AI Killed KYC

Deepfakes have beaten document-and-selfie checks. Sponsor banks are responsible for every customer their fintechs sign up, and soon they will have to cut off fintechs that cannot prove their customers are real.

On September 12, Revolut confirmed it had disclosed customer information after receiving fraudulent requests from a legitimate government agency's email domain. The information included passport and driver's-license copies; verification selfies and transaction histories may also have been exposed. Revolut said a limited number of customers were affected and customer funds were unaffected. Earlier this month, Brian Krebs reported an identity theft service selling more than 153 million driver's-license records. He found his own license with timestamps corresponding to when he handed it to a rental car associate.

Criminals now have the documents companies accepted as ID. We do not yet know how much fraud these exposures have enabled. But criminals already use AI to impersonate people with stolen identity documents. FinCEN warned financial institutions in November 2024 about suspected use of deepfake media and fraudulent identity documents to circumvent verification. Financial institutions need a new model for identity verification, now. AI has already killed document-and-selfie KYC.

Copies Are the Problem

Document-based KYC checks often begin with a user submitting a photograph of a passport or driver's license. When the company retains that image, the customer's exposure continues after the check is complete. Krebs's reporting shows how a routine ID handoff can leave a record available for sale long afterward. In Revolut's case, the company released stored customer records in response to an impersonator.

Stolen copies give attackers genuine names, document details and photographs to use in impersonation. In a case reported in August 2024, criminals obtained victims' IDs and used AI-altered images to bypass an Indonesian financial institution's facial recognition and liveness checks. Group-IB's subsequent investigation identified more than 1,100 fraudulent accounts.

Other services sell fabricated documents based on document copies. In February 2024, 404 Media tested OnlyFake, which advertised fake ID images for $15. A reporter used one to pass identity verification at the cryptocurrency exchange OKX.

By April 2026, an MIT Technology Review investigation had identified 22 public Telegram channels and groups advertising bypass kits and stolen biometric data. Some tools substitute images or video for the phone's live camera feed. Researchers described attacks combining stolen biometric data with deepfakes.

False identities also help sanctioned actors earn and move money. The U.S. Treasury Department reported in November 2025 that North Korean IT workers use false or stolen identities to obtain work and create accounts on freelance websites. Treasury links revenue from these schemes and other illicit activities to the country's weapons programs.

Each new leak gives them more identities to impersonate with tools they can buy online. Financial institutions should not need another round of fraud losses to abandon a model that accepts evidence criminals can reproduce.

Sponsor Banks Will Drop Fintechs Whose Checks They Cannot Trust

Fintechs will feel this through their banks. Most fintech apps do not hold a bank charter. They rely on a sponsor bank, a chartered bank that holds their customers' accounts, and the fintech or its vendor checks each customer's identity on the bank's behalf. Federal banking regulators said in 2024 that using third parties "does not diminish" a bank's responsibility to comply with the law. In many programs the bank receives a record that a customer passed a document-and-selfie check, without the evidence behind it. The bank cannot repeat the check, and AI has made a passing result worth less.

Sponsor banks were already tightening after 2024 enforcement orders against Evolve and Thread over risk management in their fintech programs, and one sponsor bank now calls itself "super selective". Deepfakes give those banks a reason to raise the bar again. A bank that cannot check a fintech's customers itself has to supervise that fintech's process more closely or decline the program.

Verifiable Evidence Should Replace Document Copies

Financial institutions should check identity through verifiable evidence backed by authoritative records without asking customers to upload another copy of their ID. At Opacity we call these reusable credentials. A credential contains checked facts about a person and cryptographic evidence of who issued it and whether it has been altered. The institution must also establish that the person presenting it is its rightful owner. These checks demand more evidence than a document image and a matching selfie. An AI-generated face does not establish the credential's origin or ownership. NIST's identity-proofing guidelines already recognize cryptographic checks on the source and integrity of identity evidence.

Users should choose which qualifying credentials to present and share only the information required for the check. The technology lets a bank receive confirmation of a required fact without collecting the entire document behind it. Keeping fewer copies reduces the personal information available to thieves and the bank's exposure if its records are compromised. Institutions still retain required records and remain responsible for screening customers. Banks and regulators should adopt this stronger standard now: less personal information exposed to theft, and identity checks that work even when the customer's documents are already in criminal hands.

Institutions That Keep Accepting Document Copies Will Absorb the Fraud

Criminals already hold stolen documents and the AI tools to use them. Financial service providers can still change how they verify customers, but every month they wait adds to an unknown future risk.

Fraudsters go after the weakest checks. As more banks and fintechs verify customers with verifiable evidence, the ones still accepting document photos and selfies will get the fraud the others turn away.

This is why Opacity exists. We believe there is a better way to verify who people are. Opacity builds credentials that verify people against authoritative records instead of document copies. Users choose which credentials to present and share only what each check requires. Institutions get a stricter test than a document and a selfie, along with the evidence to meet their compliance obligations. The stricter test also means fewer fake accounts, less personal data stored for thieves to steal, and a record a sponsor bank can check for itself.

If you run a fintech, wallet or other front end and want to offer reusable credentials to your users, or you are a tokenized securities venue (TSV) or securities issuer that needs investor verification, contact the Opacity team to learn more.