Quick answer: Deepfake KYC fraud is when criminals use AI to build a realistic copy of your face, or a fake identity that looks real, and then use it to pass video KYC, selfie verification or account recovery at a bank, wallet or app. In June 2026 the Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs, warned that fraudsters are doing exactly this. The best protection is simple: do not record face videos, blinks or head turns for strangers, keep your Aadhaar biometrics locked when you do not need them, watch every bank SMS and email alert, and report anything suspicious at cybercrime.gov.in or on helpline 1930.
This guide explains how the scam works in plain language, the warning signs to look for, and a step-by-step safety checklist for students, freelancers, families and small business owners in India.
What is deepfake KYC fraud?
KYC (Know Your Customer) is the identity check that banks, payment apps, brokers, lenders and even some job and gig platforms run before they let you open or recover an account. Many of these checks are now done online: you hold up your face to the camera, follow on-screen instructions such as blink, smile or turn your head, and software compares your live face with the photo on your ID. That last part is called a liveness check.
A deepfake is an image, video or voice created or altered by AI so that it looks or sounds like a real person. When criminals combine a deepfake of your face with your stolen or leaked ID details, they can try to convince an automated KYC system that they are you. A related trick is the synthetic identity: a made-up person built from a mix of real and fake details, with an AI-generated face that has never existed.
What the government advisory said
According to a June 2026 report by News On AIR, the I4C issued an advisory warning that criminals are using AI to create realistic deepfake videos and synthetic identities. The advisory said these can be used to get past:
- facial authentication
- liveness checks
- video KYC
- account recovery systems
It also described how fraudsters collect the raw material. They first reach victims through social media, job portals, dating platforms or phone calls, and then get them to share facial data, sometimes by asking them to blink, turn their head or speak on camera. Those are the same movements many liveness checks ask for.
If a stranger asks you to blink, turn your head left and right, or read a sentence aloud on camera, treat it as a red flag. You may be handing over the exact clip a fraudster needs.
How the scam usually unfolds
Every case is different, but the pattern the advisory describes usually looks like this:
- First contact. A message about a remote job, a modelling or influencer offer, a loan, a dating match or a courier problem.
- Building trust. The scammer chats for days, shares fake offer letters or ID cards, and moves the talk to WhatsApp or Telegram.
- The face capture. You are asked for a video interview, a verification selfie video, or a call where you must blink, smile, turn your head or say your name and date of birth.
- Document collection. They also ask for a photo of your Aadhaar, PAN or bank passbook for onboarding or salary setup.
- The misuse. With your face clip and documents, they try to open a bank or wallet account, take a loan, recover your existing account, or create a mule account in your name.
Often the victim only finds out when a loan recovery call arrives, a credit report shows an unknown account, or the police contact them about a mule account used in another fraud.
Who is most at risk?
| Group | Why they are targeted | Common bait |
|---|---|---|
| Students and freshers | Actively looking for jobs and internships, used to video interviews | Work-from-home jobs, part-time tasks, fake internship onboarding |
| Freelancers and gig workers | Share ID and bank details with many clients and platforms | New client onboarding, payment verification, fake platform KYC |
| Small business owners | Run current accounts, POS and payment gateways | Merchant KYC update, fake bank officer video calls |
| Parents and senior citizens | Less familiar with AI tricks | Pension or bank KYC update, lottery or courier calls |
| Content creators | Lots of clear face videos already public | Brand deals that ask for extra verification videos |
Creators should note that public videos can also be misused. Our guide to AI content labelling rules in India explains how platforms are now expected to mark synthetic content.
Warning signs you should never ignore
- A recruiter or client wants a video of you following instructions (blink, turn, read numbers) before any real interview.
- Someone asks for Aadhaar, PAN and a selfie together over WhatsApp or Telegram.
- You receive an OTP, bank SMS or email about an account, loan or login you did not request.
- A caller says your KYC is expiring and you must do a video verification on their link, not inside your bank app.
- The offer is unusually generous and urgent: high pay for little work, or a reward you never applied for.
- The person avoids official email domains and refuses to let you call back on a number listed on the company website.
Step-by-step: how to protect your face data and identity
1. Only do video KYC inside official apps and websites
Start KYC yourself from the bank, broker or wallet app you downloaded from the Play Store or App Store, or from the website you typed in. Never complete video KYC from a link sent by a caller. Genuine banks do not need you to perform liveness steps for a stranger on WhatsApp.
2. Refuse face videos for unknown people
A real employer can interview you on a normal video call without asking you to blink on command or recite your date of birth. If something feels scripted, end the call. Keep your interview and verification videos off public profiles.
3. Lock your Aadhaar biometrics
The Unique Identification Authority of India (UIDAI) lets Aadhaar holders lock their biometrics (fingerprints, iris and face) so they cannot be used for authentication until you unlock them. You can manage this through UIDAI’s online services using an OTP sent to your Aadhaar-registered mobile number. Unlock only when you need biometric authentication, then lock again. Check the current steps on UIDAI’s Aadhaar services page.
4. Turn on every alert and actually read it
The I4C advisory specifically asks people to watch for suspicious login attempts and check email and SMS alerts about financial activity. Turn on SMS and email alerts for all bank accounts, cards, UPI apps and trading accounts. An unknown login or new device alert is often your first and only early warning.
5. Share masked documents
When you must share ID, use a masked Aadhaar (only the last four digits visible) where accepted, and add a handwritten or digital watermark such as For XYZ job application only, 3 Nov 2026. This makes the copy harder to reuse elsewhere.
6. Check your credit report a few times a year
Loans and credit cards opened in your name usually show up on your credit report. Reviewing it regularly helps you catch fraud early. Many lenders and credit bureaus offer a free report, so you do not need to pay a third-party app.
7. Harden your accounts
- Use a strong, unique password and app-based two-factor authentication on email, because email is the key to most account recovery.
- Keep your phone updated and avoid installing APK files from links. Our post on Android sideloading rules explains why this matters.
- Set your social media profiles to private if you do not need them public, and remove old videos that show your face clearly from many angles.
8. Talk to family about it
Deepfake fraud often travels alongside voice cloning. Agree on a family code word and read our guide on how to stop the AI voice scam together with parents and grandparents.
For small businesses and freelancers who run KYC
If your business onboards customers or vendors using selfies or video calls, the same advisory asked financial institutions and fintechs to strengthen deepfake detection and onboarding systems. Even a small shop or agency can reduce risk:
- Do not accept identity proof only through chat apps; use a verified KYC provider or your bank’s merchant tools.
- Ask for a live call where you choose unexpected actions, rather than a pre-recorded video.
- Cross-check name, PAN and bank account details before you release goods, refunds or payouts.
- Keep staff trained to escalate any request to change bank details or payout accounts.
What to do if you think you are a victim
- Call 1930 immediately if money has moved, or file a complaint on the National Cybercrime Reporting Portal. Speed matters for freezing funds.
- Inform your bank through its official app, website or branch and ask them to block the affected account, card or UPI ID.
- Lock your Aadhaar biometrics right away if they are not already locked.
- Report the fraud communication (the call, SMS or WhatsApp number) on the Chakshu facility of the Sanchar Saathi portal.
- Change passwords for email and financial apps and sign out of unknown devices.
- Keep evidence: screenshots, numbers, links, offer letters and transaction IDs.
FAQ
Can a deepfake really pass a liveness check?
The I4C advisory warned that AI-generated replicas could be used to try to bypass facial authentication, liveness checks and video KYC. Banks are improving detection, but you should assume that a clear video of you following instructions is valuable to a fraudster and protect it.
Is it safe to do video KYC at all?
Yes, when you start it yourself inside the official app or website of a regulated bank, broker or wallet. The risk comes from doing it on links or calls that someone else started.
Does locking Aadhaar biometrics stop me from using Aadhaar?
Locking only blocks biometric authentication. You can still use OTP-based services, and you can unlock biometrics through UIDAI when you need them.
Where do I report deepfake fraud in India?
Call the cybercrime helpline 1930 or file a complaint at cybercrime.gov.in. Also inform your bank, and report the fraud number on Sanchar Saathi’s Chakshu facility.
Want more practical safety guides? Browse our AI Awareness section.
Sources
- News On AIR (Prasar Bharati) – Centre issues advisory on AI-driven cyber fraud targeting financial systems: details of the June 2026 I4C advisory, how fraudsters collect facial data, and recommendations for people and institutions.
- TelecomLive – Govt flags AI-driven identity fraud risks in banking, fintech sector: confirmation that the advisory targets facial authentication, liveness, video-KYC and account recovery.
- UIDAI – Aadhaar Services: official biometric lock and unlock service.
- Ministry of Home Affairs – National Cybercrime Reporting Portal: complaint filing and 1930 helpline.
- Department of Telecommunications – Sanchar Saathi: Chakshu facility for reporting suspected fraud communication.
Disclaimer: This article is for general awareness only and is not legal or financial advice. For a specific fraud case, contact your bank and the cybercrime authorities directly.