What Happened
A defendant in the Netherlands opened 46 bank accounts using deepfake technology to bypass remote identity verification. He combined his own features with passport photos obtained through a rental scam and submitted these synthetic images to pass the banks' biometric checks. The systems compared the deepfaked images against the stolen passport photos and approved the account openings.
The fraud succeeded because the banks used biometric verification, not biometric identification. Verification checks one person against their own stored record, while identification matches a face against a database of many people. This distinction matters under the EU AI Act, which regulates identification but leaves verification unaddressed.
Timeline
Years prior to incident: Banks increasingly adopt biometric verification for remote customer onboarding, treating voice and facial recognition as sufficient evidence of identity.
Three years before the EU AI Act: A VICE reporter demonstrated he could break into his own bank account using free deepfake voice tools. The FBI begins tracking AI as its own fraud category.
February 2024: FinCEN warns U.S. banks about deepfake-enabled identity fraud and publishes red flags for suspicious activity reporting.
August 2024: EU AI Act Article 50 takes effect, requiring machine-readable tags on synthetic content.
2024 (specific date unclear): Dutch court hears case of 46 fraudulent accounts opened via deepfake-enhanced verification.
2027 (planned): High-risk AI system requirements under the EU AI Act will take effect, delayed by the Digital Omnibus.
Which Controls Failed or Were Missing
No deepfake detection in the verification pipeline. The banks' systems accepted synthetic images that blended the fraudster's features with legitimate passport photos. The verification process compared the submitted biometric against the stored credential without testing whether the submitted sample was authentic.
No liveness detection or challenge-response. If the systems required real-time interaction, movement, or unpredictable actions during capture, the static or pre-recorded deepfakes would have failed. The absence of this control allowed pre-generated synthetic content to pass.
No cross-check against identification systems. Verification operates in isolation. It answers "does this match the stored record?" but not "is this person already known under a different identity?" The fraudster exploited that gap across 46 accounts.
No fraud signal from multiple account openings. Either the banks didn't share data about new accounts tied to similar biometric patterns, or their monitoring didn't flag the volume. The pattern should have triggered review.
What the Standards Require
NIST SP 800-63B addresses digital identity verification and defines Authenticator Assurance Levels. At AAL2 and above, multi-factor authentication is required. Biometric verification alone doesn't meet this threshold because biometrics are considered "something you are," not "something you have" or "something you know." The standard anticipates that biometrics can be spoofed.
The EU AI Act's Annex III lists high-risk AI applications. Biometric identification appears on that list. Systems classified as high-risk must demonstrate resilience against manipulation and meet transparency requirements. But biometric verification, the control that failed in this incident, isn't classified as high-risk. This creates a regulatory gap: the systems banks use for remote onboarding face no requirement to prove they can resist deepfake attacks.
Article 50 of the AI Act requires synthetic content to carry machine-readable tags. That rule targets content meant to be seen and shared. It doesn't address fraud, where the attacker has every incentive to strip or never apply such tags. A fraudster submitting a deepfake to a verification system won't voluntarily label it.
Payment Services Directive 2 requires Strong Customer Authentication for electronic payments, defined as two independent factors from knowledge, possession, and inherence categories. Biometric verification satisfies the inherence factor, but only if the biometric can't be replayed or synthesized. PSD2 doesn't explicitly require liveness detection, but its authentication standards assume the factor is trustworthy.
The FFIEC IT Examination Handbook addresses authentication for financial institutions and emphasizes layered controls. It warns against relying on a single factor, especially one that can be compromised without the customer's knowledge. Biometrics fall into that category when deepfakes are in play.
Lessons and Action Items for Your Team
Add liveness detection to every biometric verification flow. Require unpredictable actions during capture: blink twice, turn your head, read a random phrase aloud. Pre-recorded or static deepfakes fail these tests. Verify that your vendor's liveness detection is tested against current deepfake techniques, not just legacy attacks.
Treat biometric verification as high-risk, regardless of how the regulation classifies it. Require your vendors to demonstrate resilience against manipulation. Ask for third-party testing results. If they can't show you how their system detects deepfakes, assume it doesn't.
Layer biometric verification with possession-based factors. Require device fingerprinting, geolocation consistency, or a one-time code sent to a known device. The combination makes the attack harder: the fraudster needs both a convincing deepfake and access to the victim's device or location.
Monitor for patterns across account openings. If your fraud system can't detect multiple accounts opened with similar biometric features or linked to the same device, you're blind to this attack vector. Cross-reference new accounts against existing ones, even if the names differ.
File Suspicious Activity Reports when verification anomalies cluster. FinCEN's guidance on deepfake fraud includes red flags: multiple failed verification attempts, accounts opened in rapid succession, or verification sessions that show signs of manipulation. Don't wait for a confirmed fraud to report the pattern.
Pressure your verification vendors for accountability. The regulatory delay until 2027 means vendors aren't yet required to prove their systems resist deepfakes. You can require it contractually. Ask for liability clauses tied to system errors that let synthetic identities through.
Assume the regulatory gap will close. Article 50 is in effect now. High-risk requirements arrive in 2027. Biometric verification will likely be added to Annex III once the fraud patterns become undeniable. Build controls now rather than retrofitting them under regulatory pressure.
The Dutch case shows that biometric verification, deployed without deepfake-resistant controls, is a single point of failure. Your identity assurance framework should assume that any biometric sample can be synthesized. Layer your controls accordingly.
