Fighting Deepfake Fraud Takes a Layered Approach

Updated May 4, 2026

Deepfake fraud isn't emerging — it's industrialized. The tools to create convincing fake video, audio, and IDs are cheap, widely accessible, and improving faster than most defenses can adapt. For any organization that relies on identity verification to protect customers, transactions, or accounts, the question is no longer if deepfakes will target your workflows — it's whether your defenses are layered enough to catch them when they do.

Key takeaways

• Rising threat: Deepfake face swap attacks on identity verification systems increased by 704% in 2023.
• Beyond APIs: Single-solution verification methods are insufficient. A layered approach is required to defeat sophisticated AI fraud.
• Human-in-the-loop: Real-time human intervention can detect deepfakes by injecting randomness and unexpected requests into interactions.
• Multi-signal verification: Effective defense requires analyzing device trustworthiness, geolocation, phone registration, and behavioral patterns.
• Regulatory gap: There is currently no federal law specifically banning deepfakes, making proactive corporate defense essential.

What is a deepfake?

A deepfake is synthetic media — audio, video, or images — created or manipulated by AI to make a person appear to say or do something they never did. Deepfakes are convincing enough to trick both humans and automated systems into believing the content is real.

Under the hood, most deepfakes are powered by generative adversarial networks (GANs): two AI models working against each other. One model (the generator) creates fake content designed to look as realistic as possible. The other (the discriminator) evaluates whether the output is convincing enough to pass as real. They iterate against each other until the result is nearly indistinguishable from genuine media. The result is synthetic content that's extremely difficult to flag — whether it's a fabricated video call, a cloned voice, or a forged ID photo.

Any time someone can be convincingly impersonated online, the potential for abuse is enormous. Deepfakes have already been weaponized for:

• Financial fraud
• Spread of misinformation and propaganda
• Reputational damage
• Espionage
• Generation of nonconsensual imagery, including child exploitation material
• Harassment and invasion of privacy
• Intellectual property misappropriation
• Blackmail

The tools needed to create deepfakes are inexpensive and widely accessible, allowing bad actors to exploit them for an endless variety of purposes.

Deepfakes and financial fraud

Deepfake scams are driving a new wave of financial fraud — and the scale has gone industrial. Account openings, account takeovers, phishing, impersonation, and the creation of entirely fake identities are all being supercharged by synthetic media.

Deepfake fraudsters use fabricated video to impersonate account holders, authorize wire transfers, or extract passwords and sensitive account information. They impersonate bank officials or corporate executives on live calls to issue fraudulent transfer instructions. In one widely reported case, a finance officer at a multinational paid out nearly $500,000 to scammers during what he believed was a video call with company leadership. The possibilities are nearly endless, and the potential damages for financial institutions can stretch into the millions of dollars.

According to Regula Forensics, over a third of companies will experience deepfake voice fraud, and 29% will be taken in by deepfake video fraud. And this is all happening with alarming speed. Deepfake attacks using face swap technology to bypass remote identity verification increased by 704% in 2023, according to SC Media.

How deepfakes are made

Most people have a digital footprint sufficient for bad actors to create extremely convincing deepfake footage. Deepfake technology deconstructs and manipulates subtle facial features, then incorporates them into synthetic videos. A virtual camera feed with the deepfake is then used to replace the webcam that would normally record the participant's face.

Deepfakes are incredibly difficult to identify because they are extremely realistic and people are easily deceived by them. The technology keeps improving, making it very hard to detect new developments in deepfake production. Compounding the challenge, there is currently no federal law that specifically bans deepfakes. According to TechCrunch, the FTC would like to expand its impersonation rule to cover the impersonation of individuals, not just companies or government agencies. The agency may also move to criminalize goods and services used to harm consumers through impersonation via deepfakes.

The barrier to entry has also collapsed. Fraudsters are now paying as little as $15 for a fake ID and using simple desktop software to pass biometric selfie comparison tests.

Why a layered approach necessary to fight deepfake fraud

Deepfake technology is specifically designed to defeat individual verification methods. A fraudster who knows which single check they need to pass will optimize their fake to pass it. A layered approach introduces uncertainty: the fraudster doesn't know which combination of signals will be evaluated, which makes it far harder to engineer a successful attack. Behavioral analysis, device fingerprinting, phone validation, and human-in-the-loop review each address different attack vectors that a synthetic identity alone cannot defeat.

How to combat deepfake fraud

Many companies post about how easy it is to create a fake ID or a deepfake, then proceed to offer a single solution — one verification method that will make the fraud problem go away. That's not realistic. Deepfake fraud is genuinely hard to combat, especially when organizations rely on only one method — human or software — to catch it. Neither approach is failsafe on its own. The most effective way to combat deepfakes is a layered approach that combines human judgment with a biometric platform.

Two core elements make that layered model work:

• Deepfakes are getting so convincing they may become imperceptible to humans. But humans can inject randomness into an interaction in real time. Think of someone on a video call who is asked to perform something completely unexpected — verifying themselves with a bank login, or taking a picture of themselves from a second device while staying on video. With the right tools, a trusted agent can effectively serve as the CAPTCHA for deepfakes.
• A trust platform needs to offer additional safeguards that confirm identity and signal potential deepfakes from multiple angles. Once a fraudster knows they can get past a fake ID and video, they may neglect other subtle tells. Is the email address real or fabricated? Is the phone number registered to that person? Did they log in from a suspicious country or device? Is the credit card registered to them? Not knowing which verification method matters — or which will be used — forces fraudsters to guess at how to beat the system.

The best defense against deepfakes is a layered model of data and signals. Rather than simply scanning an ID and trusting it, organizations need to evaluate the trustworthiness of the device, the location of the user, the phone number being used, and the behavior exhibited by the person across multiple interactions. Comparing a current interaction against past behavior can also surface suspicious patterns: Did the person use this location last time? This device? Where are they usually, and are they there now?

The platform also needs to be able to dynamically orchestrate the types of verification requested, depending on the use case, regulatory requirements, and applicable law. And most importantly, there needs to be a human in the loop so that a transaction can escalate to a person in real time.

Biometric Update summarizes the requirement clearly: "Only the combination of authenticity checks, support for electronic documents verification, cross-validation of personal data and ability to re-verify data on the server side can protect you from fraud."

Proof's identity verification platform is built on exactly this layered model — combining document verification, biometric checks, behavioral signals, and human review to create a defense that's difficult to game. If your current verification stack relies on a single method, it's time to reassess what's protecting your transactions.