Deepfakes and remote onboarding: what a liveness check has to prove
Face-swap video and replay attacks are now cheap. What institutions should expect from liveness and document checks, and why the record matters as much as the result.
Deeptrack Research · 23 October 2026 · 4 min read
Remote onboarding replaced the branch visit for most new customers. That moved the identity check from a staff member looking at a person and their ID to software looking at a camera feed, and the camera feed is what attackers now target.
The attacks onboarding now faces
- Face-swap video that puts a different face on the person in front of the camera.
- Replays of recorded video or photos held up to the camera.
- AI-generated or edited ID documents with real ID numbers.
- Injected video that bypasses the camera entirely.
What a liveness check has to show
A useful check answers three questions: is a real person present now, is it the same person as on the document, and is the document genuine and unaltered. Regulators in Kenya do not prescribe a specific technology, but a risk-based approach means the check should match the risk of the product. A wallet with low limits and a loan or bank account need different levels of assurance.
Why the record matters
When a fraud is discovered months later, the question is whether the institution did enough at onboarding. Keeping the evidence, the scores, the reviewer and the decision together turns that question from a dispute into a lookup.
Sentinel combines document checks, face match, liveness and screening, routes exceptions to a reviewer, and keeps the full record for each customer.