Generative AI has reshaped digital identity fraud, and Identomat argues the shift demands a fundamentally different approach to know-your-customer (KYC) checks.
Fraudsters are no longer confined to stolen documents and leaked personal data. Synthetic personas, manipulated ID images, face swaps, replay attacks, virtual cameras and AI-generated media can now be aimed at almost any stage of a digital onboarding flow, according to Identomat.
The company says this changes the core question KYC systems must answer. It is no longer sufficient to check whether a document is legible or whether two facial images resemble each other. Verification now needs to establish whether identity evidence is authentic, whether the person presenting it is genuinely present, whether separate identity signals line up, and whether the level of risk justifies further checks. Identomat believes effective defence against deepfake and synthetic identity fraud depends on layering multiple controls rather than relying on a single detection feature.
Identomat draws a clear line between related but distinct threats. Stolen identity fraud uses information belonging to a real person, meaning documents may be genuine even though the applicant is not. Synthetic identity fraud blends real and fabricated attributes into a new persona that can look plausible in isolated details but inconsistent as a whole. Deepfake attacks use AI-generated or altered facial and video media to impersonate someone, while presentation attacks put a photo, mask, screen or replay in front of a biometric sensor. Injection attacks go further, inserting manipulated media directly into the digital capture pipeline rather than presenting it physically. Document manipulation, meanwhile, can produce data that reads convincingly under OCR without the underlying document being genuine.
Each control, Identomat notes, answers a narrower question than fraud teams sometimes assume. Facial matching is not the same test as liveness detection, which in turn differs from document authentication or database consistency checks. A resilient KYC workflow connects these signals rather than treating any single one as sufficient proof of identity.
Manual review still matters for high-risk or ambiguous applicants, but Identomat cautions it should function as an escalation step rather than a substitute for weak automation. Reviewers are often asked to weigh a document, extracted data, facial captures, biometric scores, screening hits and prior attempts before making a call. As ambiguous cases pile up, that manual workload grows heavier and harder to keep consistent, reinforcing why automated layers need to carry more of the initial screening burden.
Identomat’s proposed defence-in-depth model asks three sequential questions: is the document authentic, does the applicant match the identity, and is a genuine person present. The third question is where liveness detection comes in, and Identomat splits this into passive checks (assessing presence without obvious challenges, prioritising a smooth user experience), active checks (requiring a movement or response, at the cost of extra friction) and adaptive checks, which start as a passive liveness check and escalate to active only when risk signals demand it.
That risk-based logic extends across the wider verification stack, Identomat says, with stronger checks reserved for applicants whose evidence is inconsistent rather than applied uniformly to everyone. To reduce false positives without weakening controls, Identomat’s approach combines multiple signals across the verification process, distinguishes between different types of verification issues, and allows workflows to be configured according to specific business and risk requirements. This helps companies apply appropriate levels of verification while maintaining a balance between security, compliance, and user experience.
Identomat’s own platform combines document verification, face matching, liveness checks, compliance screening and workflow escalation into a single layered process, and the company was recently named a Leading Vendor in the Liminal Index 2026 for KYC in banking.
For more, read the full report here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
