From Stolen IDs to Injection Attacks: How AI Is Changing Identity Fraud

A single stolen identity document can be the starting point for thousands of fraudulent attempts. With generative AI, attackers can manipulate document images, replace photographs, create synthetic selfies and repeatedly test different variations against identity verification systems, often with minimal effort and cost.

This growing threat was the focus of Microblink’s recent webinar, From Leaked Data to Identity Fraud, featuring Vincenzo D’Elia, Director of Engineering; Radu Tudoran, engineering leader; and Hristina Nedyalkova, Head of Data Engineering.

Through demonstrations of manipulated documents, synthetic video and injection attacks, the team explored how fraudsters can exploit compromised identity information and why traditional verification methods may no longer provide sufficient protection.

A Data Breach Is Only the Beginning

Identity data breaches are typically discussed in terms of the number of records exposed. But the consequences can extend far beyond the initial incident.

During the webinar, D’Elia referenced reports of more than 153 million driver’s license records being offered for sale, illustrating the enormous volume of potentially compromised identity information.

A stolen identity document contains much more than a name and date of birth. It can include a photograph, document number and other personal details that attackers can reuse or manipulate.

D’Elia explained that fraudsters can preserve certain elements of an authentic document while changing others, creating multiple fraudulent variations from a single source.

Tudoran highlighted a particularly concerning scenario: organizations that treat possession of a previously verified identity document as sufficient evidence of legitimacy. Once that document is compromised, the same information intended to establish trust can become a tool for impersonation.

The broader lesson is that a data breach doesn’t create a single opportunity for fraud. It can supply material for repeated attacks long after the original exposure.

How Generative AI Turns One Document Into Many

Nedyalkova demonstrated several ways attackers can manipulate identity documents.

In one example, the original personal information remained intact while the photograph was replaced. In another, the photograph remained unchanged while names, birth dates and other identifying details were altered.

These modifications can support different forms of impersonation, depending on which elements the attacker wants to preserve.

The demonstrations also explored how manipulated documents can be presented during verification. Fraudsters might print and recapture an altered document, display it on another screen or substitute fabricated imagery directly into a digital capture workflow.

Generative AI makes these approaches increasingly convincing. Synthetic images can reproduce lighting conditions, document textures and visual security features that previously required more elaborate physical manipulation.

Nedyalkova also demonstrated AI-generated videos showing documents being held and moved, including examples designed to resemble ordinary verification interactions.

D’Elia illustrated the scalability of these techniques by showing approximately 100 variations generated from a single source document. Some changed photographs, others altered text, while additional variations modified visual characteristics.

The significance isn’t simply that a convincing fake can be created. It’s that attackers can generate and test many variations of the same underlying identity.

Why Traditional Liveness Checks Are Under Pressure

Document verification is only one stage of the attack. Fraudsters may also need to complete biometric verification, which introduces another opportunity to manipulate the process.

D’Elia described two distinct scenarios. An attacker might replace the portrait on a stolen document with their own photograph, allowing them to present a genuine live selfie that matches a fraudulent document.

Alternatively, the attacker could retain the original photograph and use synthetic imagery or video to impersonate the legitimate document holder.

This raises questions about verification methods that rely heavily on active challenges, where users must perform particular movements to establish their physical presence.

Such techniques were originally effective against static photographs and prerecorded videos. However, AI-generated content capable of responding to movement instructions changes the threat model.

Automation Changes the Economics of Identity Fraud

Perhaps the most consequential development is the ability to automate these attacks.

A fraudster who creates one convincing fake document may attempt to open one fraudulent account. But when document manipulation, synthetic biometrics and repeated submissions can be automated, the same source identity can potentially support thousands of attempts.

Tudoran emphasized that the greatest risk comes from fraud techniques that can operate at scale.

D’Elia similarly explained how AI agents and automated scripts could generate variations of documents and selfies, submit them through verification workflows and repeat the process with different combinations.

Each unsuccessful attempt can become another opportunity to try a modified version. For businesses, this creates a challenge that cannot be addressed through manual review alone. Human reviewers may struggle to identify increasingly realistic synthetic content, particularly when confronted with large volumes of submissions.

Effective fraud prevention therefore requires detecting manipulation across multiple stages of the verification process.

Fighting Fraud by Reproducing It

Microblink’s Fraud Lab takes an adversarial approach to developing defenses.

Rather than waiting for customers to encounter new attacks, the team reproduces emerging fraud techniques in controlled environments using synthetic identities and generated test data.

According to D’Elia, the Fraud Lab produces more than 100,000 documents each month for training and testing.

These examples allow engineers to examine how verification systems respond to different document manipulations, capture conditions, synthetic faces and injection techniques.

Nedyalkova demonstrated how Microblink’s verification technology identified manipulated or improperly presented documents. She also showed a biometric verification workflow that detected an injection attack and flagged AI-generated content.

The team connected this testing methodology to Microblink’s performance in the Department of Homeland Security’s Remote Identity Validation Rally (RIVR), an independent evaluation of identity verification technology.

Tudoran stressed the importance of anticipating fraud rather than relying exclusively on attacks already encountered by customers. Waiting for real-world failures to accumulate before developing protections leaves businesses exposed during the learning process.

Identity Verification Must Evolve With the Attacker

The webinar concluded with three central lessons.

First, one compromised identity can support many fraudulent attempts, particularly when generative AI makes it inexpensive to create variations.

Second, verification requires multiple layers of protection. Document authenticity, capture integrity and biometric authenticity address different vulnerabilities, and success at one stage cannot guarantee the integrity of the entire interaction.

Third, fraud defenses require continuous testing. As attackers develop new techniques, organizations must reproduce those techniques, identify weaknesses and refine their systems accordingly.

The central challenge is no longer simply determining whether a submitted document or selfie looks legitimate.

It’s establishing whether the evidence is authentic, whether the capture process can be trusted and whether the system can withstand repeated, automated attempts to deceive it.

As generative AI continues to lower the cost of sophisticated impersonation, identity verification must become equally adaptive.