NewThe detectors that scored perfect collapsed the hardest under attack.
Back to publications
Fraud story

A face swap cleared 38 video ID checks, and nobody can say which control failed.

Spanish police describe 38 attempts against remote video identity verification, a face altered in the call to match a forged ID, and coloured spotlights faking the document's security features. A one-second glitch ended it. What the coverage cannot say is whether the camera was bypassed, and that is the distinction that decides which control was on the hook.

Article · September 2026 · 6 minute read

A man in Murcia made 38 attempts against remote video identity verification, holding a forged national ID to the camera while software altered his face to match the photo on it. He lit the document with coloured spotlights so it threw the reflections a real one does. A momentary glitch dropped the mask and ended it. The interesting part is what the published account leaves out.

What the police described

Spain's National Police announced the arrest in August 2026. The target was not a bank account directly but a digital certificate, the credential that carries legal signing authority in Spain, which makes it a master key rather than a single account.

According to the announcement, reported by Help Net Security, the suspect made 38 attempts against more than 30 citizens. Police did not say how many succeeded. He appeared on the verification call holding a forged national ID card while AI software altered his face on screen to match the document photo.

The detail worth pausing on is the lighting. Police describe household spotlights with strategically placed coloured bulbs, used to simulate the flashes and security features a physical identity document throws off under real light. Holograms and optically variable ink are what a human reviewer is trained to look for, and he built a rig to fake them.

The infrastructure was proportionate to the ambition: more than 320 phone lines linked to 24 mobile devices, most registered with stolen identities bought locally, and an encrypted laptop seized on arrest.

Two attack classes, one session

Remote identity verification has two distinct attack surfaces, and they are defended by different controls.

A presentation attack puts something in front of a real camera: a printed photo, a replayed video, a silicone mask, a forged document under coloured lights. The control is presentation attack detection, and ISO/IEC 30107-3 is the standard it reports against.

An injection attack skips the camera. Synthetic video is fed into the application through a virtual device, so the liveness model never receives a sensor image at all. Presentation attack detection does not cover this, because the attack never reaches the surface that detection inspects. Examining face-swap and camera-injection tooling with the biometrics vendor iProov, the World Economic Forum found most of it defeated standard biometric onboarding in testing.

This case contains both halves. The document side was unambiguously a presentation attack: there was a physical card, physically lit, held up to a lens. Nobody builds a spotlight rig to fool a video stream they are generating synthetically.

The question the coverage cannot answer

The face side is where the published account stops short, and we are not going to fill the gap with a guess.

What is reported is that software altered his face on screen. That tells you the video reaching the verifier was not the camera's raw output. It does not tell you where the alteration was applied. A real-time filter sitting between a physical camera and the application is a presentation-side problem. A virtual camera driver feeding a constructed stream is an injection problem. Both produce the same thing on the reviewer's screen, and the reporting does not distinguish them.

That ambiguity is not a gap in the journalism. It is the ordinary state of affairs. A verification system that returns a pass or a fail does not record which surface the attack entered through, so after the fact nobody can say which control was on the hook.

It matters commercially because the two are procured separately. A vendor holding a presentation-attack certification has made no claim about injection, and a buyer reading that certificate as general coverage has drawn a conclusion the document does not support. One session in Murcia plausibly spanned both, and an assessment scoped to one of them would have reported a clean result.

What actually caught him

Not the liveness check. Not the document check. The mask glitched for a moment during a live call and his real face appeared on screen.

Thirty-eight attempts is a lot of chances for a control to fire, and what ended the run was a rendering failure. The attack worked until the software briefly stopped working, which is a statement about the attacker's tooling rather than about the defence.

This is the pattern underneath most of these cases. The question is never whether the face on the call looks convincing, it is whether the control reads a property the attacker cannot supply, and a control that passes a face because it moved convincingly is reading exactly the property a face swap produces. The same lesson shows up when a synthetic passport clears a document check for fifteen dollars, and when a ring opens real bank accounts through remote onboarding.

Where that leaves the measurement

A pass or a fail from a verification flow is a thin record. It does not say which surface was probed, which condition the media arrived in, or how close the decision was. Thirty-eight attempts produced 38 of those records, and the run ended on an accident instead.

Separating the two attack classes on a specific deployment is part of what we do. We build both, presented attacks against the camera and injected streams that never touch it, run them at the document and liveness steps in a real flow, and report which surface returned a pass rather than leaving it to be inferred after an arrest.