Spoofing is a type of fraud where someone pretends to be a trusted person, device, website or source of information to trick a system or another person. In identity verification, spoofing can involve presenting a fake or manipulated face, document, device or other identity signal to make it appear genuine. The aim is to convince a business or verification system that the person or information being presented is legitimate when it is not.
How does spoofing work?
Spoofing can take different forms depending on the system being targeted. During digital identity verification, a fraudster might use a photograph, video, mask or digitally manipulated image to impersonate another person during a biometric check. Spoofing can also involve manipulating device information, websites, email addresses or other digital signals. The common factor is the attempt to make fraudulent activity appear to come from a legitimate source.
Why does spoofing matter for fraud prevention?
Spoofing can allow fraudsters to bypass identity and security checks without using the genuine customer’s identity or device. If successful, this can lead to fraudulent account applications, account takeover or access to financial services. For fraud teams, detecting spoofing means checking whether the identity information being presented comes from a genuine person and genuine interaction rather than a manipulated source.
What does spoofing mean for AML compliance?
Spoofing can create AML risk when it allows someone to pass customer verification using a false representation of their identity. This can make it harder for a business to establish who its customer really is and assess the associated financial crime risk. If a fraudster successfully spoofs an identity during onboarding, they may gain access to an account that can later be used for fraud, money laundering or other financial crime. Strong identity verification and ongoing monitoring can help businesses identify suspicious activity after onboarding as well as during the initial check.
Spoofing and identity verification
Identity verification systems use different controls to detect spoofing. These can include liveness detection, biometric checks, document verification and analysis of the interacWtion itself. Liveness detection is particularly relevant for biometric verification because it helps determine whether the system is interacting with a real person rather than a photograph, video or other representation. No single check catches every form of spoofing, so businesses typically use several signals to assess whether an identity is genuine.
Spoofing targets the trust that digital systems place in identity and other signals. For AML and fraud teams, detecting spoofing helps reduce the risk of fraudulent identities passing verification and gives businesses greater confidence that the person behind an application is who they claim to be.
