KYC Fraud
Add device and runtime evidence to identity verification. Investigate manipulated onboarding sessions as AI makes fraudulent identities easier to produce.
The wider identity fraud problem.
KYC fraud starts when someone opens an account under an identity that is stolen, fabricated, or partly invented. A convincing document can get an account through onboarding and leave the business dealing with fraudulent borrowing, stolen funds, or money laundering later.
Identity theft reports provide context for the stakes of onboarding. They cover more than KYC fraud, and the figures do not isolate fraud caused by AI.
Reported identity theft
Complaints received by FBI IC3 · 2023–2025
More reports, more cases to investigate.
Reported complaints, not an estimate of all identity theft or failed KYC checks. Reporting practices and category assignment can affect totals.
FBI · Internet Crime Complaint CenterPage 25 · complaint countsView underlying data
| Category | Value |
|---|---|
| 2023 | 19,778 |
| 2024 | 21,403 |
| 2025 | 31,675 |
Identity theft losses
Losses reported to FBI IC3 · 2023–2025 · USD
The impact continues after account creation.
Losses associated with IC3’s identity theft category. These are reported losses across identity theft scenarios, not KYC-specific losses or an AI attribution.
FBI · Internet Crime Complaint CenterPage 26 · complaint lossesView underlying data
| Category | Value |
|---|---|
| 2023 | $126,203,809 |
| 2024 | $174,354,745 |
| 2025 | $185,832,657 |
A fabricated identity is getting easier to produce.
FinCEN has observed growing suspicious activity reporting involving deepfakes used against identity checks. Its analysis describes accounts opened with AI-generated identity documents, then used to move criminal proceeds.[2]
That changes the economics of fraudulent onboarding: producing another plausible face or document takes less time and fewer resources. Pair document scrutiny with evidence about the app and device delivering it, and investigate suspicious patterns across registrations.[2][3]
Check the environment behind the identity.
Identity verification examines the person and their documents. Device integrity asks a different question: is the app collecting that evidence running in an environment someone has manipulated? Instrumentation and runtime hooks can interfere with an onboarding flow even when the submitted information looks plausible.
Cipherstep’s Attestation SDK collects supported device and runtime observations and seals them into an opaque artifact. Your backend submits it to the Decision API before completing registration. Findings about instrumentation, jailbreak indicators, or inconsistent system values can inform a challenge or review; RASP can interrupt supported runtime attacks inside the app.
Your identity and liveness checks still establish who is applying. Attestation helps assess the client used to apply; it does not establish that a document or face is genuine.
A face scan from a manipulated runtime.
Illustrative session · highlights show the decision and supporting findings.
Decision API response
JSON/v1/evaluations/{evaluationId}{
"evaluationId": "6f626279-59b7-4dc3-9557-b2bd7db0a101",
"userId": "onboarding-example",
"status": "complete",
"analysis": {
"decision": "block",
"signals": [
{"type": "jailbreak_detected", "confidence": 90},
{"type": "physical_device_observed", "confidence": 95},
{"type": "runtime_hooking_detected", "confidence": 95}
]
},
"analysisVersion": 5,
"networkPending": false
}