A man in Murcia made 38 attempts against remote video identity verification, holding a forged national ID to the camera while software altered his face to match the photo on it. He lit the document with coloured spotlights so it threw the reflections a real one does. A momentary glitch dropped the mask and ended it. The interesting part is what the published account leaves out.
What the police described
Spain's National Police announced the arrest in August 2026. The target was not a bank account directly but a digital certificate, the credential that carries legal signing authority in Spain, which makes it a master key rather than a single account.
According to the announcement, reported by Help Net Security, the suspect made 38 attempts against more than 30 citizens. Police did not say how many succeeded. He appeared on the verification call holding a forged national ID card while AI software altered his face on screen to match the document photo.
The detail worth pausing on is the lighting. Police describe household spotlights with strategically placed coloured bulbs, used to simulate the flashes and security features a physical identity document throws off under real light. Holograms and optically variable ink are what a human reviewer is trained to look for, and he built a rig to fake them.
The infrastructure was proportionate to the ambition: more than 320 phone lines linked to 24 mobile devices, most registered with stolen identities bought locally, and an encrypted laptop seized on arrest.
Two attack classes, one session
Remote identity verification has two distinct attack surfaces, and they are defended by different controls.
A presentation attack puts something in front of a real camera: a printed photo, a replayed video, a silicone mask, a forged document under coloured lights. The control is presentation attack detection, and ISO/IEC 30107-3 is the standard it reports against.
An injection attack skips the camera. Synthetic video is fed into the application through a virtual device, so the liveness model never receives a sensor image at all. Presentation attack detection does not cover this, because the attack never reaches the surface that detection inspects. Examining face-swap and camera-injection tooling with the biometrics vendor iProov, the World Economic Forum found most of it defeated standard biometric onboarding in testing.
This case contains both halves. The document side was unambiguously a presentation attack: there was a physical card, physically lit, held up to a lens. Nobody builds a spotlight rig to fool a video stream they are generating synthetically.
The question the coverage cannot answer
The face side is where the published account stops short, and we are not going to fill the gap with a guess.
What is reported is that software altered his face on screen. That tells you the video reaching the verifier was not the camera's raw output. It does not tell you where the alteration was applied. A real-time filter sitting between a physical camera and the application is a presentation-side problem. A virtual camera driver feeding a constructed stream is an injection problem. Both produce the same thing on the reviewer's screen, and the reporting does not distinguish them.
That ambiguity is not a gap in the journalism. It is the ordinary state of affairs. A verification system that returns a pass or a fail does not record which surface the attack entered through, so after the fact nobody can say which control was on the hook.
It matters commercially because the two are procured separately. A vendor holding a presentation-attack certification has made no claim about injection, and a buyer reading that certificate as general coverage has drawn a conclusion the document does not support. One session in Murcia plausibly spanned both, and an assessment scoped to one of them would have reported a clean result.
What actually caught him
Not the liveness check. Not the document check. The mask glitched for a moment during a live call and his real face appeared on screen.
Thirty-eight attempts is a lot of chances for a control to fire, and what ended the run was a rendering failure. The attack worked until the software briefly stopped working, which is a statement about the attacker's tooling rather than about the defence.
This is the pattern underneath most of these cases. The question is never whether the face on the call looks convincing, it is whether the control reads a property the attacker cannot supply, and a control that passes a face because it moved convincingly is reading exactly the property a face swap produces. The same lesson shows up when a synthetic passport clears a document check for fifteen dollars, and when a ring opens real bank accounts through remote onboarding.
Where that leaves the measurement
A pass or a fail from a verification flow is a thin record. It does not say which surface was probed, which condition the media arrived in, or how close the decision was. Thirty-eight attempts produced 38 of those records, and the run ended on an accident instead.
Separating the two attack classes on a specific deployment is part of what we do. We build both, presented attacks against the camera and injected streams that never touch it, run them at the document and liveness steps in a real flow, and report which surface returned a pass rather than leaving it to be inferred after an arrest.
Related reading
- ExplainersWhat is AUC?AUC is the probability that a detector scores a randomly chosen fake above a randomly chosen real image. It runs 0 to 1, where 0.5 is a coin flip and anything below it means the model is systematically wrong rather than merely weak.
- BenchmarksDetectors collapse from near-perfect to near-random.Fourteen open-source deepfake detectors, evaluated on about 26,500 face crops across 12 demographic cells. The two that scored a perfect AUC of 1.000 fell to 0.243 and 0.340 once real and synthetic images shared one encoder, and a control isolated the file format itself as the cause.
- Fraud storiesThe engineer a security firm hired was a North Korean operative.A North Korean operative cleared a security firm's background check, reference checks, and four video interviews using a stolen identity and an AI-augmented photo. The verification that failed was remote identity screening, and it fails at industrial scale.