Sanchez observes that verification processes previously conducted across a bank counter now frequently depend on cameras, microphones and digital credentials.
“ The more convenient the remote channel, the more valuable it becomes to imitate the person behind it.”
Criminals can exploit these processes through manipulated identity documents, synthetic photographs, fabricated personal information and attempts to defeat remote verification mechanisms.
Account recovery and customer support are particularly attractive targets because they may depend on voice recognition, knowledge-based questions or human judgement.
A familiar voice or recognisable face can no longer be treated as conclusive evidence that the legitimate individual is present.
Narayanan cites research referenced in Check Point’ s AI Security Report 2026 showing that, in a controlled study, trained face-recognition specialists identified approximately 41 % of AI-generated faces as fake, compared with 30 % among ordinary viewers.
These figures concern human identification of synthetic faces rather than the overall performance of commercial biometric systems. Nevertheless, they illustrate the limitations of visual judgement.
Haber emphasises that biometric characteristics differ fundamentally from traditional credentials.
Ram Narayanan, Country Manager, Check Point Software Technologies
Haber argues that organisations must distinguish between authentication and authorisation.
“ The fundamental problem is that biometric characteristics are not credential based secrets.”
“ Authentication establishes identity confidence to start, while authorisation determines what that identity should be permitted to do.”
Successfully completing an identity check should not automatically provide unrestricted authority to perform subsequent transactions.
Faces and voices are routinely exposed through social media, corporate presentations and public appearances. Unlike passwords, they cannot simply be replaced following compromise.
The answer is not to abandon biometrics but to strengthen them through layered verification.
For financial institutions, this means applying additional verification to high-risk activities, including changes to beneficiary details, account recovery, privileged access and large financial transfers.
Narayanan similarly advocates continuous, risk-based identity assurance rather than relying exclusively on initial customer onboarding.
A legitimate-looking customer identity must remain subject to scrutiny when behaviour changes or a transaction introduces unusual risks.
This approach becomes increasingly important as synthetic identities move beyond isolated fraud attempts towards more persistent account abuse.
The limits of biometric trust
Voice biometrics, facial recognition and video authentication have become important components of digital identity verification.
However, deepfake technology is challenging assumptions about their reliability when used independently.
Cryptographic authentication, passkeys, trusted devices, behavioural analytics and contextual risk assessments can collectively provide stronger identity assurance.
Sanchez believes these methods remain valuable when combined appropriately.“ Yes, provided they never rely on one of them alone.”
For CISOs, the objective should be to establish whether the legitimate individual is authorised to perform a particular action, rather than relying solely on whether a system recognises their appearance or voice.
Making deception ineffective
As synthetic content becomes increasingly convincing, expecting employees to distinguish authentic communications from deepfakes may become an unrealistic security strategy.
Even experienced professionals can be deceived when fraudulent requests arrive through familiar channels and appear to originate from trusted executives.
WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 39