For years, a video call has been one of the easiest ways to build trust remotely. You see someone, they see you, and a decision gets made. Identity verification firm Identomat argues that this assumption is now a liability. Generative AI lets fraudsters convincingly impersonate executives, customers and business partners using publicly available footage and voice recordings.
The danger is no longer hypothetical. In early 2024, an employee at a multinational firm in Hong Kong joined what appeared to be a confidential video conference with the company’s UK-based chief financial officer and several finance colleagues. None of them were real. According to Hong Kong police, the call was built with deepfake technology from public video and audio clips. The employee authorised transfers of roughly HK$200m, about $25.5m, to five local bank accounts. The company was later named as engineering group Arup, which confirmed that fake voices and images had been used.
The FBI has issued similar warnings about criminals using AI-generated video and audio to impersonate executives and other trusted individuals. As these attacks become increasingly sophisticated, organisations need to look beyond what they see and hear on screen. Video can be a valuable part of the verification process, but it should never be the sole proof of identity.
Automated KYC has transformed digital onboarding, letting customers submit documents, take selfies and pass liveness checks without speaking to anyone. That works for most straightforward cases. The gaps appear elsewhere: inconsistent customer data, enhanced due diligence, unusually large transactions, account recovery from new devices, and internal requests such as an executive asking to move millions or change beneficiary details.
Identomat positions Video KYC as a step-up layer for these moments. Rather than relying on a conversation, organisations guide participants through a structured workflow that can include document verification, face matching, liveness detection, AML screening, consent confirmation, human review and audit logs. The company’s platform supports both one-to-one and multi-party sessions. In Identomat’s framing, video is the communication layer, while verification is the control layer.
Applied to the deepfake CFO scenario, a finance employee facing an urgent transfer request could launch a Video KYC session with the requester. Liveness checks help confirm a physically present person rather than a deepfake or injection attack, while face matching links them to a validated ID. The order can then be digitally signed, creating an auditable record. Identomat describes this as a remote, human-led branch.
The firm sees uses well beyond internal fraud prevention, including high-risk onboarding, KYB checks on directors and beneficial owners, account recovery, lending, insurance claims, crypto platforms and government services. Two companies could even use it to verify representatives before signing a high-value deal.
Identomat’s central point is that deepfakes exploit familiarity: a known face, a known voice, a known process. Not every interaction needs heightened scrutiny, but where the stakes are significant, organisations must decide where trust is assumed and where it is actually verified.
For more, read the full story here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
