Identity verification has long relied on the assumption that a person can be distinguished from an impostor through evidence of who they are. But synthetic identities, deepfakes and increasingly sophisticated fraud techniques are putting that assumption under pressure.
As criminals find new ways to manipulate identity data and bypass established checks, financial institutions face a growing challenge: how to establish trust when the evidence itself can no longer be taken at face value. The question is whether traditional verification methods can adapt quickly enough, or whether the industry needs to rethink what proving an identity actually means.
In the view of Stuart Morris, chief technology and product officer at SmartSearch, if you asked a compliance team a decade ago what identity verification meant, you would have got a reasonably simple answer.
He explained, “A document, a selfie, a database check. Confirm the person is who they say they are, run them through the usual watchlists, move on.” The answer, in the opinion of Morris, no longer holds.
Morris remarked, “In 2026, identity verification operates in an environment where the person on the other end of the screen might not be a person at all. The document they present might have been generated in minutes by a tool costing less than a monthly phone contract. The voice on the call confirming the transaction might be a cloned version of a real executive the fraudster has never met.”
The CTPO added that synthetic identities are the biggest shift in financial crime typology since online banking became mainstream. And the question for every regulated firm, he said, is whether traditional identity verification can survive the age that is already here.
How is AI making synthetic identities harder to detect? The core challenge for Morris is not that fraudsters have new tools. Instead, it is that the tools have become faster, cheaper and more convincing at a pace that outstrips the ability of most firms to adapt.
He said, “Generative AI can now produce documents that pass visual inspection. It can produce selfies that match forged documents. It can produce liveness-detection responses, voice samples for phone verification, and video calls that fool human reviewers. A document fraud operation that would have required specialist skills, physical materials and days of work in 2020 can now be run from a laptop by someone with basic technical ability in under an hour.”
Another key point for Morris is the rise of hybrid identities. A fully fabricated identity, he said, is relatively easy to catch because none of the data points checks out.
“A hybrid identity combines a real National Insurance number, a real address history, a real date of birth, with synthetic documents and a synthetic face. These are the identities that defeat the standard checks because the data behind them is often, in part, real,” he said.
Why traditional identity checks are no longer enough
A coming realisation for many in the financial services market is that traditional identity checks no longer cut it. Single-bureau identity verification is now the weakest link in the compliance chain. Industry average first-time pass rates sit around 60 to 65% on single-bureau checks, which means more than a third of legitimate customers face friction, and the gap gives sophisticated fraudsters a route in.
Morris stresses that manual verification is a separate problem. He explained SmartSearch’s 2026 Compliance Reality Check, based on 1,000 senior decision-makers across UK regulated sectors, found that 54% of firms are still conducting identity checks manually. 52% struggle to verify beneficial ownership in complex structures. 24% identify AI-generated fraud as the biggest emerging threat they face.
He said, “The gap between the threat landscape and the operational reality is wide and widening. Document-based verification alone is now insufficient. A document that passes visual inspection, that validates against database checks, that matches a selfie, can still be synthetic. The verification question has moved from “does this document look right” to “does this identity exist, is it the person presenting it, and is their behaviour consistent with a real person’s history”. That is a different question, and it requires a different answer.”
Can verification providers keep pace with AI-powered fraud?
One of the biggest challenges for verification providers in 2026 is keeping up with AI-powered fraud. Can they do it? Morris believes so, but only if firms are willing to move beyond their inherited model. He said that three capabilities now define credible identity verification in the age of synthetic identities.
He explained, “The first is triangulation across multiple trusted data sources. A triple-bureau check, cross-referenced against electoral roll, credit reference, mortality and sanctions data, is materially harder to fool than any single-source check. SmartSearch’s triple-bureau identity verification delivers up to a 97% first-time pass rate, which reduces both fraud exposure and legitimate-customer friction simultaneously.”
The second capability is layered verification combining document, biometric, behavioural and data-driven signals.
A fraudster might fake a document. They might fake a face. They might fake behavioural signals. Faking all four simultaneously, at scale, against systems that are specifically designed to detect inconsistency across layers, is a materially higher bar,” said Morris. Credas’s DIATF-certified digital identity verification, now sitting in approximately 60% of UK housing transactions, operates on this layered principle.
The third and final capability is reusable, verified digital identity. If an identity has been verified to a high standard by a trusted source, and the credential can be presented and re-verified across the customer journey Morris said that firms can both tighten verification and reduce friction.
He said, “The UK Government’s Digital Identity and Attributes Trust Framework and HM Land Registry Safe Harbour standards are both pulling the market toward this model. It is where identity verification is heading over the next three to five years.The direction of travel is clear. The question for each firm is whether it moves with the direction or finds itself defending outdated verification against a threat landscape that no longer resembles what the controls were built for.”
Synthetic identities are not a theoretical problem or a future problem. As Morris states, they are landing on compliance teams now, costing real money and causing real reputational damage.
Morris remarked, “The firms that are already investing in triangulated, layered, reusable verification are pulling ahead. The firms still relying on single-bureau, document-led, manually reviewed verification are carrying a growing operational and reputational risk, often without quantifying it.
“In the age of AI-powered fraud, identity verification can survive. But only if it adapts at the pace the threat is adapting. The tools exist. The data exists. The frameworks are in place. The question is whether firms choose to use them. Better verification, not more verification. That is the direction every regulated UK firm now needs to take.”
How AI has changed identity verification
AI is making it easier than ever to create convincing false identities, putting established verification methods under increasing pressure. Synthetic identities, deepfakes and AI-generated documents are challenging the reliability of checks that financial institutions have long relied on to establish who their customers are.
“Generative AI has made this faster, cheaper and easier to do,” RelyComply explains. Fraudsters can combine stolen personal information with AI-generated photographs, false addresses and fabricated supporting documents to build customer profiles that appear legitimate. More sophisticated attacks can even target the verification process itself, using digital injection techniques to feed manipulated images or video directly into verification systems.
For financial institutions, this creates a problem that goes beyond identifying forged documents. As RelyComply puts it, the question for compliance teams is now “whether the person, the information and the digital activity behind it can be trusted”.
Traditional know your customer (KYC) processes remain important, but document validation, database checks and one-off onboarding assessments are no longer sufficient on their own. “A convincing passport image doesn’t prove its holder is legitimate. And passing a check at onboarding doesn’t mean the account will stay free of fraud.”
The limitations are particularly significant when dealing with synthetic identities, which can remain undetected for months as criminals build apparently credible financial histories before exploiting the accounts. Rule-based systems can also struggle to identify subtle connections between accounts, devices, transactions and personal details that might otherwise appear unrelated.
RelyComply argues that identity verification must therefore move beyond individual documents towards assessing risk across multiple data points and over time. This means combining document authentication, biometric verification, liveness detection, multi-factor authentication and independent data checks, supported by risk-based escalation where suspicious activity emerges.
Artificial intelligence also has a role in strengthening these defences. It can identify suspicious patterns across large datasets, highlight inconsistencies between identity attributes and help compliance teams prioritise higher-risk cases. Combined with behavioural analytics, trusted data sources and ongoing monitoring, this can improve detection without creating unnecessary friction for legitimate customers.
Crucially, verification cannot end once an account has been opened. Perpetual KYC (pKYC) allows institutions to reassess customer risk as new information becomes available, helping identify changes that could indicate fraud or suspicious activity. Providers must also continually test their models against emerging attack techniques, while ensuring automated decisions remain explainable and auditable.
“No single verification tool can eliminate synthetic identity fraud,” RelyComply says. As the technology available to fraudsters continues to advance, financial institutions will need connected and adaptable compliance systems capable of combining reliable identity evidence with continuous risk assessment.
Ultimately, the challenge is no longer simply making identity checks faster. It is making trust more resilient as the methods used to undermine it become increasingly sophisticated.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
