Short answer

FinCEN reported in November 2024 that criminals use generative AI to alter or create ID images and combine them with stolen or fake personal data to get past identity checks. Banks respond with re-reviews, live checks and detection tools, and NIST's 2025 guidelines add controls for deepfakes and injection attacks. Your best protection is to share ID images sparingly.

Key takeaways

  • FinCEN observed an increase from 2023 into 2024 in suspicious activity reports describing suspected deepfake use, mainly fraudulent identity documents that circumvent verification.
  • Criminals combine AI-generated images with stolen or entirely fake personal information to build synthetic identities.
  • Accounts opened with such identities were used to receive and launder proceeds of other fraud, according to FinCEN's analysis of Bank Secrecy Act data.
  • NIST's SP 800-63-4, finalised in July 2025, adds controls for injection attacks and forged media such as deepfakes.
  • Handing a scan or selfie to a fake employer, landlord or buyer gives criminals source material, so share ID only with verified parties.

What FinCEN found

The US Treasury’s Financial Crimes Enforcement Network (FinCEN) issued Alert FIN-2024-Alert004 on November 13, 2024. It reported an increase, beginning in 2023 and continuing in 2024, in suspicious activity reports describing suspected use of deepfake media in fraud schemes. These schemes often involve criminals altering or creating fraudulent identity documents to circumvent identity verification and authentication methods.

According to FinCEN’s analysis of Bank Secrecy Act data, criminals have used generative AI to create falsified documents, photographs and videos to get around customer identification and due diligence controls. Some institutions reported that criminals altered or generated images for driver’s licences and passport cards and books, either by modifying a genuine source image or creating a synthetic one. Criminals also combined AI images with stolen personal information or entirely fake information to build synthetic identities.

The consequence is not only a fake account. FinCEN says bad actors opened accounts with suspected AI-made identities and used them to receive and launder the proceeds of other fraud, including online scams, check fraud, credit card fraud, authorised push payment fraud, loan fraud and unemployment fraud. Some were used as funnel accounts. That is how a fake identity ends up in the path of your money.

How banks catch it

FinCEN says institutions often detect AI content by re-reviewing a customer’s account opening documents. A reverse image search can show that the ID photo matches an image in an online gallery of AI-generated faces. More technical steps include examining an image’s metadata or using software designed to detect deepfakes.

Indicators that deserve more scrutiny, in FinCEN’s words not conclusive on their own, include inconsistencies among documents, inability to authenticate identity or source of income, and a photo that does not fit the date of birth. Account behaviour matters too: an IP address that does not fit the profile, coordinated patterns across similar accounts, rapid transactions on a new account, high chargebacks, and funds withdrawn quickly in ways hard to reverse, such as international transfers or offshore exchanges. AI fraud detection and what banks can see covers that side in more detail.

FinCEN’s best practices are multifactor authentication, including phishing-resistant forms, and live verification in which a customer confirms identity through audio or video. It warns that criminals may claim repeated technical glitches or ask to switch communication methods, and that some tools flag third-party webcam plugins that display previously generated video instead of live video.

What NIST changed

NIST’s SP 800-63-4, the fourth revision of its Digital Identity Guidelines, was finalised in July 2025 after almost four years and nearly 6,000 public comments, according to NIST. The page says it expands fraud requirements and recommendations for identity proofing and adds controls for injection attacks and forged media, with deepfakes given as an example. Injection attacks feed fake media directly into a verification system, bypassing the camera. These are guidelines for US federal agencies and a widely used reference, not a law binding every bank.

Why this matters to you

Your ID can be abused in two ways. A criminal can use a stolen or synthetic identity to open accounts that launder scam proceeds, and a criminal can use your own ID photo as source material for a forgery. The FBI’s December 2024 alert says criminals produce fake identification such as driver’s licences or credentials for identity fraud and impersonation.

The most common way ID photos reach criminals is by request. Fake job offers ask for a passport scan for “onboarding”, fake landlords ask for ID before a viewing, and fake buyers ask for a selfie with a card. See AI job interview deepfakes and hiring scams, job scams and rental scams.

Protecting your ID

  • Verify the organisation yourself before sending any ID image.
  • Mark copies with the recipient and date, and delete copies after use.
  • Limit public photos and voice samples, as the FBI advises, and keep accounts private.
  • Monitor accounts and credit reports, and freeze credit if exposed.
  • Use phishing-resistant multifactor authentication where offered.

If your identity is misused, report at IdentityTheft.gov, tell the bank involved, and file at ic3.gov. Account takeover after a phone number is hijacked is covered in SIM swap and account takeover scams.

What you can do

  1. 01Provide ID photos and selfies only to organisations you contacted yourself through a verified channel.
  2. 02Treat requests for ID in job offers, rentals and online sales as high-risk until you have confirmed the other party independently.
  3. 03Watermark ID copies you must send with the purpose and date, and delete files you no longer need.
  4. 04Check your credit reports and bank accounts regularly and freeze your credit if your ID is exposed.
  5. 05Report identity theft at IdentityTheft.gov and fraud at ic3.gov, and tell the affected bank straight away.

Related reading: AI voice clone scams and the data breach tracker.

Frequently asked questions

Can AI really create a fake driver's licence that passes online checks?

FinCEN reports that some financial institutions saw criminals use generative AI to alter or generate images for IDs such as driver's licences and passports, and that criminals successfully opened accounts with identities suspected to be AI-made. It does not say how often checks fail, and detection methods are improving.

What is a synthetic identity?

FinCEN defines it as a combination of real and fake personal information used to fabricate a person or entity that can pass validation processes. A made-up face on a made-up ID with a real stolen number is a typical example.

How do I stop someone using my ID photo?

You cannot fully prevent misuse, but you can limit supply. Send ID only to verified organisations, add a dated purpose note to copies, monitor your credit, and consider a credit freeze. Report any misuse quickly.

Do selfie and video checks still work?

They help but are not foolproof. FinCEN lists live verification checks and multifactor authentication as best practices, while warning that criminals may try to avoid live checks or use webcam plugins to display pre-made video.

Sources

  1. FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (FIN-2024-Alert004), FinCEN, U.S. Department of the Treasury, 2024-11-13
  2. NIST SP 800-63-4, Digital Identity Guidelines, National Institute of Standards and Technology, 2025-07-01
  3. Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (PSA I-120324), FBI Internet Crime Complaint Center, 2024-12-03

This article reflects public information as of 2026-11-06. AI tools and rules change quickly; we update articles when new facts are published. Spot an error? See our editorial and corrections policy.