Pain Point
The attack against document-and-selfie identity verification has changed faster than most banks' processes have.
According to iProov's threat intelligence data, native virtual camera attacks — software that feeds a fake video feed directly into a verification system instead of showing a photo to a real camera — grew 2,665% year over year, with iOS-specific injection attacks up 741% across 2025.
Group-IB's January 2026 “Weaponized AI” report documented 8,065 biometric injection attempts against a single financial institution's digital onboarding in an eight-month window — at one bank alone.
A documented 2026 court case saw 46 fraudulent bank accounts opened using deepfaked selfies that defeated a photo-and-selfie check without genuine liveness detection behind it.
Toolkits automating this entire attack — generating a forged document and a matching deepfake video together — are sold as a service for a few hundred dollars a year, no technical skill required.
A verification process built to catch a printed photo or a paper mask is not the same thing as one built to catch a synthetic video feed injected directly into the verification pipeline — and the gap between the two is exactly where 2026's attacks are landing.
How It Works — The 7-Step Process
Identity verification for a bank runs as a seven-step process, and where a bank's defenses actually sit within it determines whether 2026-era attacks succeed or fail:
Data submission — the applicant provides personal information — name, address, date of birth — as the baseline the rest of the process checks against.
Document capture and authentication — a government-issued ID is analyzed for security features, tampering, and consistency; where available, NFC chip verification checks the document against data cryptographically signed by the issuing authority — a step that catches roughly 62% of synthetic-identity attempts a purely visual check would miss.
Data cross-check — the data extracted from the document is matched against what the applicant submitted, and checked against trusted external sources, confirming the identity exists independent of the document alone.
Biometric liveness and injection-attack detection — a selfie or video is matched against the document photo, while liveness detection confirms a real, present person — and, critically in 2026, injection-attack detection confirms the camera feed itself hasn't been substituted before it ever reached the verification system.
Risk signal enrichment — device, network, and behavioral signals — including whether the same document or device has appeared in a prior flagged application — add context a document-and-face check alone can't provide.
Automated decisioning — the signals combine into a composite score with reason codes, routing the application to pass, review, or decline.
Ongoing re-verification — identity confirmation continues after onboarding — the authentication half of the process — since a clean identity at account opening doesn't guarantee the account is still controlled by the same person a year later.
Step 4 is where 2026's attacks specifically concentrate. A liveness check that only asks “is a face present” passes a well-made deepfake. One that also asks “is this camera feed genuine” is what catches an injection attack before it reaches step 6.
False Positives
A bank tightening every step in response to this threat risks rejecting real customers over ordinary lighting or an unfamiliar document format. The fix demonstrated by 2026's attack data isn't broader suspicion — it's adding the specific detection layer (injection-attack detection at step 4, document authenticity at step 2) that was actually missing, without making every applicant re-prove they're human twice over.
Business Impact
Reduced exposure to the injection-attack and deepfake methods driving 2026's fastest-growing onboarding fraud category.
A verification process that catches synthetic identities at the document step, before they ever reach a human reviewer.
An auditable process a bank can walk a regulator through step by step, not describe only in general terms.
Ongoing re-verification that closes the gap between a clean onboarding file and account behavior months later.
How Finchecker Solves It
Finchecker's identity verification software runs document authentication, biometric liveness, and injection-attack detection as one connected process — built for the specific 2026 attack methods (virtual camera injection, deepfake video, synthetic documents) that a standard photo-and-selfie check no longer catches.
See how identity verification software stands up to 2026's injection attacks, not just 2020's photo fraud. Talk to Finchecker about identity verification for banks.
