Deepfake has raised serious concerns in the financial sector. Often, during the registration for financial services, we are asked to submit a photo while holding our Aadhaar card. With generative AI, creating a virtually identical picture within seconds has become a feasible and worrisome prospect.
It is now even possible to generate hyper-realistic videos of individuals and this could enable fraudsters to exploit this technology to circumvent the verification processes established by banks.
“As deepfakes improve, I think it will only become harder over time to validate if the person on the other side is real or AI-generated. This problem will be bigger for banks that have more stringent regulatory requirements during onboarding,” Nitin Kamath, CEO of Zerodha, posted on X.
Taking cognisance of the advancements, the government has already urged banks to prepare for the potential implications of deepfakes.
Banks have a deepfake problem
Banks and other financial services companies use eKYC/ Video-KYC features to onboard customers. The RBI does mandate KYC to be done through a live feed only, however, fraudsters can easily deceive live video verification sessions through a method known as a camera injection attack, introducing deepfake videos into the system.
For example, a man from Kerala fell victim to a deepfake scam where another man, pretending to be his friend, duped him of INR 40,000.
For banks, deepfakes are also exacerbating the pre-existing issue of financial fraud. For decades, banks worldwide have contended with counterfeit documents and forged identity cards. In fact, fraudulent documentation emerged as one of the primary forms of bank fraud in 2022, as indicated by a survey by Deloitte.
Now, with the advent of generative AI, the financial sector is presented with a fundamental problem. As Video KYC features can now be easily manipulated, should banks contemplate mandating customers to visit physical branches for identity verification?
Banks are working on countermeasures
The experts AIM has spoken to opine that forsaking the digital process is not currently under consideration by banks. Instead, the challenge provides banks with an opportunity to innovate and create technologies to combat the problem of deepfakes.
According to Aditya Gupta, chief executive officer & founder at Credilio, the traditional methods of eKYC and video-KYC authentication were developed before the onset of generative AI. Hence, banks and financial institutions will now need to introduce additional layers of security checks to nullify this threat.
Credilio, which uses video KYC to onboard customers to its platform, is working closely with its partner banks to analyse the risks emerging from advancements in deepfake tech. “The solutions for introducing additional layers of security are currently under development and expected to be rolled out during the year,” he told AIM.
Moreover, digital KYC processes cannot be substituted with physical processes, given the mammoth scale of the financial services sector. “Going back to physical KYC processes may increase customer onboarding costs, making financial services inaccessible, hindering India’s financial inclusion and also the Digital India vision,” Supratim Chakraborty, partner at Khaitan & Co, told AIM.
He believes that adopting future-proof technologies, such as ‘liveness detection systems’ and advanced image processing frameworks developed by certain startups, could significantly enhance the ability to identify and flag deepfakes.
These innovative solutions may prove instrumental in filtering out suspicious profiles, offering an effective means for banks to counter the challenges posed by the deepfake technology in identity verification. “Additional due diligence measures such as asking randomised questions to customers during the onboarding process, as well as recognising choppy sentences, varying tone, inflection in speech, phrasing, etc may also help flag suspicious users,” Chakraborty said.
Biometric verification in KYC
However, according to a report from Netherland-based Sensity AI, liveness tests used for ID verification are susceptible to deepfake attacks. This is where technology, which tracks one’s biometrics like fingerprints and iris, can come in handy to tackle deepfake. Banks’ onboarding partners are working on technology to facilitate fingerprint and iris scanning without the need for separate hardware.
Accura Scan, India’s only certified biometric solution provider, has unveiled the integration of contactless finger biometrics and document liveness checks into its digital ID products. The company’s biometric fingerprint verification eliminates the necessity for extra hardware, utilising a device’s built-in camera to capture and analyse finger vein and fingerprint ridge patterns. This entirely touchless process is designed to be conducted remotely.
“As a step towards innovation, ‘identity fingerprinting’, or uniquely authenticating users through their facial, gestural, and vocal mannerisms in a privacy-preserving manner, may also be considered towards building trust in digital KYC processes,” Chakraborty added.
Moreover, as an alternative, Gupta suggests the creation of a neutral KYC repository, which is conducted in person for consumers and has validity for a longer duration for use by all regulated entities. “This should have biometric / iris checks to neutralise the threat of eKYC and Video KYC,” he pointed out.
AI against deepfake
Many financial services experts believe AI could also possibly be the strongest defence banks have against the deepfake menace. The right approach for banks is to stay ahead of the evolving deepfake technologies and continually enhance their security measures.
Identity verification and digital KYC solutions providers across the globe are trying to use AI to track biometrics and make KYC processes safer and more secure. Moreover, AI can also be leveraged to detect adversarial attacks and other AI-based fraud tactics like camera injection attacks.
