Fraud, Deepfakes, and the Collapse of eKYC as a Line of Defense

For years, much of digital financial security has been built around one question: Are you who you say you are? Government-issued IDs, facial biometrics, liveness checks, device verification, and data cross-checks have made onboarding far more sophisticated. The logic was sound. If a financial institution could establish who was on the other side before opening an account or extending credit, a significant portion of the risk could be contained. But fraud kept evolving. And while banks and fintechs were perfecting the front door, fraudsters learned how to operate once they were already inside.

We still tend to treat identity like a snapshot, while fraud plays out like a movie. eKYC (electronic Know Your Customer) captures a moment in time: it confirms that certain signals match and gives an institution enough confidence to make a decision. What follows are hundreds, sometimes thousands, of interactions that also tell us something about that person. Devices change. Locations change. So do beneficiaries, transaction amounts, timing, and the way money moves. An account may have been legitimately opened by its rightful owner and be controlled by someone else months later. Knowing who came in matters. Knowing who is operating the account today may matter even more.

Artificial intelligence has made that gap much harder to ignore. Building a convincing identity is now cheaper and more accessible. Synthetic documents, AI-generated faces, voice cloning, and deepfakes can challenge controls that looked robust just a few years ago. An underground economy has also developed around these capabilities, selling identity packages and pre-verified accounts. Recent investigations have found accounts that have already cleared KYC controls being sold for hundreds of dollars. The price itself is almost beside the point. What matters is that passing KYC now has a market value for fraudsters.

None of this makes eKYC obsolete. It makes eKYC insufficient as a standalone line of defense. A legitimate account can be taken over, sold, used as a mule account, or later connected to a broader fraud network. A synthetic identity can even behave like a perfectly ordinary customer for weeks before doing what it was created to do. Another selfie is not going to explain what happened between those two moments.

In Mexico, this deserves attention well beyond the country's largest banks. Throughout 2026, CONDUSEF has documented cases involving the impersonation of financial institutions and has warned about the use of AI to create audio, video, and communications that mimic their representatives. SOFOMES have appeared among the institutions affected in several of those reports. Not every case can be attributed to synthetic identities or deepfakes, but they point to something we know well in security: fraud tends to migrate toward the places where it is easier to operate.

What This Means

That is why I am particularly interested in what this means for SOFIPOs, SOFOMES and other players in the second tier of Mexico's financial system. Many have done important work digitizing origination, reaching markets that were previously underserved and cutting the time it takes to extend credit. But that progress also puts them in front of a different kind of adversary. If an institution can originate a loan in minutes, it needs to be just as fast at detecting when something changes after the customer has been approved.

Fraud does not respect institutional boundaries either. An identity can apply for credit at one institution, receive funds at another, and then distribute them across several accounts. Looked at individually, each transaction may seem reasonable. The problem becomes visible in the sequence. That is still a major blind spot: we have plenty of information, but we do not always look at it together.

The next line of defense, then, is less about piling on more verification and more about understanding behavior. Unexpected device changes, new beneficiaries, transaction velocity, activity that does not fit an account's history, or unusual connections between identities become far more meaningful when viewed together. Digital trust should not work like a permanent pass granted on the day of onboarding. It should be reassessed as the relationship evolves.

The Relevance of FRAML 

This is where FRAML becomes relevant. Fraud and anti-money laundering have traditionally grown as separate functions inside many financial institutions, with their own teams, rules and alerts. Criminals have never cared about that distinction. The same identity can take out a loan, receive funds, move them across accounts, and eventually become part of a money-laundering operation. We may see four separate events. To the person behind them, it was probably one operation all along.

Bringing identity and transactions into the same view starts to close that gap. An unusual transaction should change what we think we know about an identity, just as a new identity signal should change how we assess its activity. We do not need to turn every transfer into an interrogation. We need to know when it is time to start asking questions again.

Mexico does not need to throw away what it has already built. eKYC, biometrics, and document verification remain fundamental. What we can no longer assume is that identity has been settled the moment someone clears onboarding.

For years, we focused on knowing who was standing at the front door. Fraud is forcing us to pay attention to what happens after someone walks through it. Continuing to invest almost exclusively at the point of entry, when an identity can be manufactured, bought, or change hands, is like installing a better lock while leaving the windows open.