A stolen national ID passed every check. The selfie didn't.

Attackers took the portrait off a stolen ID, generated the selfie meant to verify it, and injected it into the onboarding flow without ever showing it to a camera

The document was genuine. That was the attack.

A customer running identity verification on IDmission received a new account application. The national ID card checked out. The machine-readable zone parsed, the number validated, the holographic features held. It had also been stolen from a real person.

The Machine Readable Zone (MRZ) on the reverse confirms the document's encoding is consistent with genuine Argentine DNI formatting. The CUIL number, biographic data, and holographic security features were all verified as authentic, making the document itself indistinguishable from a legitimately presented credential.

The selfie, shown in Exhibit A,  was the problem. Attackers had taken the photo printed on that ID, fed it to a diffusion model, and gotten back a fresh-looking selfie of the same face against a plain background. They then injected that file into the selfie capture step via file upload and API submission, so the image reached the verification pipeline without a camera ever capturing it.They submitted the two together to open accounts in the victim's name and to access the accounts the victim already held.

Reality Defender scored the selfie as Manipulated. Detection flagged it before any account was created.

A genuine document is now an attack asset.

Call it ID-photo resynthesis. Our red team tracks it as a stolen identity document paired with AI-generated facial imagery, aimed at the selfie-to-ID match.

The attack skips forgery entirely. Forging a national ID is the hard part, and the part every vendor already checks. The attacker steals a genuine one instead and builds the selfie from the portrait on it.

Deepfakes are now linked to 1 in 5 biometric fraud attempts (Entrust, 2026 Identity Fraud Report). Latin America and the Caribbean have absorbed more than their share of that growth: identity fraud across the region climbed 137% in a single year (Sumsub's Global Fraud Index).What has also grown is sophistication. Multi-step attacks that combine synthetic identities, deepfakes, social engineering, and device tampering surged 180% year over year (Sumsub, 2025–2026). Inside the region's banking and payments sector, most of it now targets accounts that already exist rather than new ones being opened, with account takeover accounting for 82% of all fraudulent activity.

Document checks and selfie checks are supposed to corroborate each other, and resynthesis collapses that, because both now trace back to the same photo. 

Injection, not presentation

A presentation attack puts something in front of a real camera: a printed photo, a mask, a replayed video on a screen. Presentation attack detection (PAD, commonly called liveness) is built and certified to catch exactly that. An injection attack never touches the camera. The attacker feeds a pre-rendered image or stream directly into the capture channel, through a virtual camera, a tampered device, or a direct API call, so the pipeline receives a file that looks like a capture. This case was an injection attack. Liveness did not fail here; it was never the control in play. The controls that address injection are injection detection at the capture layer and generative-content detection on the image itself.

The ID supplies the material used to defeat the check on the ID.

"We built the document check and the selfie check to corroborate each other. Once an attacker can generate the selfie from the document and upload it, no capture app involved, they stop being independent, and liveness was never designed to catch an image that no camera captured. So we added a check that asks whether a generative model made the image at all." Ashim Banerjee, Founder and CEO, IDmission 

Neither check asks whether a camera made the image

Document verification asks whether the ID is genuine. This one was. Face matching asks whether the selfie belongs to the person on the ID, and it did, because the model had learned that exact portrait. Liveness asks whether a live person is in front of the camera, and an injected image never reaches the camera, so that question was bypassed rather than answered.

Two checks, one photo. That question didn't need asking when a face on a screen implied a person in front of a lens. Identity is now synthetic, and most onboarding pipelines predate that. IDmission added one that does.

Detection tuned to faceswaps misses diffusion

Detection attributed the image to a diffusion model. Faceswaps and GANs are the previous generation, so detection built to catch them is hunting a signature this attack never leaves.

The pixel-level patterns don't match those produced by a physical camera sensor. No reviewer sees that difference. Detection does. Reality Defender’s analysis, conducted on March 18, produced the following results: 

Exhibit B: Deepfake Analysis Report

Detection scored the selfie inside the pipeline IDmission already had

IDmission captured the document, received the injected selfie through the capture channel, ran its verification checks, and owned the onboarding decision. Reality Defender scored the same selfie for manipulation and returned a result. Nothing changed in the architecture. The fraud team works in the console it already had.

The exposure is structural, not a tuning problem. Document and selfie checks were built when a genuine photo meant a genuine person, and that assumption is what's failing, worldwide and at a growing rate. Authenticity isn't a check you bolt on after the fact anymore. It has to be built into the workflow itself.

3 Checks belong in any onboarding flow

Resynthesis works against any pipeline that treats the document and the selfie as independent evidence, which is most of them. These are worth running, regardless of who you buy from.

1. Run injection detection at the platform layer: verify that the selfie originated from a camera sensor on a trusted device rather than a file, a virtual camera, or a direct API submission. A pre-rendered image that never touches a camera clears everything downstream of capture. Your IDV platform owns this check. 
2. Run your detection against diffusion outputs, not faceswaps alone. Systems tuned to the older technique will miss this one
3. Score the selfie for manipulation separately from the match result. When the selfie came from the ID portrait, face matching confirms it by design. Liveness is not a substitute here: it guards the camera, and an injected image never reaches it.

One blocked application proves nothing on its own. Every capture gets scored, not a sample. 

Detection is a continuous discipline, and the models change as the generators do.