ProKYC: Deepfake Tool for Account Fraud Attacks

Summary

Cato CTRL security researchers have identified ProKYC, a deepfake tool being sold to cybercriminals as a method to bypass Know Your Customer (KYC) verification on financial service applications such as cryptocurrency exchanges. ProKYC can create fake identity documents and generate deepfake selfie videos, two key pieces of biometric data used during KYC verification. The tool helps cybercriminals defeat facial recognition and liveness checks to create fraudulent accounts. The procedure below describes how a bad actor could use ProKYC’s service to bypass KYC verification. Target: KYC verification services Actor: ProKYC, cybercriminal group Reporter: Cato CTRL Procedure: 1. The bad actor collected user identity information. 2. The bad actor paid for the ProKYC tool, created a fake identity document, generated a deepfake selfie video, and replaced a live camera feed with the deepfake video. 3. The bad actor used a mixture of real PII and falsified details with the ProKYC tool to generate a deepfaked identity document. 4. The bad actor used ProKYC tool to generate a deepfake selfie video with the same face as the identity document designed to bypass liveness checks. 5. The bad actor used the victim information to register an account with a financial services application, such as a cryptocurrency exchange. 6. During identity verification, the financial services application used facial recognition and liveness detection to analyze live video from the user’s camera. 7. The bad actor used ProKYC to replace the camera feed with the deepfake selfie video. This successfully evaded the KYC verification and allowed the bad actor to authenticate themselves under the false identity. 8. With an authenticated account under the victim’s identity, the bad actor successfully impersonated the victim and evaded detection.

Deployers

• KYC verification services

Tags

• MITRE ATLAS
• AML.CS0034