Digital Identity Verification Insights

ChatGPT Created a Fake Passport That Passed a Real Identity Check A recent experiment by a tech entrepreneur revealed something that should concern every security leader. ChatGPT-4o was used to create a fake passport that successfully bypassed an online identity verification process. No advanced design software. No black-market tools. Just a prompt and a few minutes with an AI model. And it worked. This wasn't a lab demonstration. It was a real test against the same kind of ID verification platforms used by fintech companies and digital service providers across industries. The fake passport looked legitimate enough to fool systems that are currently trusted to validate customer identity. That should make anyone managing digital risk sit up and pay attention. The reality is that many identity verification processes are built on the assumption that making a convincing fake ID is difficult. It used to require graphic design skills, access to templates, and time. That assumption no longer holds. Generative AI has lowered the barrier to entry and changed the rules. Creating convincing fake documents has become fast, easy, and accessible to anyone with an internet connection. This shift has huge implications for fraud prevention and regulatory compliance. Know Your Customer processes that depend on photo ID uploads and selfies are no longer enough on their own. AI-generated forgeries can now bypass them with alarming ease. That means organizations must look closely at their current controls and ask if they are still fit for purpose. To keep pace with this new reality, identity verification must evolve. This means adopting more advanced and resilient methods like NFC-enabled document authentication, liveness detection to counter deepfakes, and identity solutions anchored to hardware or device-level integrity. It also requires a proactive mindset—pressing vendors and partners to demonstrate that their systems can withstand the growing sophistication of AI-driven threats. Passive trust in outdated processes is no longer an option. Generative AI is not just a tool for innovation. It is also becoming a tool for attackers. If security teams are not accounting for this, they are already behind. The landscape is shifting fast. The tools we trusted even a year ago may not be enough for what is already here. #Cybersecurity #CISO #AI #IdentityVerification #KYC #FraudPrevention #GenerativeAI #InfoSec https://lnkd.in/gkv56DbH

The recent guilty plea in the OnlyFake digital ID fraud case should be a wake-up call for every enterprise that still relies on document-based identity checks. Criminals (full link below) used AI-generated fake passports, driver’s licenses, and Social Security cards, images good enough to pass basic online verification systems to bypass verification processes at scale. Here’s the truth: A static image of a government ID is no longer a high-trust signal. When realistic digital forgeries can be bought, customized, and used for fraud with minimal effort and cost, document-only checks become a vulnerability. That’s why enterprises need to rethink identity verification as a multi-layered, context-aware process, not a single checkbox: 👉 Document authenticity isn’t enough. Image uploads can be fabricated. 👉 Device trust matters. Is this request coming from a known, managed device, or a risky/new endpoint? 👉 Location trust adds signal. Unusual geolocation patterns can be an early fraud indicator. 👉 Behavior and biometric signals (like liveness and face match) help ensure it’s a real person in front of the camera. 👉 Continuous risk evaluation, not just one-time checks, protects over time as threats evolve. Modern identity assurance must move beyond “did they show me something that looks like an ID?” to “can we confidently verify this user, this device, and this session?” Document checks can still be still part of the story but they can’t be the whole story anymore. Without layered verification that includes device intelligence, location analytics, and live biometric checks, organizations expose themselves to fraud.

We get an increasing number of client calls at Gartner from HR and recruiting leaders who are concerned about candidates misrepresenting their identities during the interview process. I'm sure many of you read the articles last year about US firms inadvertently hiring North Koreans into remote roles. There are different reasons candidates might do this, such as a candidate with the right skills who happens to be one country trying to get a better paid job in another country. Or it might be more sinister, and could be an attacker trying to get a position that gives them systems access to get up to mischief like stealing intellectual property or planting ransomware. In any case, if an candidate is not using their real identity - something is wrong. I was pleased to co-author a new piece of research Mitigate Rising Candidate Fraud Through Identity Verification, led by my colleague Emi Chiba, explaining how HR and recruiting leaders can mitigate these risks. Robust online identity verification, with appropriate liveness detection, injection attack detection, and checking of identity data from the document against authoritative sources will make it harder for fraudulent candidates to get the job. Clients can read the research here: https://lnkd.in/eKX_6ncX Non-clients can get smarter with Gartner, by exploring our other insights: https://gtnr.it/GExpert Photo by Eric Prouzet on Unsplash

🇫🇷 🤝🏻🇩🇪 : joint French-German proposals by our cyber agencies ANSSI - Agence nationale de la sécurité des systèmes d'information and the Federal Office for Information Security (BSI) Security on a decisive topic : the European digital Identity wallet 🇫🇷 ANSSI and 🇩🇪 BSI issued a new joint paper on remote identity verification ⭐️Following an initial joint publication in 2023, ANSSI and BSI are now releasing a new joint document aligned with the updated European regulatory framework. 🌍 Last month, Director General of ANSSI @Vincent Strubel & German counterpart Claudia Plattner reaffirmed the trusted relationship between #ANSSI and #BSI on the topic of remote identity verification. 📈 Since February 2024, the regulatory shift introduced by eIDAS 2 has brought forth the #EU Digital Identity Wallet, which may be issued based on remote identity verification. At the same time, cyber threats have continued to evolve, and European standardisation work on remote identity verification has progressed. Key takeaway =a secure and trusted EUDI Wallet depends on: 🔹Strong, harmonized standards 🔹Advanced defenses against remote attacks 🔹Cross-border interoperability and regulatory support. 🛡️ High Assurance is Essential for EUDI Wallet Onboarding. Remote identity proofing, particularly video-based methods, are being explored as alternatives to national eID systems but present significant technical and security risks. 🎯 3️⃣ Critical Verification Goals to ensure trustworthiness: 🔹Biometric genuineness 🔹Document authenticity (genuine, current, and physically possessed) 🔹Face matching (the face matches the ID document photo). ⚠️ 2️⃣ major categories of attacks: 🔹Presentation Attacks: use of photos, masks, or replayed videos in front of the camera. Exploit the fact that many ID document security features are not verifiable remotely. 🔹 Injection Attacks : Bypass the camera using pre-recorded or AI-generated data; Deepfakes and synthetic documents pose increasing challenges. ✅ Recommendations for Strengthening the Ecosystem 🔹Harmonise Evaluation Criteria -Establish pan-European test specifications directly mapped to LoA High. -Mandate biometric attack testing in evaluations 🔹Bridge the Document Verification Gap -Develop standards for remote verification of ID documents. -Promote chip reading over OCR where legally possible. -Ensure legal frameworks enable conformity assessment bodies to perform robust testing. #cyber #scybersecurity #Europe

𝗔𝗜, 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗙𝗿𝗮𝘂𝗱 & 𝗔𝘃𝗶𝗮𝘁𝗶𝗼𝗻 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆: 𝗔 𝗪𝗮𝗸𝗲-𝗨𝗽 𝗖𝗮𝗹𝗹 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝘆 The power of artificial intelligence has been widely celebrated for its ability to boost productivity, enable automation, and drive innovation across industries. But as we continue integrating AI into more critical areas of our lives, it’s important to pause and ask: are we prepared for its darker side? This week, a startling case surfaced that highlights how AI’s misuse could impact security critical sectors, including aviation. A Polish researcher, Borys Musielak, used ChatGPT-4o to generate a highly convincing fake passport in just five minutes. The passport, a digital replica of his own, was sophisticated enough to bypass automated KYC systems used by fintech giants like Revolut and Binance. This wasn’t an advanced Photoshop job and it was AI-generated, lightning fast, and disturbingly easy to replicate. Musielak’s demonstration exposed a chilling reality: if identity verification systems rely solely on images or selfies, they are now obsolete in the face of generative AI. 𝗦𝗼, 𝘄𝗵𝗮𝘁 𝗱𝗼𝗲𝘀 𝘁𝗵𝗶𝘀 𝗺𝗲𝗮𝗻 𝗳𝗼𝗿 𝗮𝘃𝗶𝗮𝘁𝗶𝗼𝗻? Airports and airlines worldwide depend heavily on identity verification to safeguard passengers, secure national borders, and maintain operational integrity. With AI now capable of generating hyper realistic fake documents, even potentially manipulating biometric data the risks to aviation security are serious: - Unauthorized access to restricted areas using fake IDs - Boarding under false identities, posing a significant safety risk - Disruption to travel processes, including immigration and customs - Loss of trust in digital self-service check-ins and biometric gates This isn’t science fiction, it’s a present-day reality. And it calls for an urgent re-evaluation of how we approach identity verification in aviation. 𝗪𝗵𝗮𝘁 𝗻𝗲𝗲𝗱𝘀 𝘁𝗼 𝗵𝗮𝗽𝗽𝗲𝗻 𝗻𝗲𝘅𝘁? - Stronger Authentication: We must move toward NFC based verification and eIDs, which offer secure, hardware level validation that can’t be faked with a simple prompt. - AI Resilient Systems: Security systems must be re-engineered to detect AI-generated forgeries. Relying on visual checks alone is no longer enough. - Collaborative Response: Regulators, airport authorities, airlines, and tech companies need to act together, sharing threat intelligence and establishing AI misuse detection protocols. - Public Awareness: Passengers and staff alike should be aware of the potential misuse of AI-generated documents and the signs to look out for. This isn’t a challenge for the future. it’s a pressing issue today. Aviation must once again lead by strengthening identity verification systems. As AI evolves, so must our security. Passenger trust and safety depend on staying ahead of emerging threats. #AviationSecurity #AIandEthics #DigitalIdentity #AirportOperations #KYC #CyberSecurity #TravelTech #AIinAviation

A New Era of Digital Identity Begins - What It Means for AML Compliance🚨 The UK has published official guidance clarifying how digital identities can be used under the Money Laundering Regulations - a significant development for AML/CTF and customer due diligence frameworks. What’s new? 🔎 → Regulated firms can now rely on certified Digital Verification Services (DVS) listed on the GOV.UK register to satisfy Regulation 28 identity requirements. → Digital identities aligned with the UK Digital Identity & Attributes Trust Framework are formally recognised for KYC verification. → This brings greater regulatory clarity and legal certainty when using approved digital ID providers. EU comparison 🔎 → eIDAS 2.0 introduces EU Digital Identity Wallets, cross-border recognition and harmonised assurance levels. → The EU AML Regulation (AMLR) allows the use of eIDAS-compliant digital ID for CDD - while maintaining liability with the obliged entity, similar to the UK approach. What remains unchanged? 🔎 → Digital ID supports verification - it does not replace full CDD obligations → Risk assessment and enhanced due diligence still apply → Firms retain ultimate responsibility for compliance Keen to hear your views - particularly on whether this will reduce friction in onboarding, support technology adoption, and enable future-ready identity ecosystems without increasing risk 👇 As digital ID adoption accelerates, firms will need to balance efficiency with robust CDD and governance controls. Stay tuned!

HM Treasury’s 2026 guidance clarifies how the UK Digital Identity and Attributes Trust Framework interacts with the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLRs). The document formalises the regulatory perimeter for the use of certified digital identity services within customer due diligence (CDD). A digital identity is described as a digital representation of a person acting individually or on behalf of an organisation, enabling identity verification without physical documents. Digital identity services: • Verify identity and attributes (e.g. address, age, biometric data). • Operate across public, private and charity sectors. • May be used online or in person. Certification is central. Digital verification services (DVS) can be independently certified against the UK Digital Identity and Attributes Trust Framework and listed on the DVS Register maintained by the Office for Digital Identities and Attributes (OfDIA) under the Data (Use and Access) Act 2025. Certification involves assessment by an independent conformity assessment body overseen by UKAS The guidance confirms that certified and registered #digitalidentity services can be used by regulated entities to fulfil identity verification obligations under Regulation 28 of the MLRs . Specifically: • Verification of an individual’s identity may be satisfied through certified DVS. • Verification of company directors may also be supported through certified DVS. • Services that are not certified and not listed on the DVS Register cannot reliably be deemed suitable for MLR-compliant identity verification Limitations within the CDD architecture The guidance clarifies boundaries. Digital identities: • Address identification and verification. • Do not replace the broader CDD obligation, including understanding the purpose and intended nature of the business relationship • Do not remove the obligation to apply enhanced due diligence where required. • Do not transfer liability from the regulated entity; firms remain ultimately responsible for CDD failures . Record-retention requirements under Regulation 40 MLR continue to apply. The guidance places certified digital identity services within the “independent source” requirement under CDD. This has governance and control implications: • Vendor due diligence now includes verification of DVS certification status and register presence. • Controls must ensure alignment with trust framework standards. • CDD frameworks must distinguish between identification, verification and ongoing monitoring components. • Risk assessment methodologies must continue to determine when enhanced due diligence is required, independent of the identity verification channel used. Sector-specific guidance is referenced for financial services (JMLSG), accountancy (CCAB), legal (LSAG), gambling and other supervised sectors #financialcrime #regulatory #sanctions #uk #AML #moneylaundering

AI has fundamentally changed the rules of identity security. Generative AI is used to create deepfakes, synthetic identities, and spoofing attacks faster than many legacy systems can respond. The result is a playing field that feels increasingly uneven for organizations trying to verify someone is who they claim to be. That’s why the new NIST SP 800-63-4 Digital Identity Guidelines are so important. They finally give the industry a clear framework for biometric systems that are both privacy-preserving and resilient against AI-driven attacks. At iProov, we believe the only effective way to fight AI-based identity threats is with AI that’s certified, explainable, and responsibly deployed. Our recent Ingenium certification for deepfake protection demonstrates that this isn’t just a vision — it’s available today. 🔗 Read the article: https://lnkd.in/eqRYxeyY Identity security can’t afford to play defense with outdated tools. Winning this battle means aligning with #NIST guidelines and verifying that someone is who they claim to be — the right person, in real time, with privacy and trust built in. #DigitalIdentity #AIandSecurity #Biometrics #NIST #IdentityVerification

🔐 The #UN Just Launched a #Blockchain Digital Identity System. Here’s Why It Matters. More than 1 billion people worldwide still lack a verifiable legal identity. Without it, they face barriers to education, healthcare, financial services, and basic human rights. Now, the United Nations Joint Staff Pension Fund (UNJSPF) and UNICC have deployed a #blockchain-based Digital Certificate of Entitlement (DCE) — and it may become a blueprint for global digital public infrastructure. This is one of the most advanced public-sector blockchain identity systems in production today, and it has already been used by 43,000+ beneficiaries across 190 countries. ⸻ 🌍 Why #Blockchain for Digital Identity? Traditional systems rely on centralized #databases, which are vulnerable to: ❌ data breaches ❌ identity theft ❌ manual processing errors ❌ exclusion of low-tech and remote populations The United Nations approach uses: 🔹 Decentralized Identifiers (DIDs) 🔹 Verifiable Credentials (VCs) 🔹 Biometric verification + AI liveness detection 🔹 Zero-knowledge proofs for selective identity sharing Users control their identity on their own device, not a central server. ⸻ 🛡 Real-world impact so far The DCE has already delivered measurable results: 📉 40% reduction in paper-based processing 📉 76.5% decrease in manual overtime costs (2021–2024) 🌱 Over 38,800+ digital certificates issued in 2025, reducing environmental footprint 🔐 Near zero fraud due to biometric/geo-location verification 🔄 99.96% retention of users choosing digital over paper This is not a pilot — it is a live, global digital identity system. ⸻ 🧩 Why this is bigger than pensions This model is aligned with: 🌐 SDG 16.9: Legal identity for all by 2030 🧱 Global digital public infrastructure initiatives 📜 eIDAS 2.0 & international digital identity frameworks A DCE Consortium is now being formed to offer DCE-as-a-Service across UN agencies and potentially governments worldwide. This could evolve into a global standard for self-sovereign identity (SSI), protecting the most vulnerable populations while enabling secure digital services. ⸻ 🔮 My takeaway Blockchain’s most transformative use case may not be money — it may be identity. If we get digital identity wrong, we increase surveillance. If we get it right, we increase freedom, dignity, and access. The UN’s work shows a path toward secure, self-sovereign, privacy-preserving identity at a global scale. ⸻ Follow 👉 George Petrovic & comment or share ♻️ if you believe identity is a human right, not a privilege. #blockchain #digitalidentity #ssi #identitymanagement #un #publicsector #governance #privacy #cybersecurity #digitalpublicgoods #web3 #technology #inclusion Suggested LinkedIn tags: UNDP Exponential Science Blockchain for Good Alliance (BGA) UNDP AltFinLab Milica Dimitrijevic Teodor Petricevic Burcu Mavis Paolo Tasca Marco Alberto Javarone

Payments are a natural extension of digital identity Digital identity is a representation of an individual that provides for the legal equivalence of in-person identity validation, authentication, authorisation, and signature time-stamping. A digital identity uses trusted data from an authoritative source to initially verify an individual’s identity and then authenticate that individual each time their identity is used. A good digital identity system is formed from components that work together to ensure security, usability and privacy. The private sector can play a crucial role in driving adoption by helping consumers understand the benefits of having a digital identity “firsthand” through compelling and frequent use cases, such as renting a car or buying medicine. With technological expertise and proficiency in security, compliance and user experience, specific parties in the private sector should be considered important partners to governments. Payments — especially those using digital wallets — are ideal for accelerating the adoption of digital identity systems, creating a virtuous cycle that benefits both domains. Payments can help drive digital identity adoption by offering a clear and immediate value proposition: Payments are a part of everyday life, and they often involve authentication processes that digital identity will help enhance. The frequency of payment transactions creates numerous opportunities for end-users to interact with and become comfortable with biometric authentication processes. In the future, citizens may be asked to verify their identity for some higher-risk purchases, or when a periodic verification might be required. They complete this verification process using a familiar biometric experience they use everyday, on their device. The familiarity of using biometrics to perform tasks on their device will be the same simple process to verify it is them completing a payment. This linkage between identity verification and payment authentication is likely to drive increased trust in digital identity technology and processes in other contexts (e.g., eKYC). Financial institutions and payment providers may further promote digital identity adoption by integrating these systems into their services. Digital identity integration improves security, reduces fraud and streamlines customer onboarding, demonstrating the practical benefits of digital identity to a wide audience. This virtuous cycle accelerates growth and adoption for digital identity and digital payments alike. As digital identity systems become more widespread due to their use in payments, they become more valuable for other applications. Simultaneously, as digital identity systems improve, gain trust and — over time — become integrated into payment authentication, they could make digital payments even more secure and efficient. 👉 Subscribe for more insights https://lnkd.in/d94JgWBU Source Visa #fintech #payments #id