Deepfakes and identity: how detection has to evolve

Deepfake identity protection is becoming a requirement for any service that verifies who a user is. Synthetic avatars, generated from photos or videos, can now reproduce a face closely enough to reach verification systems that were built to check a real person. When a face is the credential, a convincing copy becomes a way in.

Why traditional detectors miss some attacks

Detection tools first focused on images produced by neural rendering, where a network synthesises the picture directly. Those tools struggle with 3D models built through a conventional graphics pipeline, because the output is not generated the same way. Itseez3D, a company working on digital identity and 3D graphics, released a deepfake detector built with machine learning that analyses the whole head rather than the inner face. Where traditional systems examine the area around eyes, nose and mouth, the wider analysis includes hair, neck and overall proportions, which makes inconsistencies visible.

The company distributes the tool as a Docker container so that it can run inside the customer's own cloud, an architectural choice that keeps data within the original environment and addresses privacy concerns. According to the vendor, the detector reaches accuracy above 99% with a false alarm rate below 2%, figures that should be validated against the specific use case before relying on them.

The incident behind the product

The motivation came from a concrete case. At the beginning of 2023, the company noticed an unusual spike in traffic to its avatar creation demo from Bangladesh. Operators were using videos to abuse the demo in order to bypass the facial verification system of the national identity card. The avatars were not photorealistic, and they still fooled the check, which raised concerns about electoral fraud before a national vote. Itseez3D blocked the traffic from the country, informed the government and offered a free detector.

The episode shows the practical shape of the risk: the barrier to a convincing synthetic face is lower than the security of the verification system protecting an identity document or a bank account. It also shows why detection belongs inside the verification flow, rather than being added after an incident.

What identity checks should change

Three changes follow. Verification should analyse the full face and the surrounding context, including consistency across frames in a video rather than a single image. Liveness checks should require an action that is hard to reproduce with a pre-recorded model, and they should run alongside a detector rather than as the only control. Systems should be tested against synthetic inputs as a routine, the same way they are tested against ordinary fraud. The European data protection framework adds another layer, because biometric data is a special category and its processing requires a legal basis, transparency and proportionality. The Garante per la protezione dei dati personali has published guidance on deepfakes and on biometric verification, which makes the compliance review part of the project rather than a later step.

Detection is one half of the defence: social engineering as an attack path shows that the human remains the entry point when the perimeter holds.