GenAI could make KYC effectively useless

GenAI could make KYC effectively useless

KYC, short for "know your customer," is a process used by financial institutions and banks to confirm customer identities. It often involves verifying ID images and selfies. Companies like Wise, Revolut, Gemini, and LiteBit rely on these images for security.

However, generative AI poses a potential threat to this process. With open source tools, attackers could manipulate selfies to pass KYC tests. While there's no evidence of this happening yet, the ease of creating convincing fake ID images is concerning.

In a typical KYC process, customers submit a selfie holding their ID document, which is cross-checked for authenticity. Fraudsters have long sold forged IDs and selfies. But now, tutorials online demonstrate how generative AI tools can create synthetic renderings of a person holding an ID, making it harder to detect fakes.

While creating convincing deepfakes requires some effort, it's becoming more accessible. Android apps can be tricked into accepting deepfaked images, and web apps can be fooled with virtual webcam software.

Even liveness checks, where users demonstrate they're real through actions like head turns, can be bypassed with generative AI. While some believe human reviewers can still spot fakes, the threat is growing, and KYC may become ineffective as a security measure.