Cases › security breach › LR-2026-0293
Deepfake liveness-check bypass attempts at Indonesian bank's digital KYC
Preliminary Why: Publisher not yet named · subject to change
Severity moderate: the bank's own systems and loan-application flows were targeted with a bounded scope stated (roughly 1,000 fraud cases among 2 million users), but no dollar loss figure is given.
Earliest source we hold 2026-10-30 · Captured by AI Risk Wire 2026-10-31 03:27 UTC
A major Indonesian financial institution found deepfake fraud inside its mobile app despite running multi-layered security, and brought the problem to Group-IB in August 2024. Group-IB's investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%. Over the following year the same institution logged 8,065 separate attempts to fool its liveness checks with AI-generated faces during digital KYC for loan applications, described as a technique run at volume rather than one clever attacker.
Risks this incident falls under
| Risk | Role | NIST AI 600-1 | Incidents | Last 6 quarters |
|---|---|---|---|---|
| AI used to run a cyber attack | Primary | Information Security | 33 | |
| Manipulation and misinformation | Also | Information Integrity | 10 | |
| AI system attacked or breached | Also | Information Security | 1 |
Sorted by rule from the case's fields; not yet read from the sources.
Control failure chain
L1 · ModelProvider not namedModel provider
Sources not yet read for controls.
Model version not linked to a model card.
9 more for this risk at this layer
L2 · HarnessHarness not namedAgent framework vendor
Sources not yet read for controls.
L3 · ApplicationDeployer not namedDeployer
Sources not yet read for controls.
L4 · Infrastructure / targetOrganisation hitOrganisation hit
Sources not yet read for controls.
6 more for this risk at this layer
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
The same controls in other incidents of this risk
| Control | Layer | Here | Held elsewhere | Did not hold elsewhere |
|---|---|---|---|---|
| Content safety classifiers | L1 Model | Not read yet | – | – |
| Safety training and refusal | L1 Model | Not read yet | – | 1 |
| Cyber and weapons safeguards | L1 Model | Not read yet | – | – |
| Dangerous-capability testing before release | L1 Model | Not read yet | – | – |
| Outside red-teaming | L1 Model | Not read yet | – | – |
| Staged or restricted release | L1 Model | Not read yet | – | – |
| Abuse monitoring and account enforcement | L1 Model | Not read yet | – | – |
| Reasoning monitoring | L1 Model | Not read yet | – | 1 |
| Safeguards kept on in testing | L1 Model | Not read yet | – | – |
| Known flaws patched | L4 Infrastructure / target | Not read yet | – | – |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not read yet | – | – |
| Network segmentation | L4 Infrastructure / target | Not read yet | – | – |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not read yet | – | – |
| Backups and recovery | L4 Infrastructure / target | Not read yet | – | – |
| Phishing and fraud filters | L4 Infrastructure / target | Not read yet | – | – |
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Others like this
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
Extractor proposed values without quotes; dropped: .
LR-2026-0293 · version 1 · published 2026-10-31 after automatic checks; not yet checked field by field by a person · JSON