The Deepfake Detection Gap: How Many of Your Verified Customers Never Existed?

When a loan goes bad, it gets filed as a default: a real customer who couldn't repay. But a growing share of credit losses don't fit that story. They aren't borrowers who failed to repay. They're borrowers who never existed.

These are synthetic identities: profiles assembled with AI-generated or deepfaked credentials that passed your KYC checks, behaved like real customers, and built a credit history. Then they walked away from exposure no one can ever collect on.

This is no longer a fringe problem. Synthetic identity fraud now accounts for 20% of credit losses in the U.S. financial system. In Javelin's 2024 Identity Fraud Study, 73% of financial institutions reported it rising, and US lender exposure reached a record $3.3 billion.

And the problem isn't only at the front door anymore. It's already inside the building.

That misclassification compounds quietly. When ghost borrowers are counted as defaulters, provisioning models distort, risk ratings lose accuracy, and recovery teams spend months chasing people who were never real.

It also masks intent. Synthetic profiles are often nurtured deliberately, built up with credit history and believable behaviour over months or years, before a calculated "bust-out" maxes every line at once and disappears. Filed as a default, it looks like bad luck. It was a plan.

Most identity systems are being upgraded to catch deepfakes at onboarding. That's necessary work, but onboarding has never been airtight. By one estimate, 95% of synthetic identities go undetected at the onboarding stage. And the upgrades leave the harder question unanswered: what about the accounts verified before today's controls existed?

There was a window, still open for many institutions, when deepfake generation had already outpaced detection. Synthetic identities sophisticated enough to defeat live verification became viable well before detection tools could reliably catch them. Every account onboarded in that window passed verification against controls that, in hindsight, could not see what they were up against.

Those identities did not get caught later. They settled in. They are in your portfolio today, operating as legitimate accounts. Together they form a body of identity debt that routine KYC remediation is structurally not designed to find.

This is not a marginal edge case. It is a structural limit on how detection works, and it has two consequences for financial institutions.

The first explains the historic risk. Detection models in use when many of your accounts were onboarded were trained against a narrower range of known threats. Actors using newer generation methods produced deepfakes that fell outside what those models had ever learned. Those identities passed verification not because any single control was weak in isolation, but because the controls were structurally incapable of recognising what they had never been trained to see.

The second consequence is that the problem is ongoing. A detector that is not continuously retrained against the newest generation methods is already partially obsolete, and any synthetic identity created with those newer methods can pass it today.

The research points the same way. Europol's Innovation Lab, in its report Facing Reality? Law Enforcement and the Challenge of Deepfakes, has noted that detection trained on known deepfakes offers limited assurance against fakes produced by unknown or updated models. A 2025 systematic analysis in the Journal of Sensor and Actuator Networks (Alawadhi et al.) reached a similar conclusion: keeping pace depends on detection methods that are robust and continuously adaptable. And the World Economic Forum's January 2026 report, Unmasking Cybercrime: Strengthening Digital Identity Verification against Deepfakes, tested commercial verification tools against real-world attack tools and concluded that identity systems must continuously adapt to remain resilient.

Most KYC remediation programs do important but narrow work: refreshing expired ID documents, updating addresses, re-screening customers against sanctions lists, re-rating risk. Those are surface-level updates to a customer record, and they assume the identity behind that record was genuine to begin with.

The global standard actually supports going further. The FATF Interpretive Note to Recommendation 10 requires institutions to keep the data collected during customer due diligence up to date and relevant by reviewing existing records, particularly for higher-risk customers.

That obligation was written for ongoing monitoring. But applied with current detection, it does something far more consequential: it lets you satisfy a regulatory requirement and remove synthetic profiles from your portfolio in the same pass.