{"id":9624,"date":"2025-06-20T10:04:03","date_gmt":"2025-06-20T10:04:03","guid":{"rendered":"https:\/\/www.amlcc.com\/?p=9624"},"modified":"2025-06-20T10:04:04","modified_gmt":"2025-06-20T10:04:04","slug":"spotting-fake-ids-in-online-aml-checks","status":"publish","type":"post","link":"https:\/\/www.amlcc.com\/jm\/spotting-fake-ids-in-online-aml-checks\/","title":{"rendered":"Spotting fake IDs in online AML checks\u00a0"},"content":{"rendered":"\n

Spotting fake IDs in online AML checks\u00a0<\/h1>\n\n\n
\"Richard<\/div>
Richard Simms<\/span>

Director and Founder of AMLCC and AMLCC Consult<\/h3><\/div><\/div><\/div><\/div>\n\n\n
\"Spotting<\/figure><\/div><\/div>\n\n\n\n
\n
\n

You run your usual AML searches. Sanctions clear. PEPs clear. ID documents match. Job done? Not quite.<\/p>\n\n\n\n

AML searches and online identity checks are now standard procedure. Yet modern AI is shifting the landscape. Gone are the days of simple document forgery. Criminals now use deepfake technology to generate realistic video calls, voice messages and fake IDs that can\u2014and do\u2014fool online ID checks.<\/p>\n\n\n\n

For small property, legal or accountancy businesses, understanding how deepfake fraud fits into your daily operations is critical.<\/p>\n\n\n\n

AI deepfakes are already working<\/strong><\/h2>\n\n\n\n

In early 2024, Arup (the global engineering firm behind icons like the Sydney Opera House) was conned into transferring nearly \u00a325 million<\/a> after a finance employee in their Hong Kong office received a video call from what looked and sounded like the firm\u2019s CFO. Over 15 transfers totalling US$25\u202fmillion were made before it became apparent that none of the participants was genuine\u2014they were all deepfakes generated from livestream and meeting footage<\/p>\n\n\n\n

Another well-publicised case is a 2019 incident involving a UK energy company<\/a>. A cloned voice of the parent company\u2019s German CEO persuaded their UK subsidiary to send \u20ac220k to Hungary, money that was quickly moved on via Mexico.<\/p>\n\n\n\n

Voice-cloning tech has been used to mimic the bosses of WPP, Octopus Energy and others via WhatsApp and video, prompting near-miss transfers of large sums. Deepfake technology is good. And it\u2019s getting better.<\/p>\n\n\n\n

Can this really happen to your business?<\/strong><\/h2>\n\n\n\n

If you’re a small firm, it\u2019s easy to assume deepfakes are someone else\u2019s problem. Big money, big names, big targets. But the reality is that most businesses use similar tools and the same processes, and that makes everyone vulnerable.<\/p>\n\n\n\n

Let\u2019s take a hypothetical example. A client provides a passport and a utility bill. Your system runs a document-based, online identity check, maybe a biometric match, and an address or credit reference check. All green. You jump on a video call to finalise things. The person looks and sounds exactly like the ID.<\/p>\n\n\n\n

But what you\u2019re seeing might be an AI-generated replica. Something designed to pass every layer of your check, except one: human instinct.<\/p>\n\n\n\n

This is where small firms have the edge. You know your clients. You ask smart questions. You\u2019re not stuck in red tape. The trick is using that advantage on purpose\u2014not just by accident.<\/p>\n\n\n\n

How to strengthen your defences<\/strong><\/h2>\n\n\n\n

1. Add a live, unpredictable step<\/strong><\/p>\n\n\n\n

Standard document and biometric checks are essential, but not enough on their own. You need something dynamic. Ask the person on a live call to say a randomly generated phrase. Or hold up an everyday object (like a pen or a mug). Ask them to turn their head or change the lighting. These are small tests that throw off deepfakes.<\/p>\n\n\n\n

2. Layer your verification<\/strong><\/p>\n\n\n\n

Don\u2019t rely on one method. Combine a document check with biometric verification, and follow up with a credit or address validation from a separate source. When a fraudster fakes one layer, it sometimes doesn\u2019t match the others.<\/p>\n\n\n\n

Fraudsters are known to use a tactic called \u2018repeaters\u2019. This is where they test fake documents before they ever reach you, automatically uploading lots of slightly different versions to identity platforms to see what gets through. One version might get rejected, another accepted. Over time, they learn exactly how to design a fake that passes. <\/p>\n\n\n\n

This is why layering your checks is so important. If one system is fooled, the others can still catch it.<\/p>\n\n\n\n

3. Watch their behaviour<\/strong><\/p>\n\n\n\n

Warning signs of money laundering and fraud often come up in the day-to-day business relationship you have with your client. Be alert to signs like:<\/p>\n\n\n\n