EU Deepfake Rules Leave Banks Exposed to AI Identity Fraud

The European Union’s AI Act introduces transparency duties for deepfakes, generally requiring artificially generated or manipulated images, audio and video to be disclosed. The law entered into force on Aug. 1, 2024, with the relevant obligations due to apply from Aug. 2, 2026. Critics say the framework focuses on labeling synthetic content while giving insufficient attention to how the same technology can undermine identity checks used by banks.

Advances in generative AI allow fraudsters to mimic a customer’s face or voice at low cost, potentially defeating onboarding, login and transaction-verification systems built around selfies, video calls or speech. The latest concern is that disclosure rules offer little protection inside private authentication channels, where criminals have no incentive to label manipulated media. Banks may need stronger liveness detection, multifactor authentication and continuous behavioral monitoring rather than relying on biometric resemblance alone.