AI Deepfakes Merged Scammers Faces On Stolen Identities

Hong Kong police have arrested eight people accused of operating a sophisticated scam ring that used AI to bypass banks identity checks to steal millions of dollars.

A report out of Hong Kong, reveals that Triad Gangs merged their own facial features on stolen identity cards to create convincing deepfakes that fooled multiple banks.

The arrests came as part of a massive crackdown in the last two weeks that resulted in the arrests of 503 fraudsters. The fraudsters collectively stole over close to $200 million from victims.

It All Started With Real Stolen Identity Cards

The fraud ring began their scheme by using real identity cards from victims across the country. Using the information from 21 different stolen Hong Kong identity cards that had been reported lost, the fraud ring used those cards to apply for 44 different bank accounts.

During the application process, they altered the identity documentation by merging their own faces onto the identity cards. When the KYC checks popped up, they were able to upload the documentation and pass the selfie checks.

Common emulation tools available online like ProKYC are often used by scammers to bypass those selfie checks and are emerging more frequently.

“The syndicate first tried to use deepfake technology to merge the scammer’s facial features with the cardholder’s appearance,” said Chief Inspector Sun Yi-ki of the cybersecurity and technology crime bureau. “This allowed them to bypass the selfie checks of the banks systems.”

Their Technique Worked Most Of The Time

Normally bypassing KYC checks is hit or miss, but the fraud ring appears to have cracked the code.
Thirty of the 44 applications sailed through bank security measures without raising red flags.

The use of real identity cards insured that the system would not flag the identity cards as counterfeit, and using deepfakes alterations for facial features insured they could bypass the liveness checks too.

They Used The Account For Fraud And Money Laundering

Once banks approved the accounts with the deepfakes, the ring wasted no time in extracting value from the accounts. They quickly applied for loans and made credit card purchases amounting to over $860,000.

But they didn’t just use the accounts for fraud. Investigators discovered that the accounts were used to launder more than $1.2 million in criminal proceeds as well.

Deepfake AI Linked To Triad, A Growing Trend

Police believe the arrested suspects, six men and two woman are linked to local triad gangs. This case is part of a disturbing trend where criminal syndicates are shifting to AI to perfect their crimes.

In October of last year, police in Hong Kong police arrested 31 people for using deepfake technology in romance and investment scams targeting victims across Asia . The scammers relied 100% on AI to create “beautiful people” that would lure in victims with video calls and then engage them in cryptocurrency scams.

And in Myanmar, Cambodia and Thailand, Triad gangs are increasingly relying on software like Haotian AI to carry out their pig butchering scams all over the world. The company provides the AI for between $1,200 and $9,900, which they tout as providing “God Level Assistance.” to scammers in convincing victims. Banks Fraud Controls At Risk?

Banks Fraud Controls Under Attack

What makes this particular case unusual is that until now, these KYC attacks have been mostly limited to cryptocurrency and Fintech platforms that have limited fraud controls. This attack shows that AI can be used to bypass banks most coveted fraud controls – identity checks.