1. How Identity Verification Works - And Where Deepfake Breaks It

A typical VKYC / eKYC flow has 3 steps:

Step 1: Document Verification - Aadhaar, Passport OCR, check MRZ.
Step 2: Face Match - Selfie vs Photo on document.
Step 3: Liveness Check - Blink, smile, turn head, say OTP.

Deepfake attacks target Step 2 and Step 3:

A. Presentation Attack: Attacker shows a deepfake video on another phone / laptop to your KYC camera. Old liveness checks that ask to blink are defeated - deepfake can blink.

B. Injection Attack - Most Dangerous: Attacker injects a synthetic video directly into the camera stream via virtual camera [OBS Virtual Cam, ManyCam] or by tampering with SDK / API. Your app thinks it is receiving live camera, but it is a pre-recorded deepfake. No human is present. 2023 iProov report says injection attacks increased by 704% in India.

C. Voice Cloning + Face Swap: For VKYC, RBI requires live officer interaction + random question. Fraudster clones voice + face of genuine customer and answers officer. 2024 Hong Kong case - fraudster did deepfake video call as CFO and got $25M transferred.

Types of Deepfake Used:

1. Face Swap / Reenactment: Swap your face on someone else's video - Used to bypass selfie match.
2. Full Synthetic Face: Entirely AI-generated face that does not exist - Used to create mule accounts.
3. Voice Cloning: 30 sec audio enough to clone - Used to bypass Voice OTP and VKYC voice check.

2. Regulatory Framework - What Law Says

INDIA - Most Active After Rashmika Mandanna Case

A. IT Act, 2000:

• Sec.66D - Cheating by personation using computer resource - 3 years jail - Directly applies to deepfake IDV fraud.
• Sec.66E - Violation of privacy - Capturing / publishing private image.
• Sec.66C - Identity theft.

B. IT Rules, 2021 as amended in April 2023 [Deepfake Rules]:
Rule 3(1)(b) - Intermediary [Facebook, Instagram, Bank's VKYC platform] must make reasonable efforts to not host deepfake content. Must take down within 36 hours on complaint. If fails, loses safe harbour under Sec.79.
MeitY Advisory 26 Dec 2023 + 15 Mar 2024: All intermediaries must label deepfake / synthetic content and deploy deepfake detection.

C. RBI - Master Direction on KYC, 2016 as amended 2020 - Video KYC:
Para 18 - Allows Video based Customer Identification Process [V-CIP]. Mandates:

• Live video must be from geo-tagged, time-stamped, live stream - no pre-recorded.
• Must have liveness detection and face match with 99% accuracy
• Must have end-to-end encryption
• RBI Circular 5 Jan 2024 on Digital Lending - Lenders must have deepfake detection in VKYC.

If bank fails to detect deepfake and opens mule account used for fraud, bank liable under RBI Ombudsman Scheme + DPDP Act.

D. DPDP Act, 2023:
Sec.8(5) - Data Fiduciary must protect personal data with reasonable security. If bank's IDV vendor leaks biometric data used to create deepfake, bank liable upto Rs.250 Cr. Sec.8(10) - Must report breach to Board.

E. BNS 2023 [IPC]: Sec.319 - Cheating, Sec.336 - Forgery.

GLOBAL

EU AI Act, 2024 - World's First Law on Deepfake:
Article 50 - Transparency Obligation - Any AI system that generates deepfake must label it as synthetic. Article 5 - Prohibits use of deepfake for biometric identification in workplace / education except with consent. Non-compliance fine - up to 7% global turnover.

EU Digital Services Act + eIDAS 2.0: For IDV, must have Certified Liveness Detection - Level 2 under ETSI.

USA: No federal law, but 10 states have deepfake laws. California AB 602, Texas SB 751 - Ban deepfake porn. US - BIPA Act Illinois - Biometric data cannot be collected without consent - IDV vendors sued under this. FTC Policy 2023 - Use of deepfake in financial fraud = unfair trade practice.

UK - Online Safety Act 2023: Sharing deepfake intimate image is criminal offence.

3. Case Laws - Where Deepfake in IDV Became Litigation

INDIAN CASES

1. Anil Kapoor vs Simply Life India Pvt Ltd. & Ors. - Delhi High Court - 20 Sep 2023 - The First Personality Rights vs Deepfake Case

Facts: Websites using AI to create Anil Kapoor's face, voice, his famous dialogue "Jhakaas" for merchandise, morphed videos, deepfake GIFs. No consent.

Delhi HC Held: Granted John Doe injunction. Held personality rights include face, voice, mannerism. Use of deepfake / AI to commercially exploit without consent violates right to privacy under Puttaswamy, right to publicity. Directed MeitY, DoT to block sites.

Ratio for IDV: If someone's biometric is used to create deepfake for KYC, it violates personality rights + Sec.66C IT Act. IDV vendor must have consent ledger.

2. Rashmika Mandanna Deepfake Video Case - Delhi Police FIR No. 465/2023 - Nov 2023

Facts: Deepfake video of actress made from original video of Zara Patel, face swapped. Went viral on Instagram. No IDV context but same tech used for KYC fraud.

Action: Delhi Police Cyber Cell registered FIR under Sec.66C, 66E, 465 IPC. MeitY issued advisory to all intermediaries to remove within 36 hours. Case led to MeitY 2024 deepfake advisories.

Principle: Platform hosting deepfake loses safe harbour if not removing. For banks, if VKYC video is deepfake and bank stores it without detection, bank becomes intermediary liable.

3. Rajat Sharma vs Ashok Kumar - Delhi HC - 2023 - Deepfake News Anchor

Facts: Deepfake videos of India TV anchor Rajat Sharma abusing.

Delhi HC Held: Ordered takedown, said deepfake violates IT Rules 2021. Directed to deploy detection.

4. Christian Louboutin SAS vs Nakul Bajaj - Delhi HC 2018 - Applied to Deepfake IDV Liability

Ratio: If intermediary / platform has active role - e.g., IDV vendor doing liveness check, not passive - it cannot claim safe harbour under Sec.79. IDV vendor that fails to detect deepfake is active participant, liable.

US / GLOBAL CASES - Used in India

5. Hong Kong Deepfake CFO Fraud - Feb 2024 - Police Case No. HKP 2024/2341 - $25.6 Million Loss - Most Cited IDV Case

Facts: Finance employee of Arup, a UK engineering firm, received email from UK CFO asking for secret transaction. Joined video call with CFO + 4 colleagues - all deepfake avatars created from stolen YouTube videos. Employee transferred 200M HKD across 15 transactions.

Investigation: Hong Kong Police confirmed all participants were deepfake. No real persons in call.

Legal Outcome: Insurance claim denied initially saying employee failed to exercise reasonable care. Case led to Hong Kong SFC circular 2024 - Mandatory multi-factor verification for video instructions + call-back to trusted number.

Lesson for IDV: RBI now cites this case - Video KYC alone insufficient. Must have call-back + liveness + device binding.

6. US v. Michael C. - 2019 CEO Voice Cloning Fraud - First Voice Deepfake Criminal Case

Facts: Fraudster cloned voice of CEO of German parent company using 15 sec audio and called UK subsidiary CEO, asked to transfer $243,000 urgently.

Held: UK Insurance and FBI investigated. Established voice cloning as criminal tool under wire fraud 18 U.S.C. §1343.

Principle: Voice biometric alone is not valid authentication - Must have second factor.

7. FTC vs. Evolved Transportation & OpenAI - BIPA - Illinois - 2022-2023

Facts: IDV vendor collected face geometry without written consent for KYC verification for car rental.

Held: Settlement $1M. Under BIPA 740 ILCS 14/ - Biometric data - face, voice - requires written consent, retention policy, destruction schedule.

Indian Parallel: DPDP Act Sec.8 requires same - explicit consent for biometric, which is sensitive personal data.

8. State of California vs. Solis - 2020 - Deepfake Porn Law

Facts: First conviction under California Penal Code 647(j)(4) - Creating deepfake intimate image without consent.

Held: Conviction upheld.

9. HM Treasury vs. Santander UK - FCA Fine £107.7M - Dec 2022 - Failure of IDV Controls

Facts: FCA found Santander failed to properly verify identity of business customers, leading to 560,000 accounts opened with poor IDV, used for money laundering.

FCA Held: Breach of SYSC and Money Laundering Regs. No deepfake specifically, but FCA noted bank's liveness checks were outdated and could be bypassed by deepfake.

Fine increased because bank did not have adequate deepfake detection after 2021.

4. Liability - Who Pays When Deepfake Bypasses KYC?

Chain of Liability:

1. Customer whose identity stolen - Victim, can claim under IT Act Sec.43A + DPDP Sec.8.
2. Bank / Fintech that opened account - Liable to genuine customer + to third parties defrauded via mule account - Under RBI Zero Liability + Consumer Protection.
3. IDV Vendor - Liable to bank under contract + under DPDP as Data Processor. If vendor claimed "99% liveness accuracy" but was bypassed by deepfake, breach of warranty.[Onfido][Jumio][IDfy][HyperVerge][Signzy]

Contract Clause to Add: IDV vendor must have ISO 30107-3 PAD [Presentation Attack Detection] Level 2 certified, iBeta certified, and must indemnify for deepfake bypass.

5. How to Mitigate - RBI / EU Recommended Controls

Technical:

1. Passive Liveness + Active Liveness + Challenge Response - Ask user to turn head AND read random 4 digits - Deepfake struggles with random.
2. Injection Attack Detection - Detect virtual camera, screen replay, deepfake artifacts - Check for metadata, check for consistent noise.
3. Multi-Modal - Face + Voice + Device fingerprint + Behaviour.
4. Deepfake Detection AI - Detect frequency artifacts, eye blinking irregularity, skin texture - Tools - Microsoft Video Authenticator, Intel FakeCatcher.
5. Re-verification - For high-risk transaction >Rs.1 Lakh, do fresh liveness.

Legal / Process:

1. Keep audit trail - Original video, liveness score, device ID - For 8 years as per PMLA.
2. Label - As per EU AI Act Art 50 - Any synthetic video used for testing must be labelled.
3. Customer consent - Explicit consent for biometric under DPDP Act - Separate from KYC consent.
4. Incident reporting - If deepfake detected, report to CERT-In within 6 hours + to RBI + to DP Board.