It happens at scale
Group-IB reported 8,065 AI deepfake injection attempts against a single financial institution’s KYC flow over eight months. That is one institution, and only the attempts that were identified.
Injected selfies and deepfakes: provenance, not pixels.
A deepfake injected through a virtual camera can look flawless. JERIX does not judge how the selfie looks. On iOS it checks that the frame was captured and signed on the device, and for a passport it checks the issuing state’s signature on the chip.
The attack moved from the lens to the feed.
Injection skips the camera entirely. The verification flow receives a stream that looks like a selfie and was never filmed.
It has reached Israel
On 21 June 2026, Calcalist reported a deepfake fraud case in Israel with roughly 120 victims. The full background is in deepfakes and remote identity.
Check where the capture came from.
Judging pixels is a race against image generators. A signature is not: it needs a key the attacker does not have.
A signed capture on iOS
On iOS, each frame is hashed and signed on the device with a single-use nonce and Apple App Attest. Frames from a virtual camera, a video file or a replay carry no valid signature, so they do not verify.
A forged passport fails the chip
The passport chip is signed by the issuing state. JERIX verifies that signature to the state’s national root, offline. A forged or altered passport fails, and a chip from an unknown issuer is refused.
The face is matched to the chip’s photo
The selfie is compared with the photo stored in the chip’s own signed data, not with a picture of the document that could have been edited.
Nothing left to fuel the next attempt
Images and biometrics are deleted once the check completes, so a breach cannot hand an attacker a gallery of real faces to train on. The tests behind each claim are on the security page.
How it works, in three steps.
The full verification flow is on the how it works page.
- 01
A single-use nonce
Each verification session starts with a nonce that is valid once. A capture from another session, or a second submission of the same one, is refused.
- 02
Signed on the device (iOS)
On iOS, every frame is hashed and signed on the device against that nonce, and Apple App Attest proves a genuine, unmodified app on real Apple hardware.
- 03
Verified, then deleted
The server checks the signed capture and, for a passport, the chip signature to the issuing state’s root. The images and biometrics are deleted once the check completes.
Questions about injection and deepfakes.
What is a virtual camera injection attack?
Instead of holding a face up to the camera, the attacker feeds the verification flow a video stream from software: a virtual camera, an emulator, a pre-recorded file or a generated deepfake. The picture can look perfect, because it never passed through a real lens.
Does JERIX detect deepfakes?
JERIX does not analyse the image to decide whether it is fake. It checks provenance. On iOS, a frame that did not come from the device’s own camera session carries no valid signature, so it does not verify. A forged passport has no valid chip signature, so it fails too.
Is the capture on Android signed the same way?
No. Android captures do not carry hardware attestation. The passport chip signature check and the match against the chip’s own photo apply on both platforms. If a flow requires device-level capture attestation, require iOS capture for that flow.
Can a recorded verification be replayed later?
Every session nonce is single-use, so a replayed submission is refused. On iOS, a capture manifest replayed into a second session fails its signature check.
See provenance checked, live.
We walk your team through a signed iOS capture, a replayed session and the passport chip check, step by step.
Book a demo