarenko, a 27-year-old Ukrainian known online as "John Wick", pleaded guilty in Manhattan to conspiracy to commit fraud involving identification documents.
Prosecutors said OnlyFake sold at least about 10,000 digital fake IDs between 2021 and 2024, covering licences from all 50 US states, US passports and the passports of about 56 countries, in bulk packages of up to 1,000, paid for in crypto. Buyers used them to get around the KYC programmes of banks and crypto exchanges. He agreed to forfeit $1.2 million. In late June 2026 the judge sentenced him to the year he had already spent in custody, according to Law360.
OnlyFake was the small one. VerifTools sold document images for "as little as nine dollars" until the FBI and Dutch police took it down on 28 August 2025. US prosecutors put its illicit proceeds at about $6.4 million. In April 2026, Dutch police published what they found on its servers: 915,655 documents generated between May 2023 and August 2025, and 636,847 registered accounts.
Between July 2024 and August 2025 alone, VerifTools sold 236,002 images of US documents for $1,468,836.98. Eight men aged 20 to 34 were arrested in the Netherlands on 7 and 8 April 2026. Police listed what the documents were used for: phishing, bank helpdesk fraud, contracts and loans, and getting past KYC checks.
Vendor data shows how fast the craft moved from scissors to software. Entrust, whose Onfido product verifies identities for banks and exchanges, said digital document forgeries rose 244% in the year to August 2024, overtaking physical counterfeits. Sumsub reported that one in five fraudulent verification attempts in Europe in 2025 involved an edited or forged ID, and that ChatGPT and Gemini were behind 2% of all falsified documents it processed.
Do the machines catch them? In the US Department of Homeland Security's Remote Identity Validation Rally, with results presented in January and February 2026, seven commercial document-validation systems were shown genuine and fake IDs. In their worst case, they accepted between under 0.88% and under 76.68% of the fakes. Only one stayed below 1%.
3. Front two: a deepfake every five minutes
A forged document only gets a fraudster halfway. The selfie must match it, and it must look alive. In the year to August 2024, Entrust detected a deepfake attempt every five minutes. A year later, deepfakes made up one in five of the biometric fraud attempts it saw, and deepfaked selfies were up 58%.
Sumsub counted ten times more deepfakes worldwide in 2023 than in 2022, then four times more again in 2024. In 2025, the deepfake attempts it detected nearly doubled in France and the UK. People are no backstop: in an iProov study published in February 2025, just 0.1% of participants could reliably tell real content from fake.
The same technology fooled a finance employee at the engineering firm Arup in Hong Kong into paying out HK$200 million, about $25.6 million, in 15 transfers after a video call with a deepfaked finance chief. Hong Kong has also produced the clearest police record of deepfakes used to open accounts.
4. Front three: skipping the lens
The first two fronts try to fool the camera. The third goes around it. A presentation attackputs something in front of the lens: a printed photo, a replayed video, a mask, a deepfake playing on a tablet. An injection attack never shows the lens anything. It replaces the video stream between the camera and the app, so the software receives a clean image no camera ever captured.
The European specification CEN/TS 18099, adopted in late 2024, describes injection as interfering with the system "by replacing the original data sample provided by the user at the biometric data capture device". The tools are mundane: virtual-camera software built for streamers, hooking frameworks on rooted phones, emulators. ENISA notes that "virtual cameras are not considered an offensive type of software per se", so their presence proves nothing.
Gartner said in February 2024 that presentation attacks were still "the most common attack vector, but injection attacks increased 200% in 2023". ENISA went further a month later: injection attacks "have a greater success rate than presentation attacks". The vendor numbers since then each measure something different and cannot be compared directly. They all point up.
Behind the percentages are real tools. In December 2024, Group-IB described more than 1,100 deepfake attempts against the loan-application checks of one Indonesian financial institution, run from 45 devices with a virtual-camera app feeding pre-recorded video. In September 2025, iProov reported a tool that injected deepfakes into jailbroken iPhones running iOS 15 or later.
In December 2025, MITRE accepted an iProov case study (AML.CS0033) showing real-time face swaps streamed into an Android app called "Virtual Camera: Live Assist" on phones that had not been rooted. In April 2026, MIT Technology Review found 22 public Telegram channels selling virtual cameras, jailbreaks and hooking frameworks; some named Binance, BBVA and Revolut as targets. Telegram removed the channels.
This is not a story of locks that no longer work. The World Economic Forum's Cybercrime Atlas reviewed eight camera-injection tools in January 2026. Half needed a rooted or jailbroken device; prices ran from about $10 to $3,000, and three were free. The review relied on the tools' own documentation, not on direct testing. It judged that they "generally failed against modern SDK-based verification systems".
5. The kit, priced
Every part of the attack now has a market price. The figures below come from different sellers and years, and several are indicative estimates from threat-intelligence firms. Together they show how cheap each piece has become.
6. A lower rate, better attacks
Headline fraud rates do not capture the change. Sumsub's global identity fraud rate fell to 2.2% in 2025, from 2.6% the year before. Over the same year it counted a 180% rise in what it calls sophisticated fraud, and warned that stable percentages can create a false sense of security.
Other providers see higher rates in finance. AU10TIX reported on 9 July 2026 that its confirmed fraud rate reached 3.89% in the first quarter of 2026, about one attempt in 26, with payments the most exposed. Deloitte estimated in May 2024 that fraud losses enabled by generative AI could reach $40 billion in the United States by 2027, from $12.3 billion in 2023.
Italy's financial intelligence unit, the UIF, has started to name the problem. Its annual report for 2025, presented on 16 June 2026, counts about 162,000 suspicious transaction reports, up 11.5%. Reports linked to fraud and scams numbered about 31,600, "just under a fifth of the flow". In some cases, accounts were opened remotely with documentation the UIF found had been produced with artificial intelligence tools.
Eight days earlier, on 8 June 2026, the UIF issued a new Communication on technology-enabled fraud and money mules. It names generative AI and deepfakes, warns of accounts opened with "stolen, fictitious or synthetic identities" and lists signs of "simulated or virtualised devices" among its red flags. Part of the injection toolchain is now in the guidance Italian banks and other obliged firms use when deciding whether to report.
7. What still holds
The most useful evidence on defences comes from governments rather than vendors. The DHS Remote Identity Validation Rally, run at the Maryland Test Facility, tested commercial systems and presented results in January and February 2026. The spread between the best and the worst is the main finding.
No single control closes the door. Gartner's prescription is "a combination of PAD, injection attack detection (IAD) and image inspection", backed by device and behavioural signals. ENISA says "a silver bullet for the defense of an RIDP system does not exist", and most supervisors it interviewed found unattended automatic checks insufficient, "at least for critical, high-risk use cases".
The strongest lock is the chip in modern passports and many ID cards. Read over NFC, it carries a digital signature from the issuing state. ENISA calls chip data "impossible to forge with current technologies when all security mechanisms are fully and correctly implemented". But private firms are not consistently allowed to read chips across the EU, and a chip says nothing about a paid mule holding a genuine document.
Against injection, the defence has to sit on the device: detecting virtual cameras and emulators, and asking Google's Play Integrity or Apple's App Attest to vouch for the app. Both companies warn against relying on them alone. Apple's documentation is blunt: "a compromised app can falsify the results." NIST's 2025 guidelines now require controls showing "digital media is being produced by a genuine sensor".
Standards bodies have moved faster than lawmakers. ETSI's identity-proofing standard, revised in February 2025, requires injection and liveness detection to be lab-tested every second year, with a first test "before end of 2026". The EU's AMLA consulted on due-diligence standards from February to May 2026; by mid-July it had not announced sending its final drafts to the Commission.
8. Update, October 2026: the toolkit that arrived the next day
On 15 July 2026, one day after our reporting closed, researchers working with Cybernewswere handed a code repository to analyse. They completed a technical report on 22 July. Cybernews published the findings on 26 August 2026.
The toolkit "feeds a saved photograph, prerecorded video, or remotely controlled video stream into an app as though it were coming directly from the device's camera". It drives the front and rear cameras separately, one for the ID and one for the selfie. It "can also manipulate information about the phone, including its model, location, identifiers, browser characteristics, and security state". The files included attestation and keybox material.
The report does not say the tool works without root access, and it names no Android versions. On root it says the opposite: "The phone must be unlocked and given elevated access, commonly known as root access." Cybernews withheld the full specimen and found "no evidence that any identity verification provider accepted fraudulent identities using the toolkit".
It still aims at the two weak points identified in July: the timing of live challenges, which a remote stream may get around, and device attestation, which the spoofing layer targets. Cybernews advised providers to "treat a positive attestation as a single risk signal, not as proof that the camera feed is genuine".
None of this overturns the July analysis. It moves the threat one layer down, from the picture to the machine that takes it. A bank that checks only the image now checks the one part of the session an attacker fully controls. The selfie still has a place in remote onboarding. It can no longer be the only witness.
