Anatomy of a Fraud Attempt: The Signer Who Was in Two States At Once
A $95,000 transaction was flagged on a combination nobody would stop a deal for individually. The photo submitted had been reenacted. The email address on the account was new. The connection came through a proxy reporting a location the device did not agree with. And the device itself showed activity from two different states inside a single attempt.
Key takeaways
- Location is one of the hardest things for an attacker to fake consistently, because it has to hold across the proxy, the device, and the document at the same time.
- A device cannot be in two states at once, and that contradiction is cheap to detect and expensive to avoid.
- Reenactment reuses a real photo of a real person, so a face-match check can pass while the person is nowhere near the session.
How the scheme works
- Start with a real person's real photo. Reenactment animates an existing image, so the result matches the document because it came from the document.
- Route the session through a proxy. The goal is to present a location consistent with where the real identity should be, since a signer appearing from an unexpected country invites scrutiny.
- Use a fresh email. Contacting the account holder's actual address would alert them, so the account carries a new one.
- Join and present the reenacted face. The document matches, the face matches the document, and motion is present.
- Move before the details are reconciled. The window is the length of the session.
Why it gets past normal checks
Each layer clears:
- The document is real.
- The face matches, because it is the right person's face being animated.
- The proxy supplies a plausible location.
- The new email address is unremarkable on its own, since people change addresses.
What does not clear is consistency between layers. The proxy claims one place. The device's own signals report another. Both of those cannot be true, and the contradiction exists because faking location convincingly requires controlling every layer that reports it, which is substantially harder than controlling any one of them.
That is the general shape of these attempts. The World Economic Forum's January 2026 analysis of face-swapping and injection tooling found capability concentrated in a small number of tools, with camera injection tools ranging from free to roughly $3,000. The face is now the affordable part. Making every other signal agree with it is not.
How Proof disrupts the fraud scheme
Check the signals against each other.
Defend runs location risk data, device fingerprinting, IP signals, and email age alongside the biometric check. A contradiction between them is the finding, and it only exists if the signals are evaluated together.
Treat email age as identity evidence.
A brand-new address on an account transacting at six figures is a weak signal alone and a strong one in company.
Score the face for reenactment specifically.
Continuous frame analysis through the session looks for synthetic manipulation, going well past confirming a match against the document.
Put a person on the highest-value sessions.
A trained agent is the layer reenactment is worst against, because holding a natural conversation is harder than holding a still match.
The question to ask
Does your stack compare what the proxy says about location with what the device says? If those two answers live in different systems and nobody reconciles them, the contradiction that would have caught this attempt is sitting in your logs unread.
To learn more about the fraud patterns we see emerging in 2026, check out our field guide.
.jpg)
