For decades, the financial sector and other industries have relied on an authentication mechanism dubbed “know your customer” (KYC), a process that confirms a person’s identity when opening account and then periodically confirming that identity overtime. KYC typically involves a potential customer providing a variety of documents to prove that they are who they claim to be, although it could also be applied to authenticating other people such as employees. With the ability of generative artificial intelligence (AI) that use large language models (LLMs) to create highly persuasive document replicas, many security executives are rethinking how KYC should look in a generative AI world.
How generative AI uses LLMs to enable KYC fraud
Consider someone walking into a bank in Florida to open an account. The prospective customer says that they just moved from Utah and that they are a citizen of Portugal. They present a Utah driver’s license, a bill from two Utah utility companies, and a Portuguese passport. The problem goes beyond the probability that the bank staffer does not know what a Utah driver’s license or Portuguese passport looks like. The AI-generated replicas are going to look exactly like the real thing. The only way to authenticate is to either connect to databases from Utah and Portugal (or make a phone call) to not only verify that these documents exist in the official systems but that the image in the official systems matches the photo on the documents being examined.
An even bigger security threat is the ability of generative AI create bogus documents quickly and on a massive scale. Cyber thieves love scale and efficiency. “This is what is coming: Unlimited fake account setup attempts and account recovery attempts,” says Kevin Alan Tussy, CEO at FaceTec, a vendor of 3D face liveness and matching software.
AI-generated fake personal histories could validate AI-generated fake KYC documents
Lee Mallon, the chief technology officer at AI vendor Humanity.run, sees an LLM cybersecurity threat that goes way beyond quickly making false documents. He worries that thieves could use LLMs to create deep back stories for their frauds in case someone at a bank or government level reviews social media posts and websites to see if a person truly exists.
“Could social media platforms be getting seeded right now with AI-generated life histories and images, laying the groundwork for elaborate KYC frauds years down the line? A fraudster could feasibly build a ‘credible’ online history, complete with realistic photos and life events, to bypass traditional KYC checks. The data, though artificially generated, would seem perfectly plausible to anyone conducting a cursory social media background check,” Mallon says. “This isn’t a scheme that requires a quick payoff. By slowly drip-feeding artificial data onto social media platforms over a period of years, a fraudster could create a persona that withstands even the most thorough scrutiny. By the time they decide to use this fabricated identity for financial gains, tracking the origins of the fraud becomes an immensely complex task.”
Alexandre Cagnoni, director of authentication at WatchGuard Technologies, agrees that the KYC security threats from LLMs are frightening. “I do believe that KYC techniques will need to incorporate more sophisticated identity verification processes that will for certain require AI-based validations, using deepfake detection systems. The same way MFA and then transaction signing became a requirement for financial institutions in the 2000s because of the new MitB attacks, now they will have to deal with the growth of those fake identities,” he says. “It’s going to be a challenge because there are not a lot of (good) deepfake detection technologies around and it will have to be quite good to avoid time-consuming tasks, false positives or the creation of more friction and frustration for users.”
