Shufti’s new research reveals a rapid surge in deepfake AI-powered identity fraud which is projected to increase by 495% by the end of 2026, fuelled by document deepfakes and synthetic identities. The findings are based on proprietary fraud attempt data taken from across its identity verification network, which emphasis four main attack types that make up the deepfake fraud stack – synthetic identity fraud, live video deepfakes, face swaps and document deepfakes.
The report decodes the fast-growing landscape of document deepfakes and face swaps, which leads us to conclude that a single selfie “check is no longer a sufficient control” without taking a multi-layered approach.
Powered by open-source models and low-cost cloud infrastructure, attackers can now feed a single image or text prompt into a generative model to instantly produce a fully responsive face or high-resolution document credential. Due to the marginal cost of producing these synthetic assets as volume expands, deepfake fraud is scaling without stops.
Document deepfakes are the fastest-growing category within the fraud stack by a wide margin, with projections estimating an explosive growth rate of nearly 3,892% year over year in 2026.
Synthetic identity creation, where entirely fabricated personas are generated, remains the single largest attack type by volume and continues to trend upwards by 173%.
Attackers deploy these synthetic assets using three main access routes, often layering them within a single campaign to bypass controls.
Often relying on a human reviewer to catch these sophisticated streams isn’t enough as the deepfake is too difficult to detect and the human eye is over-confident.
Gartner predicts that by 2026, 30% of enterprises will no longer view standalone identity verification checks as reliable in isolation, and Deloitte estimates that generative AI could drive total fraud losses in the U.S. up to $40 billion by 2027.
Fraud and compliance leaders are warned in the report that a standalone selfie or document check is no longer a viable security control. Stopping software-driven fraud requires stacking independent checks that an attacker must beat all at once.
Shufti uses a three-layer detection architecture – find out more here.
This architecture processes every file through a seven-part forensic model to ensure the media is authentic. Shufti is a certified iBeta Level 3 liveness provider, enabling institutions to effectively shut down the deepfake fraud stack without compounding onboarding friction for legitimate consumers.
Download and read the full ‘Deepfake Fraud Index Report’ by Shufti.
