{"schema_version":"0.10.0","id":"LR-2026-0293","record_version":1,"title":"Deepfake liveness-check bypass attempts at Indonesian bank's digital KYC","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":45.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":5.44,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-31","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-10-31","history":[{"date":"2026-10-31","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"c1477d7f09e3a6619d82d0bc6329fe6a55a7b61ca6e07182721dfdfc7d845050"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":["liveness_check","biometric_authentication"],"deployment_context":"production","tier":null,"lifecycle_stage":"production","integration_type":null,"intended_use":"identity verification during account opening or recovery and digital KYC for loan applications","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-30","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A major Indonesian financial institution found deepfake fraud inside its mobile app despite running multi-layered security, and brought the problem to Group-IB in August 2024. Group-IB's investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%. Over the following year the same institution logged 8,065 separate attempts to fool its liveness checks with AI-generated faces during digital KYC for loan applications, described as a technique run at volume rather than one clever attacker. The document does not state how the attempts were caught, what was halted, or what remediation followed.","tags":["deepfake","liveness-check-bypass","kyc-fraud","synthetic-identity","mobile-banking","indonesia"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate: the bank's own systems and loan-application flows were targeted with a bounded scope stated (roughly 1,000 fraud cases among 2 million users), but no dollar loss figure is given.","harm_class":["financial","third_party_security"],"affected_description":"a major Indonesian financial institution; roughly 1,000 fraud cases among 2 million users","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.group-ib.com/blog/deepfake-fraud-prevention/","publisher":"Group-IB","date":"2026-10-30","type":"press","title":"Deepfake Fraud Prevention: Why Detection Alone Fails","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.guardrails_present":"C","system.deployment_context":"C","system.lifecycle_stage":"C","system.intended_use":"C","event.date_disclosed":"D","event.trigger":"D","event.detection_method":"D","event.summary":"C","event.tags":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.incident_class":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.severity_because":"C","context.industry":"C","context.country":"C","context.denominator_available":"C","context.denominator":"C"},"field_citations":{"system.guardrails_present":[{"source_index":0,"quote":"Over the following year, the same institution logged 8,065 separate attempts to fool its liveness checks with AI-generated faces during digital KYC for loan applications."},{"source_index":0,"quote":"Mobile banking fraud centered on face-swapped liveness checks defeating in-app biometric authentication, the same pattern Group-IB investigated directly at the Indonesian institution above"}],"system.deployment_context":[{"source_index":0,"quote":"In August 2024, a major Indonesian financial institution came to Group-IB with a problem: deepfake fraud was showing up inside its mobile app, despite the bank already running multi-layered security."}],"system.lifecycle_stage":[{"source_index":0,"quote":"Over the following year, the same institution logged 8,065 separate attempts to fool its liveness checks with AI-generated faces during digital KYC for loan applications."}],"system.intended_use":[{"source_index":0,"quote":"Synthetic video or voice used to pass identity verification during account opening or recovery, particularly in banking, fintech, and insurance"}],"event.summary":[{"source_index":0,"quote":"In August 2024, a major Indonesian financial institution came to Group-IB with a problem: deepfake fraud was showing up inside its mobile app, despite the bank already running multi-layered security."},{"source_index":0,"quote":"Group-IB’s investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%, but enough to make the national-scale cost of deepfake-driven loan fraud worth calculating."},{"source_index":0,"quote":"Over the following year, the same institution logged 8,065 separate attempts to fool its liveness checks with AI-generated faces during digital KYC for loan applications."},{"source_index":0,"quote":"That’s not one clever attacker; it’s a technique being run at volume."}],"event.tags":[{"source_index":0,"quote":"Over the following year, the same institution logged 8,065 separate attempts to fool its liveness checks with AI-generated faces during digital KYC for loan applications."},{"source_index":0,"quote":"Synthetic video or voice used to pass identity verification during account opening or recovery, particularly in banking, fintech, and insurance"},{"source_index":0,"quote":"Mobile banking fraud centered on face-swapped liveness checks defeating in-app biometric authentication, the same pattern Group-IB investigated directly at the Indonesian institution above"}],"event.responsible_party":[{"source_index":0,"quote":"Over the following year, the same institution logged 8,065 separate attempts to fool its liveness checks with AI-generated faces during digital KYC for loan applications."}],"event.adversarial_actor":[{"source_index":0,"quote":"That’s not one clever attacker; it’s a technique being run at volume."}],"event.incident_class":[{"source_index":0,"quote":"Over the following year, the same institution logged 8,065 separate attempts to fool its liveness checks with AI-generated faces during digital KYC for loan applications."}],"impact.severity":[{"source_index":0,"quote":"Group-IB’s investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%, but enough to make the national-scale cost of deepfake-driven loan fraud worth calculating."}],"impact.harm_class":[{"source_index":0,"quote":"Group-IB’s investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%, but enough to make the national-scale cost of deepfake-driven loan fraud worth calculating."}],"impact.affected_description":[{"source_index":0,"quote":"Group-IB’s investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%, but enough to make the national-scale cost of deepfake-driven loan fraud worth calculating."}],"impact.severity_because":[{"source_index":0,"quote":"Group-IB’s investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%, but enough to make the national-scale cost of deepfake-driven loan fraud worth calculating."}],"context.industry":[{"source_index":0,"quote":"In August 2024, a major Indonesian financial institution came to Group-IB with a problem: deepfake fraud was showing up inside its mobile app, despite the bank already running multi-layered security."}],"context.country":[{"source_index":0,"quote":"In August 2024, a major Indonesian financial institution came to Group-IB with a problem: deepfake fraud was showing up inside its mobile app, despite the bank already running multi-layered security."}],"context.denominator_available":[{"source_index":0,"quote":"Group-IB’s investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%, but enough to make the national-scale cost of deepfake-driven loan fraud worth calculating."}],"context.denominator":[{"source_index":0,"quote":"Group-IB’s investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%, but enough to make the national-scale cost of deepfake-driven loan fraud worth calculating."}]},"notes_on_gaps":"The document is a vendor blog on deepfake fraud generally; only the Indonesian bank passage describes a concrete, dated event. The 8,065 attempts are given both as 'over the following year' and as an '8-month window' in the by-the-numbers list, so no duration is recorded. The document does not state the date the fraud began, how it was detected, what was halted, remediation, or any dollar loss. The AI systems here are the attackers' generative tools (deepfakes), not an autonomous agent, so agent_involved is false and failure_class is null. incident_class is coded security_compromise as the closest fit for an identity-verification bypass; the bank's own systems were the target, not the source of harm. Country ID inferred from 'Indonesian'. The 2 million users figure is used as the denominator. Extractor proposed values without quotes; dropped: ['event.agent_involved', 'event.date_disclosed', 'event.detection_method', 'event.trigger', 'system.autonomy_level', 'system.developer']. Single secondary source; corroborate before upgrading any field to B. [2026-10-31: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":"Finance and Insurance","org_size_band":null,"country":"ID","denominator_available":true,"denominator":{"value":2000000.0,"unit":"other","period":null},"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}