16Identity & fraudBelow the top 20
Defeat of KYC selfie checks
AffordanceImpact domainCap-adjacent
Statement (NASA form)
Given that onboarding still trusts a liveness clip that models can now render, there is a possibility of synthetic people opening real accounts resulting in a financial system that cannot tell which customers exist.
Likelihood
4Likely
Consequence
3Major
Urgency
4Expedite
The selfie was an authenticator. It is now a file format.
Composite 16 = 4×3 + 4
Applicable mitigations
Controls · Retire voiceprint as an authenticator · Real-time clone detection on high-risk lines · Out-of-band confirmation on a known number · Pace rules: no irreversible action faster than a human can reconstruct it · A real off-ramp that still functions · Contract-first delegation with privilege attenuation · Duty of care on high-stakes delegates