AI-generated deepfake IDs are now good enough to get past the identity checks many gambling operators rely on. A convincing passport image, a matching selfie and even a short liveness video can be produced in minutes with freely available tools. For an industry built around know-your-customer checks, that changes what a verified account actually means.
1. What is a deepfake ID?
A deepfake ID is a fake identity document, selfie or video made with AI to pass as a real person during verification.
Some are entirely invented people, known as synthetic identities. Others use a real person’s stolen details with an AI-generated face attached. The aim in both cases is the same: to open an account that passes KYC and looks legitimate on paper.
2. Why are gambling businesses being targeted?
Gambling accounts can move money quickly, which makes them useful to fraudsters and money launderers.
A verified account can be used for bonus abuse, to launder funds, or sold on as a mule account for someone else to use. The Gambling Commission’s 2026 money laundering and terrorist financing risk assessment, published in July, names the use of AI to create mule accounts and bypass customer due diligence as an emerging risk for the sector.
3. Can deepfakes really beat selfie and liveness checks?
Some can, particularly where verification relies on a single selfie or a basic liveness test.
Entrust’s 2026 Identity Fraud Report found that deepfakes now account for one in five biometric fraud attempts, and that deepfaked selfie attempts rose 58% in a year. It also recorded a 40% rise in injection attacks, where fake images or video are fed straight into the verification process without ever passing through a real phone camera.
A check that only asks whether a face matches a document is easier to fool today than it was even two years ago.
4. Who is responsible if a deepfake gets through?
The operator is, even when verification is handled by a third-party provider.
Your KYC supplier runs the check, but your licence carries the consequences. Licence condition 1.1.2 makes you responsible for the third parties you contract with, and weak customer due diligence features in many of the Commission’s enforcement cases. If an account opened with a fake ID is later used to launder money, the regulator will want to know what your controls were and how you tested them.
5. What does good verification look like now?
Layered checks that carry on throughout the customer relationship.
That means combining document and biometric checks with device, location and behaviour signals, so one convincing image is never enough on its own. It also means looking again when something changes: a new device, a sudden jump in deposits, or a withdrawal to an unfamiliar account.
We also recommend asking your KYC provider specifically how they detect injection attacks, since that is where much of the newer fraud is happening.
Things to do about deepfake ID fraud
- Ask your KYC provider how they detect deepfakes and injection attacks, and for evidence of recent testing.
- Add device and behaviour signals to onboarding, so a fake face alone cannot open an account.
- Re-verify at key moments, such as large withdrawals, payment method changes or logins from new devices.
- Train customer service and payments teams to spot and escalate accounts that don’t add up.
- Update your risk assessment so it covers AI-enabled identity fraud, as the Commission now expects.
- Check your verification logs so you can show how each decision was made if you are asked.
If an account on your platform was opened with a deepfake ID last month, how would you find out?
If you’d like to review how your verification holds up, book a meeting with us or connect with Jason Chaplin on LinkedIn: https://www.linkedin.com/in/jasonchaplin/
