As a leader in digital identity verification, QoreAI is always on the lookout for new threats to the security of online transactions. So when news broke in early February about the rise of AI-generated fake IDs on the dark web, our team sprang into action. We tracked down the hidden telegram threads and websites where these sophisticated fakes were being created and tested them against our cutting-edge QoreVerify application. The role of social media platforms in spreading awareness and misinformation about AI-generated fake IDs cannot be understated, with popular platforms like Facebook and TikTok becoming battlegrounds for the dissemination of both genuine information and deepfakes, highlighting the potential use of blockchain to verify the source of media on these platforms.

After quickly testing some AI-generated fake IDs we found in hidden telegram threads (we caught them all), we set to purchase a few fake ID images to see how well they performed when tested against our QoreVerify application. The development of these AI-generated fake IDs found on dark web websites is significantly advanced by machine learning, particularly through generative adversarial networks (GANs) and first-order motion models, which play a crucial role in their creation and detection. Neural networks, mimicking the human brain, generate realistic ID images by learning a compact representation of bona fide faces and dispersing the representations of deepfakes, showcasing the sophistication behind these technologies.

How to tell if an ID image is a deepfake? Tips for detecting deepfakes

Fake IDs have long been a problem for car dealerships, but the rise of AI-powered deepfakes takes this threat to a new level. Using advanced machine learning techniques like generative adversarial networks (GANs), fraudsters can now create unrealistic images of fake IDs that fool many traditional verification methods. While these images won’t work for in-person transactions (since they’re not physical documents), they can be used to perpetrate deepfake scams in electronic scenarios - like scheduling a test drive or purchasing a vehicle remotely. The origin of deepfakes, including deepfake pornography on platforms like Reddit and their use in creating non-consensual fake videos, showcases the broader issue of digital deception that can range from scamming individuals to influencing public opinion.

So, how can dealerships protect themselves and their customers from this new wave of AI-powered fraud? That’s where QoreAI comes in.

Putting QoreVerify to the Test, our team purchased a range of AI-generated fake IDs from various dark web sources and ran them through our QoreVerify application. The results? Thanks to our layered approach to digital identity verification, QoreVerify caught almost all of the fakes immediately.

Here are some of the key techniques QoreVerify uses to sniff out even the most sophisticated deepfakes:

1. Prohibiting manual upload of ID photos: By requiring users to take a live photo of their ID (rather than uploading a pre-generated image), we ensure that they have a physical document in hand.

2. Third-party checks: QoreVerify cross-references ID data with external databases (like DMV records) to confirm that the ID matches a real identity.

3. Cross-matching front and back: We don’t just rely on the OCR of the front of the ID - we also analyze the barcode data and match it against the plaintext to catch anomalies.

4. Face matching with liveness checks: QoreVerify uses facial recognition with randomized liveness checks to ensure the person presenting the ID is who they say they are.

How can dealerships protect the car buying experience against the use of AI-generated fake IDs?

There are several key security elements every dealership should put in place to protect against deepfake IDs.

Prohibiting manual upload of ID photos

First, dealerships should not allow manual document upload of ID images. Manual upload allows the user to pull the pre-generated deepfakes from their image library instead of snapping a new photo. By requiring them to use the camera function on their phone, you ensure they have the physical document in front of them and aren't using a pre-generated image.

Screen-to-screen fraud is a way fraudsters may attempt to circumvent live document upload – by pulling up the AI-generated image on one device and using the camera on a second device, however QoreVerify's liveness detection tools will detect this type of fraud in most cases.

Third-party checks, such as DMV checks

Dealerships should also have layered fraud prevention that includes a third-party check. Third parties check and query an external database to confirm whether the information on the ID matches the jurisdictional records at the DMV. Other third-party checks can query the Social Security Administration, PEP lists, and known lists of fraudulent identities. These checks will confirm whether or not you have a real identity on your hands – the only way they can be passed is if the data on the ID matches the data of a real person exactly.

Of course, identity thieves regularly steal and have access to an entire identity, allowing them to create ID cards that do match the DMV database. They simply swap in their own photograph. This is why it is important to have layered security so that all types of deep fake fraud can be detected.

Cross-matching the front and back of the ID

Many digital ID verification tools, or requests for copies of IDs, only use optical character recognition (OCR) to parse the data on the front of the ID and see if it matches the record of the individual. However, a review of the data format in the 2D barcode can quickly sniff out almost 50% of fake IDs. By matching the text on the front of the ID to the data in the barcode, our software can catch all but the most sophisticated fakes, as every state orders and formats its data slightly differently, and capable software will flag anomalies that indicate the ID might be fraudulent.

Face matching

During a sales or service transaction, a dealership should never simply accept an image of an ID. They should always perform face matching to ensure the individual presenting the ID is the individual with whom they are doing business. Facial comparison tools take less than 5 seconds to create a template and perform a match. While deep fake videos do exist, randomized liveness checks and anti-spoofing tools applied during the selfie process make it extremely difficult to use a pre-recorded video to fool face-matching technology. But unfortunately, the fraudsters are improving every day.

How does AI use deepfake technology to generate IDs?

The dark web sites building and creating deepfake IDs and passports might use some AI, but they are mostly just PDF417 and ID image generators. Creating deepfakes involves using advanced AI and machine-learning techniques, including deep-learning models and algorithms like generative adversarial networks (GAN), to generate highly realistic images or videos. This includes creating deepfake videos and photographs, which can be used to fabricate non-existent individuals or alter the appearance and actions of real people in videos, raising concerns about their use in disinformation and propaganda. This technical aspect of deep learning is crucial in creating deep fake IDs, where the AI is trained to produce images that can pass more than just a cursory inspection by closely mimicking real ID features. The user still inputs the data they want to appear on the ID, and the tool formats it and places it in a contextual background. Although the tool is slightly more advanced and can create images that pass cursory inspection, it mostly places the fields on a pre-created template.

The websites typically include a disclaimer saying the ID images should not be used for illegal purposes and are meant to be used for set dressing for films and television.

Can digital identity verification software catch deepfake IDs using deep learning?

We tested AI-created deepfake IDs against our software. Our digital identity verification engine caught almost all of them immediately. This success is partly due to initiatives like the Deepfake Detection Challenge, which accelerates technology development to identify manipulated content effectively. Such challenges assess the most effective algorithms for detecting deepfakes, significantly contributing to the advancements in our software's capabilities. This does not mean that every AI-generated fake ID can be easily sussed out by software, but it does mean that these images aren’t quite the threat the media made them out to be. Yet.

ID scanning software is broadly capable of detecting AI-generated deepfake IDs using layered security.

How to tell if an ID image is a deepfake? Tips for detecting deepfakes

There are a few common factors we saw when generating deepfake ID images. Distinguishing between ‘real images’ and AI-generated images is crucial for detecting deepfakes, as it helps identify the authenticity of the images used in IDs. Additionally, it’s important to acknowledge that deep fake technology affects video content through ‘video manipulation,’ expanding the scope of detection challenges beyond still images. The challenge intensifies with the ability to create personalized videos, including those used in scams, and for creating highly realistic documents, making the detection of such sophisticated deepfakes even more critical. We are being intentionally vague in this section because we do not want to help fraudsters create better fake ID images.

Use of stock backgrounds

Many fake ID images we see use recycled stock backgrounds to make it appear like the ID was placed on an available surface for a live photo. However, the AI images often re-used the same backgrounds repeatedly, making it easier for us to spot.

Blurred areas

The edges of the background and the edges of the ID where it interacts with the background also often showed hallmarks of being AI-generated. This includes inconsistent shadowing around the borders of the ID, blurry corners of the ID, or seaming and sticking on the AI-generated background that blurs into nothing or shifts in an obviously fake way. There is also often a difference in sharpness between the sharp background pattern and the ID itself, which appears blurry or slightly out of focus.

Absence of sticker marks

ID information is typically printed onto a pre-printed card that contains the design of the state's ID. In all cases, especially if the ID is not brand new, you can easily view the edges of the sticker, which leaves a margin between the individual's printed data and the edge of the card. In all the AI-generated images, the sticker lines were either absent or irregular and did not match the known borders of that state's standard printing.

Front and back data mismatch

AI-generated fake ID images are made to look good, but they usually don't have a sophisticated understanding of barcode data (or MRZ) formatting. Every jurisdiction and document type (and many jurisdictions have 20+ valid document types in circulation at any given time) has different expected fields. When we scan an ID using our AI algorithms, we instantly check to make sure the data is in the format we expect it to be. We then compare that data against the plaintext data on the front of the document. This is a great way to root out AI-created fake IDs not built by individuals who know state data formats.

The Power of Adaptive Security

While no single method is foolproof against the constantly evolving threat of AI-powered fraud, QoreVerify's layered approach provides a robust defense. By combining multiple verification techniques and harnessing the power of machine learning ourselves, we stay one step ahead of the fraudsters.

Our commitment to continuous innovation has made QoreAI a trusted partner for dealerships and other businesses that need to verify identities remotely. And we're just getting started.

Stay ahead of the curve with QoreAI. As deep fake technology continues to advance, so does QoreAI. We're constantly refining our algorithms, integrating new data sources, and pushing the boundaries of what's possible in digital identity verification.

Curious to see QoreVerify in action?

Contact our team today to schedule a demo and learn how we can help protect your dealership from the growing threat of AI-generated fake IDs and other forms of deepfake fraud. With QoreAI, you can transact with confidence, knowing that you have the most advanced multi-signaling identity verification technology on your side.