Banks can verify a customer’s identity at account opening, but that verification offers limited assurance about how the associated risk may change over time. Artificial intelligence (AI)-generated documents, deepfake impersonation and synthetic identities are adding to that concern, particularly as banks extend loans, credit cards and other services to customers they have never met in person.

Bala Kumar, President and Chief Product and Technology Officer of identity verification provider Jumio, argued that banks could use shared identity histories both to reassess risk after onboarding and to reduce repeated document submission for recognised customers. As AI makes documents and impersonation more convincing, his proposition is to combine that history with other signals to admit genuine customers faster and direct scrutiny towards suspicious cases.

AI is making identity fraud harder to detect

In September 2025, the Monetary Authority of Singapore (MAS) published an information paper on deepfake-related cyber risks, identifying the defeat of biometric authentication as a key area of impact and recommending safeguards including liveness detection and protection against injection attacks. The paper outlined suggested measures rather than new binding requirements.

Kumar said regulators had to balance fraud prevention against the friction their rules imposed on the public, so technology typically moved first. “The technology is ahead of the regulators,” he said.

In November 2024, the US Financial Crimes Enforcement Network (FinCEN) reported increased suspicious activity filings involving suspected deepfake use, particularly fraudulent identity documents intended to circumvent verification and authentication controls at financial institutions.

Kumar said he personally could once identify a fabricated document within seconds; now he could examine an AI-generated one for five minutes “and I still cannot be sure whether it’s good or bad”. Fraudsters shared techniques, he added, while institutions often defended their systems in isolation.

In April 2026, Jumio reported a 700% year-on-year rise in injection attempts, which introduce manipulated images or video directly into verification systems. Kumar said the figure measured all attempted attacks, not only those rejected. Jumio did not disclose the number of attempts or their share of total verifications.

Kumar advocated combining document, facial, liveness, device and contact-detail checks. A fraudster submitting three identities from the same laptop, he explained, might initially pass verification before repeated device use raised suspicion. He stressed that signals needed to be considered together, recognising that families could also share devices. FinCEN similarly identified inconsistent device information and third-party webcam plug-ins as potential warning signs.

Independent certification also needs to be read within its scope. Jumio’s iBeta result, announced in October 2025, covered presentation attacks under ISO/IEC 30107-3 Level 2, such as photographs or masks shown to a camera. It did not establish protection against injection attacks, where manipulated images or video enter the verification system directly. Injection attacks are addressed separately under the technical specification CEN/TS 18099.

Identity risk does not end at onboarding

The challenge also extends beyond the initial verification, as subsequent use of an identity can reveal risks that were not apparent at account opening.

Kumar described how some fraudsters reused successfully verified identities at other institutions within hours or days, while more organised actors waited months. Others created synthetic identities by combining genuine personal details belonging to different people. He said he had seen such identities build credit histories over five or six years before being used for fraud, with potential payouts of $20,000 to $40,000 as higher credit scores enabled larger loans.

Historical context was among the hardest signals for impersonators to replicate, Kumar argued. Although AI could generate convincing faces and documents, building a credible identity history took time. However, the synthetic identity examples showed that even established financial histories could be misleading.

Banks also have limited visibility into how an identity is used beyond their own customer relationships. Suspicious patterns at another institution may not be apparent through a bank’s existing monitoring, creating a potential role for cross-institution identity intelligence.

Jumio launched Jumio Watch in April 2026 to reassess identity risk after verification. The company said early studies showed up to 25% more risk detected after onboarding, although this did not establish a corresponding reduction in fraud losses. Kumar said risk profiles varied by customer, region, season and controls, with promotional incentives potentially attracting a different mix of applicants.

Kumar said Jumio could alert a bank using its continuous assessment service when subsequent encounters with the same identity elsewhere in its customer network raised concerns about that identity. “We’re not saying it’s bad, we’re saying it’s risky, go take a look,” he said. The bank could then investigate or seek additional information before extending credit or releasing further funds.

Continuous identity assessment would supplement rather than replace existing controls, including periodic know-your-customer (KYC) reviews. Transaction monitoring examines account activity, while sanctions screening identifies restricted parties. Identity intelligence adds information about the customer behind those activities.

Can reusable identity reduce onboarding friction?

Previous identity information has a separate use at onboarding, where it can reduce repeated document submission for recognised customers.

Stricter identity checks can increase onboarding costs and cause legitimate customers to abandon applications. Kumar identified three competing concerns for banks: customer drop-off, fraud losses and the expense of manual reviews and support. He compared the objective to airport fast-track lanes, where previously vetted travellers face fewer checks.

Banks are already using reusable identity information to simplify onboarding. In Singapore, Singpass Myinfo allows customers to consent to sharing government-held information when opening accounts, reducing repeated data entry. Private-sector models are also emerging, using previously verified identity records and biometrics to recognise returning users.

Jumio’s selfie.DONE™ follows the latter approach. It starts with a selfie, checking whether the applicant is already represented in its identity graph containing more than 75 million legitimate and fraudulent identities, according to the company. Where a suitable existing record is found, Jumio can retrieve and reassess the identity document with new fraud checks without asking the applicant to submit it again. Other applicants undergo conventional verification.

Kumar said around six in ten users arriving for verification in the deployments he described were already represented in the graph, allowing Jumio to draw on their existing identity records. Separately, the company reported a 20% improvement in verification completion rates. These findings came from Latin America and North America.

For banks, the commercial case rests on how many applicants can be recognised in their markets and whether fewer verification steps improve completion rates without increasing fraud losses or compliance costs.

Regulatory responsibility remains with banks

Reusable identity raises a question banks cannot hand to a vendor: when can they rely on a check performed elsewhere? Kumar said the decision rested with each bank’s compliance function, noting that “every compliance team has a completely different approach”, even within the same institution.

In Singapore, MAS Notice 626, which sets anti-money laundering and countering the financing of terrorism (AML/CFT) requirements for banks, permits them to rely on qualifying third parties for specified customer due diligence measures, but not for ongoing monitoring. MAS guidance distinguishes this from outsourcing, where a provider performs checks under the bank’s own AML/CFT controls, an arrangement that may instead fall under MAS Notice 658 on outsourcing by banks.

Kumar described a process in which a matched identity’s document is re-examined against current fraud models. “It’s a fresh assessment that we’re doing, except we’re not asking the customer to give it,” he said. Banks would need to establish how their arrangements fit the applicable requirements and remain responsible for meeting their obligations.

Kumar said Jumio acts as data controller for identities in its graph, with users’ consent. He described an explicit consent request during the verification journey, which users had to accept before proceeding, allowing their identity information to be reused across participating companies. Banks adopting reusable identity would also need to establish how responsibility is shared with the provider and the original verifier if a reused identity later proves fraudulent.

Beyond these responsibilities, banks would need to assess the operational benefits. For continuous identity assessment, the test is whether it reduces fraud rather than simply generating additional alerts. Kumar emphasised allowing recognised customers to complete verification quickly while directing scrutiny towards suspicious cases. “You have to find the balance in conversion and fraud,” he said.

Banks would need to assess whether those alerts lead to timely intervention, weighing any reduction in fraud losses against false positives, investigation costs and customer abandonment.