TL;DR
- 01What happened
Over a two-month investigation, MIT Technology Review found 22 public Telegram channels and groups selling kits that defeat the face liveness checks in banks’ and crypto exchanges’ online identity verification (eKYC), along with stolen biometric data, and reported it in April 2026. The core tool is a virtual camera, which swaps the phone’s camera feed for prepared recorded or synthetic (deepfake) video. Binance, Spain’s BBVA and the UK’s Revolut were named as targets.
- 02Why it was hard to tell
To the app, the swapped video arrives by the same route as a real camera’s. However much the content looks like the person, it cannot show whether it was taken live by a real camera.
- 03The missing layer
The firms are aware of such attempts and detection of synthetic traces is improving, yet in iProov’s test a virtual-camera swap on a non-rooted Android phone went unnoticed by the liveness check. What failed was the layer that checks that video reaching the app was taken live by a real camera.
What happened
- Investigation
- MIT Technology Review spent two months in early 2026 and reported on April 15. In 22 public Telegram channels and groups in Chinese, Vietnamese and English, it found bypass kits and stolen biometric data on sale.
- Tools
- Virtual cameras (swapping the camera feed for video or photos of a real or synthetic person); code known as a “hooking framework” injected into a financial institution’s app so that opening the camera triggers the virtual camera; offers to jailbreak phones; and mixes of stolen biometrics and deepfakes.
- Targets
- Binance, a major crypto exchange, Spain’s BBVA and the UK’s Revolut were named on the channels.
- Firms’ response
- All three said they were aware of such bypasses and called them an industry-wide challenge. Binance said it had seen attempts and prevented them. BBVA and Revolut declined to comment on whether their safeguards had been breached.
- Harm
- The number of victims and success rates are not known. Telegram removed the channels and groups the reporter flagged for violating its terms, but similar ones remain.
- Scale
- iProov reports virtual-camera attacks in 2024 were about 25 times the 2023 level (up 2,665%).
Glossary
eKYC — Identity verification done online. A common method matches an ID document against a video of the face taken on the spot.
Liveness check — A check that the person in front of the camera is there live, not a photo or recording. Many ask the user to turn their head or similar.
Virtual camera — Software that hands an app prepared video or images as if they came from the real camera. To the app it is hard to tell apart from a real one.
How the kits on sale are used, and the flow shown in iProov's test. The point to stop it is ③: check, separately from the video, that it came from a real camera.
Jailbreaking offered too.
From stolen data or public photos.
It arrives by the same route as a real camera's.
Accounts serve as mule accounts or to move money.
Timeline — disclosure and response
- Japan’s government adopts a comprehensive anti-fraud package: remote identity checks are to be unified, in principle, on the My Number Card’s public certificate, and methods that send images of a driving licence or similar are to be abolished.
- The US FinCEN issues an alert on deepfake fraud targeting financial institutions, listing red flags such as using a third-party webcam plugin during a live verification check.
- iProov reports virtual-camera attacks up 2,665% on 2023.
- Japan promulgates an amended rule under its anti-money-laundering act. Remote checks that send a photo image (the “ho” method and others) can no longer be used from 2027-04-01.
- Hong Kong police announce 22 arrests in a group that used AI to put faces onto photos from lost ID cards, passed online identity checks and opened bank accounts.
- iProov’s test is published in MITRE ATLAS: on non-rooted Android, a virtual-camera app and face swap passed a liveness check.
- MIT Technology Review reports its investigation of 22 Telegram channels and groups.
Facts rest on MIT Technology Review’s investigation and on disclosures by FinCEN, the Japanese government, iProov and others. This is not one company’s incident but an investigation of a market in kits. The number of victims and success rates have not been disclosed.
After disclosure
- Telegram: Removed the channels and groups the reporter flagged for violating its terms. Similar ones remain.
- Binance: Said it had seen bypass attempts and prevented them, and that some services selling bypasses are themselves scams.
Why it wasn’t stopped
This case was not a failure of face-matching accuracy or of the kind of liveness prompt. Video reaching the app was taken to be shot live by a real camera, and its origin was never checked.
Video that reached the app was accepted as the person's face without checking it came from a real camera, live.
Proof works before the account opens; detection works after synthetic traces or fraudulent transactions surface. In between, the video received is treated as the live person.
The fake shows only after use
Detection is getting stronger. But detecting synthetic traces is a race against the tools that make them, and what it cannot tell apart gets through. “The video looks like the person” and “the video was taken live by a real camera” are separate facts, and the second cannot be checked from the video’s content; that distance is the detection–proof gap, and it is a structural one.
The same structure appears in the Hong Kong deepfake meeting fraud (a recording of familiar faces and voices became the grounds for a payment instruction).
How to counter this
Check where the video came from, not what it shows. Confirm, separately from the video, that the device and app are genuine and that the video arrived live from a real camera. In Japan, from April 2027 remote checks that send a photo image can no longer be used, and reading the My Number Card’s IC chip becomes the main method: regulation, too, is moving away from relying on how an image looks.
Industries and operations to watch
- IndustryFinance & FinTech
- Banks, crypto exchanges, payment apps and others that open accounts online. Accounts opened this way serve as mule accounts or to move money.
- OperationAccounts & permissions
- Opening accounts and registering new devices. Both use face video as proof of the person.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Face matching (against the ID photo) | Ineffective | Stolen or synthetic faces are prepared to match the document photo. |
| Movement prompts (turn head, blink) | Partial | They stop a plain recording, but synthetic video can respond to them. |
| Detecting synthetic traces | Partial | It stops what it can tell apart, but it is a race against the tools. |
| IC-chip reading, public certificate | Partial | Checks the person without relying on face video. Passes if the card and PIN are stolen together. |
- Check the video’s origin separately from the video. Use device attestation and similar means to check that the device and app are untampered and that the camera feed has not passed through a virtual camera or hooking. If that cannot be confirmed, do not pass the check however natural the video looks.
- Add checks that don’t rely on video. In Japan, move to IC-chip reading or the public certificate. Send applicants to extra checks on red flags such as wanting to switch communication methods mid-check, citing glitches.
- Record what was checked before letting it through. Keep the result of the origin check and the decision in a form that can later be shown to a third party: in other words, as proof.
Three things to confirm in your organisation about online identity checks
- Do you have a way to tell when ID-check video comes from a virtual camera?
- Do you have a plan to move off methods that rely on a photo image alone?
- If signs of fraud appear just after an account opens, such as large transactions in a short time, is there a procedure to redo the identity check?
Note: if the device itself is in the attacker’s hands, the origin check can be broken too. Tighter checks also mean more legitimate users giving up partway. The number of victims of these kits has not been disclosed; this Brief rests on the market’s existence and the technique shown in testing.
Sources
- Primary, original investigationMIT Technology Review “Cyberscammers are bypassing banks’ security with illicit tools sold on Telegram”
- Primary, alertUS Treasury FinCEN “FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions”
- Primary, government decisionJapan, Ministerial Council on Crime Control “Comprehensive measures to protect the public from fraud”
- Primary, regulationNational Police Agency JAFIC Order amending the Ordinance for Enforcement of the Act on Prevention of Transfer of Criminal Proceeds
- Primary, researcher’s own disclosureiProov “iProov Issues Annual Identity Verification Threat Intelligence Report”
- Primary, researcher’s own disclosureiProov “MITRE ATLAS Publishes Critical Vulnerability in the KYC Identity Process Discovered by iProov”
2 more (reporting, analysis)
- ReportingBiometric Update “KYC bypass tools sold on Telegram to defeat biometric checks”
- Reporting, Hong Kong police announcementThe Standard “Police dismantle AI-driven fraud syndicate, arresting 22”
References: “The last layer left for cyber defense in the age of AI”, “Proof-as-Auth: sign in without ever sending your key”