Digital onboarding was built around a simple assumption: the face on the camera belongs to the person opening the account, and the identity document is either genuine or forged badly enough to catch. Generative AI has broken that assumption. Deepfake video, cloned voices, and fabricated identities generated in bulk are now routinely used to pass onboarding checks that were never designed to question whether a face is real in the first place, and institutions evaluating an AML screening solution in Dubai are increasingly having to plan around this specific gap.
What Deepfake and Synthetic Identity Fraud Actually Look Like
These are two related but distinct attack types, and screening tools need to catch both.
- Deepfake identity fraud. AI-generated or manipulated video, audio, or images used to impersonate a real person, or to present a fully synthetic face during a liveness or selfie check.
- Synthetic identity fraud. A blend of real and fabricated personal data, such as a stolen or invented ID number paired with a fake name and date of birth, used to build an identity with no prior history.
- Why synthetic identities are harder to catch. Because the identity was designed from scratch, it has no fraud record and no watchlist hits, so negative-record screening finds nothing wrong with it.
Why This Threat Is Growing So Quickly
- Synthetic identities made up roughly one in ten fraud cases globally as of early 2026, an eightfold increase, according to LexisNexis, with global losses estimated between 20 and 40 billion dollars annually
- Deepfake fraud attempts during digital onboarding increased by more than 300 percent year over year, per industry reporting cited in recent UAE banking research
- Fraud toolkits have collapsed in price: bundled synthetic document and deepfake video kits have been documented selling for roughly 629 dollars a year, AI-generated identity documents for around 15 dollars each in bulk, and virtual camera injectors for about 30 dollars a month on public channels
- FATF’s December 2025 Horizon Scan explicitly names deepfakes as a tool capable of bypassing AML controls, customer due diligence systems, and digital ID verification at onboarding
This is the backdrop that matters for anyone evaluating an AML screening solution in Dubai right now, not the fraud landscape of even two or three years ago.
The UAE Picture
A BioCatch study published in April 2026, based on surveys of 100 Emirati banking executives, found that 66 percent of institutions reported an increase in fraud attempts; out of those 66 percent, 58 percent of those surveyed observed an increase in associated losses, and 62 percent estimated annual fraud losses exceeding 5 million dollars. The CBUAE’s fraud monitoring expectations require systems to operate 24/7/365, with integrated device, location, and behavior analysis, and to suspend sessions where remote control software is detected or a user is on the phone during a high-risk transaction. Onboarding flows are increasingly expected to align with the National KYC Platform rather than operating as a standalone check
Institutions weighing an AML screening solution in Dubai against this backdrop are not just comparing detection accuracy on paper. They are comparing whether a vendor’s approach reflects what Emirati banks are actually reporting as active, growing fraud pressure.
Why Traditional Verification Falls Short
- Passive liveness checks only confirm that a frame looks like a human face, which does not distinguish a real face from a convincing synthetic overlay
- Virtual camera injection, where a deepfake video stream is fed into the onboarding flow in place of a genuine camera feed, has been shown to bypass a wide range of active liveness implementations in testing
- Synthetic documents pass standard OCR and visual checks because their formatting, typography, and machine-readable zone data are constructed to meet the same standards genuine documents do
- Standalone identity verification and authentication tools, assessed in isolation from broader behavioral and device signals, are increasingly considered unreliable on their own against AI-generated deepfakes
Where the Risk Doesn’t Stop at Onboarding
Contact centre deepfake attempts have risen sharply industry-wide, moving from roughly one attempt a month to several a day at some institutions. Much of this activity targets account recovery, device re-binding, MFA resets, and agent-assisted support calls, which typically require less evidence than opening an account. An institution that only hardens its onboarding flow can still leave these weaker downstream touchpoints exposed to the same underlying attack methods.
What Screening Tools Need to Catch
An AML screening solution in Dubai built for this threat needs to go beyond a single liveness check at account opening.
- Active liveness detection paired with dedicated injection and deepfake detection, not passive checks alone
- Document forensics that go beyond OCR and visual formatting, capable of flagging structurally valid but fabricated documents
- Behavioral biometrics, including typing patterns, device context, and navigation behavior, layered on top of document and face checks
- Session-level evidence capture that holds up under later review, rather than a pass or fail decision with no supporting trail
How First Compliance Helps
First Compliance works with UAE financial institutions to assess whether their current onboarding stack can actually detect deepfake and synthetic identity attempts, rather than assuming a passed liveness check means a verified human. That assessment typically covers document forensics, liveness and injection detection, and how well onboarding data feeds into ongoing transaction monitoring once an account is open.
Conclusion
Deepfakes and synthetic identities are not a future risk for UAE onboarding flows. They are an active and rapidly growing one, reflected directly in what Emirati banking executives are already reporting and in the toolkits being sold openly for well under a hundred dollars. Closing this gap means treating identity verification as a layered problem, not a single liveness check, and evaluating any AML screening solution in Dubai against its ability to catch injection attacks, fabricated documents, and synthetic identities specifically, not just generic fraud patterns. First Compliance can be reached to review whether a current onboarding stack is built for this threat or still assumes the face on the camera is real.
Frequently Asked Questions
What is the difference between deepfake fraud and synthetic identity fraud?
Deepfake fraud uses AI-generated or manipulated video, audio, or images to impersonate a real person or fake a live face during verification. Synthetic identity fraud combines real and fabricated personal details to build an entirely new identity with no prior record.
Why can synthetic identities pass standard KYC checks?
Because the identity was built specifically to avoid detection, it has no fraud history and no watchlist hits, so checks that rely on flagging known bad actors find nothing to flag.
Can passive liveness detection catch deepfake video during onboarding?
Not reliably. Passive liveness checks generally only confirm a frame looks human, and testing has shown virtual camera injection can bypass many active liveness implementations as well, which is why layered detection matters.
Is this risk limited to new account onboarding?
No. Account recovery, device re-binding, and agent-assisted support interactions often require less evidence than opening an account, which makes them a growing target for the same deepfake techniques.
How are UAE banks responding to this threat?
Surveyed Emirati banking executives report rising fraud attempts and losses tied to this shift, and the CBUAE’s fraud monitoring expectations now call for continuous, integrated device, location, and behavioral analysis rather than a single point-in-time check.