Cybercriminals use fake and fake biometrics to defraud banks

summary
Biometric systems, favored by 73% of Brazilians, face increasing threats from cybercriminals using deepfakes and other advanced technologies, prompting cybersecurity companies to look for innovative, multi-party solutions to combat fraud.

Tokens and passwords are no longer the preferred methods of accessing personal devices or accounts. Making way for fingerprints, facial recognition, and even voice analysis, biometric systems represent the new frontier in authenticating transactions.

More than 4.2 billion mobile devices already use some type of active biometrics, according to Juniper Research, and projections are that by the end of 2026, 57% of all global digital transactions will be verified through these methods. In Brazil, technology adoption is also a tangible reality. An Accenture survey shows that 73% of Brazilian consumers feel more secure using biometrics compared to traditional digital tokens in banking apps and digital wallets.

Unfortunately, this also attracts the attention of cybercriminals. “With the advancement of biometric technologies, especially facial recognition, companies and governments are strengthening security systems through automatic identification of individuals. However, this movement is accompanied by cybercrime in search of sophisticated technologies, powered by artificial intelligence, capable of circumventing authentication systems,” explains Anchisis Moraes, Director of Threat Intelligence at Apura Cyber ​​​​Intelligence SA.

According to the cybersecurity expert, criminals are using everything from high-resolution printers to software to forge biometric characteristics, posing a challenge to the technological protection of banking applications, public services and financial platforms.

These attacks can be classified into five levels of complexity. The first level uses high-resolution digital photos, high-definition videos, and even paper masks, while the second level relies on realistic dolls and 3D latex or silicone masks. At level 3, impostors resort to hyper-realistic artifacts and wax heads. Level 4 involves altering 3D facial maps to trick authentication servers into “proof of life.” The most advanced stage, Level 5, involves the digital injection of images and videos directly into devices, or even the use of highly convincing deepfakes, leading systems to accept the fraud as if it were organic activity by the legitimate user.

Deep fraud and the use of synthetic digital identities have been on the rise in Brazil. Reports, such as those from Deloitte published by the Infochannel portal, indicate that the economic loss caused by AI-driven fraud could reach R$ 4.5 billion by the end of 2025. A growth of more than 800% in the use of deepfakes has already been observed.

In China, an emblematic case revealed the destructive potential of these scams. An employee at a state-owned company was urged to transfer US$622,000 (about R$3.1 million) after a video chat with who he believed was his CEO. The fraudster used real-time deepfake technology to mimic the image and voice of company leadership, creating a state of extreme urgency to force the transfers. The scam used public videos of the CEO to create the avatar, and similar scams have been reported since.

So Anchises explains that cybersecurity companies have relied on multiple layers of protection to mitigate these threats. One key strategy is to adopt multi-modal systems: combining data from video, audio, temperature sensors and deep and behavioral analysis, making it harder for fraudsters to act. Advanced systems also integrate real-time deepfake detection and behavioral biometrics, which monitors details like typing speed, touchscreen pressure, and even how you handle the device.

Other tactics involve dynamic challenge and response techniques, with unpredictable AI-generated challenges (such as asking for just one eye blink or speaking with unplanned contextual information), and combining negative and positive life proofs – mixing automated video analysis with real-time interactions. Moreover, systematic monitoring of leaks is increasing: specialized teams scan the dark web and open databases in search of photos and profiles recycled in new scam attempts. Despite the sophistication of the attacks, corporate response is also evolving, showing that the war for digital identity has only just begun.

“That is why the work that Apura does in cooperation with other cybersecurity companies is essential, when monitoring networks for potential threats, and when an attack is unfortunately successful, a comprehensive assessment of all the factors involved is carried out to further develop and improve defensive tactics against cybercriminals who want to exploit vulnerabilities in the use of biometrics,” concludes the Apura Cyber ​​​​Intelligence specialist.