Fraud prevention for digital banks and neobanks
You never meet your customer, so the phone is the identity. The attacks that matter to you arrive at remote sign-up, at a device change and at recovery.
Block
BLOCK · virtual camera · emulator · face reused · details pasted- Your customer sees
- We couldn’t verify this session. This camera isn’t a real one. Try again on your own phone, with its own camera.
- Your FRM receives
- VIRTUAL_CAMERAEMULATORFACE_REUSEDDETAILS_PASTED
What digital banks face now.
- Every customer arrives through a phone, so the phone is the identity.
- Deepfakes are one in five biometric fraud attempts, and virtual-camera attacks grew 2,665% in 2024. (Entrust (2026 Identity Fraud Report: deepfakes, social engineering and injection attacks on the rise, opens in a new tab), Nov 2025; iProov (Threat Intelligence Report: native virtual-camera attacks, opens in a new tab), 2024 data)
- A device change or a recovery request is the moment a takeover begins.
- In Singapore, a 12-hour cooling-off applies after a new device or token is activated. (MAS and IMDA (Response to consultation on the Shared Responsibility Framework, opens in a new tab), Oct 2024)
Across the customer journey.
Where each attack appears for digital banks, what DeepID reads at that moment and the action it returns. Each moment is checked against what the one before it bound.
| Moment | The attack | What DeepID does | Decision |
|---|---|---|---|
| Sign-up | Deepfakes, injected video and synthetic identities | Liveness that catches injected streams, read with the device below the camera and a face search across your customers. | Block |
| Login | Emulators and cloned apps | A device ID that survives reinstalls, and root, emulator and cloned-app signs read in every session. | Allow, or block |
| New phone or SIM | Takeover through a new phone | The face from sign-up holds before the new phone is bound, then a cool-off before limits return. | Step up, then cool off |
| New payee | Recovery followed by a new payee | A payee added inside the cool-off waits, and the first session after recovery is read against the owner’s rhythm. | Cool off |
| Payment | Coerced or unauthorised transfers | The call, the screen, the typing and the payee become one decision with its reasons. | Hold |
Where to start.
The journey most at risk: remote sign-up, then the first device change. Start at sign-up, where the face, the SIM and the phone are bound. Every later step, including recovery, is checked against what sign-up bound.
- 1Sign-upA live face on a real camera, matched to the ID, bound to the SIM and the phone.
- 2New phone or SIMRe-bind only after the face from sign-up holds, then cool off.
- 3Video KYC deepfakesThe injected camera, caught below the picture.
- 4Account takeoverRecovery as a new-phone event, with the hours after it covered.
Your free first analysis.
A deepfake and injection test on your own onboarding flow, run as a shadow proof on live sign-ups with no action taken, because history cannot show a camera or a device.
What it shows. The sessions that came through a virtual camera or an emulator, and the faces that appeared on more than one application, against the outcomes you already know. No figure is published for this; you count it on your own data, against what you see today.
Use cases for digital banks.
Each shows how the attack unfolds, what your checks saw at each step, what DeepID read and the decision it returned.
Digital arrest
Hold the coerced payment before it leaves the account.Hold, then call backMule accounts
Catch mule accounts before the money moves.Cool off, then holdVideo KYC deepfakes
A live person, in front of a real camera, on every video KYC call.Step up, hold or blockAccount takeover
Protect the account through recovery and the hours after.Step up, then cool offLoan stacking
Catch stacked and synthetic applications before disbursal.Cool off or blockInvestment scams
Slow the scam payment and hold the mule trading account.Warn, then cool offAI agents
Tell the customer’s own assistant from automation that only looks like one.Allow, or step upVulnerable customers
Extra time, and a call back, for the customers most at risk.Cool off, then holdInsider fraud
Hold the takeover that starts with a contact change made from the inside.Step up, then hold
Rules that apply.
India first. Each rule is dated and sourced on its market page, and the rule map covers the six other markets.
- RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025In force 1 Apr 2026 (RBI (Press release: directions on authentication mechanisms for digital payment transactions, opens in a new tab), Sep 2025; RBI (Authentication Mechanisms for Digital Payment Transactions Directions, 2025, opens in a new tab), Sep 2025)
- SIM binding: UPI apps today, messaging apps nextIssued Nov 2025 · deadline reported as 31 Dec 2026 (The Hacker News (India orders messaging apps to work only with active SIM cards, opens in a new tab), Dec 2025, press report; Angel One (DoT extends SIM-binding deadline for WhatsApp, Telegram and Signal till year end, opens in a new tab), 2026, press report; NPCI (UPI user onboarding: product overview, opens in a new tab), as of Oct 2026)
- MuleHunter.AI and the I4C Suspect RegistryLive since Dec 2024 · MoU May 2026 (Outlook Business (Finance Ministry asks banks to use MuleHunter.AI to check digital fraud, opens in a new tab), Dec 2024, press report)
- Limiting customer liability in unauthorised electronic transactionsSince Jul 2017 (RBI (Customer protection: limiting liability of customers in unauthorised electronic banking transactions, opens in a new tab), Jul 2017)
DeepID supports compliance with these rules. It never claims to guarantee it.
The modules these use cases read with.
Open a module to see what it reads and the reasons it sends with each decision.
See DeepID on a real phone.
We show your fraud, security and engineering leads how DeepID would run your sign-up, login or payment journey, then plan a pilot on your own traffic.