How are you seeing AI-created documents impact current lending and application processes?
There’s a lot made at the moment of the ability of generative AI to create realistic documents, and I think people are right to be concerned. Supporting documentation, such as utility bills or bank statements, can be particularly vulnerable, where verification relies heavily on visual inspection rather than authoritative data or provenance checks.
However, with secure identity documents, it’s not quite as straightforward. There, the greater concern is often the use of AI to manipulate images of genuine IDs. At the very least, claims that convincing identity documents can be created with “just a few prompts” have caused the industry to think much harder about how we authenticate people’s identities and which signals need to form part of an application process.
We can see this reflected in evolving regulatory and industry requirements internationally, as different countries and regions respond to changes in the technology and the threat landscape.
What does effective identity verification look like in an era where media can be easily spoofed?
I think it’s widely understood now that there has to be a necessary level of friction to achieve a reliable level of assurance.
So, that might mean a live capture of the applicant’s identity document, authentication of the contactless chip in that document, or, as we’re likely to increasingly see, the verified digital credentials of their digital identity. You then need to confirm that the person submitting the ID is present and is indeed the rightful holder through some form of biometric capture with a liveness check.
The document, biometric and capture process must also be protected against presentation attacks. And all of this has to be underpinned by device intelligence: the ability to establish that the capturing device and transaction are authentic and haven’t been compromised in some way to allow the injection of digitally manipulated media or replay attacks.
It’s no longer about simply authenticating each element in isolation, but increasingly about establishing the trustworthiness of the application as a whole. However, this doesn’t mean that all of the above needs to be an arduous process for the applicant. If it’s layered properly, we can verify all these elements and still deliver a very user-friendly, minimum-friction process.
What’s the fraud trend that you think the industry is still underestimating?
There has been a great deal of focus on deepfakes and digitally manipulated media of late. They capture the imagination and look more convincing every day. However, they can also introduce signals that well-designed controls may detect. They are undoubtedly a challenge, but one for which multiple countermeasures exist.
Yet another very real threat has quietly become an everyday part of people’s lives, to such an extent that many have become less alert to its significance. Data leaks have largely moved from headline news to the bottom of the page in all but the biggest cases. This was already a significant issue when the exposed material included personal details, email addresses and account numbers.
However, as more industries have adopted remote onboarding, images of people’s identity documents and biometric captures have also become credentials that can be harvested and replayed. Because the underlying media may be genuine and unaltered, conventional defences focused on detecting fabricated or manipulated content may not flag the attack.
This is why device intelligence and protection against replay and injection are so important, alongside checks for reuse, transaction anomalies and other contextual risk signals. We are always asked what we’re doing about deepfakes, but people ask far less often about replay attacks.
As AI takes over more detection and decisioning, how does the role of the human fraud analyst change?
The way I see it, AI will increasingly handle the more routine detection. This allows the fraud analyst to focus on complex and emerging threats. Their role will shift from manual review towards investigation, challenging automated decisions, identifying new attack methods and feeding that intelligence back into detection systems.
The most effective approach will play to everyone’s strengths, combining AI’s speed and scale with human judgement and context. The real questions are how quickly we will get to that point and how we start preparing for it now.
About Simon Horswell
Simon Horswell is Senior Fraud Specialist at Entrust, with over two decades of experience in identity document security and fraud prevention. He has worked across law enforcement, forensic science, and fintech, including roles at the UK’s National Document Fraud Unit and Onfido. Simon now helps organizations combat deepfakes, synthetic identities, and AI-driven fraud through expert analysis, training, and product strategy.
Pre-Event insights ahead of the Fraud FS Summit
The Fraud FS Summit brings together senior fraud and financial crime professionals for a full day of presentations, panel discussions, interactive roundtables and networking; inclusive of 2 course lunch and drinks reception with canapés. Join the UK’s leading fraud conference in London, view the latest agenda for the Fraud FS Summit here.
