DEV Community: Garima Limaye

How Deepfake Fraud Is Changing Identity Verification in India

Garima Limaye — Mon, 19 Oct 2026 09:47:42 +0000

India’s rapid shift towards digital banking, online services and remote business transactions has made identity verification a routine part of everyday life. From opening a bank account to completing video KYC or authorising a financial transaction, organisations increasingly rely on digital methods to establish who a person claims to be.

However, artificial intelligence is changing the nature of this process. Deepfake technology can imitate a person’s face, voice and expressions with remarkable accuracy. Fraudsters can exploit these capabilities to impersonate genuine customers, bypass security checks and gain access to sensitive information.

As a result, identity verification in India is facing a new challenge. The question is no longer simply whether the information provided matches an identity document. Organisations must also determine whether the person presenting the information is genuine and whether the interaction itself has been manipulated.

What Is Deepfake Fraud in Identity Verification?

Deepfake fraud involves the use of AI generated or manipulated audio, video or images to impersonate another person. Criminals may create a synthetic face, reproduce someone's voice or alter a video recording to make a false identity appear authentic.

These techniques can target digital onboarding systems, video based identity checks, voice authentication tools and customer support processes. For example, a fraudster may use a manipulated video during a remote verification session to impersonate a genuine customer.

Voice cloning creates another risk. An attacker may reproduce a customer's or senior executive's voice and use it to request account access, authorise a transaction or persuade an employee to disclose confidential information.

The growing accessibility of generative AI tools makes these attacks harder to dismiss as isolated technical incidents. Organisations must now consider the possibility of deliberate impersonation even when an interaction appears convincing.

Why Traditional Identity Verification Methods Are Becoming Less Reliable

Traditional verification methods often depend on matching identity documents with a photograph, checking personal information or confirming a person's presence during a video call. These controls remain important, but each has limitations when used alone.

A genuine identity document does not prove the identity of the person presenting it. Similarly, a video call may show a convincing face without establishing whether the footage is live, manipulated or generated using AI.

Voice authentication also faces new challenges. A familiar voice may previously have provided a useful additional check, particularly in telephone banking or customer support. However, convincing voice cloning makes this approach less dependable as a standalone security measure.

This does not mean existing verification systems have become obsolete. Rather, organisations need to strengthen them through independent checks, secure technical controls and risk based assessments.

How Deepfake Fraud Is Affecting Digital KYC in India

Know Your Customer, commonly known as KYC, is an important part of India's regulated financial system. Banks and other regulated entities must follow applicable identification and verification requirements to establish customer identity and manage risks associated with money laundering and financial crime.

Digital onboarding has improved convenience by reducing the need for physical paperwork and in person visits. Video based customer identification can also help organisations serve customers across different locations.

However, deepfake technology introduces new vulnerabilities into these processes. A manipulated video may attempt to deceive a verification officer, while synthetic images or stolen identity documents may be used together to create a more convincing false identity.

Financial institutions therefore need to assess whether their verification procedures can detect suspicious activity beyond basic document matching. Liveness detection, device and session risk analysis, independent verification signals and human review of unusual cases can strengthen the process.

The Reserve Bank of India's Know Your Customer framework provides the regulatory foundation for customer identification by regulated entities. Its requirements must be read alongside applicable amendments and sector specific directions. Deepfake detection should support these obligations rather than replace prescribed KYC procedures.

The Business Risks Extend Beyond Banking

Although financial services are an obvious target, deepfake fraud can affect businesses across several sectors.

In recruitment, an applicant may use manipulated video or audio to misrepresent their identity or qualifications during a remote interview. In corporate finance, a fabricated voice message from a director may persuade an employee to transfer funds or change supplier payment details.

Insurance companies may face manipulated evidence during claims assessment, while online marketplaces may encounter impersonation attempts involving sellers, buyers or account holders. Digital service providers may also face attempts to gain access to customer accounts through synthetic identities.

These incidents can lead to financial losses, data exposure, operational disruption and reputational damage. They may also raise questions about whether an organisation's verification procedures were appropriate for the level of risk involved.

Businesses should therefore treat identity verification as an ongoing security responsibility rather than a single check completed at the beginning of a customer relationship.

What Legal Frameworks Apply to Deepfake Fraud in India?

India addresses different aspects of identity fraud through existing criminal and information technology laws. The precise provisions applicable to a deepfake incident depend on the conduct involved, the evidence available and the harm caused.

Section 66C of the Information Technology Act, 2000 addresses identity theft involving the fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature. Section 66D addresses cheating by personation using a communication device or computer resource.

The Bharatiya Nyaya Sanhita, 2023 may also apply where the facts establish offences such as cheating by personation or forgery. For instance, Section 319 addresses cheating by personation, while Section 336 deals with forgery, subject to the requirements of the relevant provisions.

Not every AI generated image or manipulated video automatically constitutes a criminal offence. Investigators must examine the purpose, method of creation, use of the content and surrounding circumstances.

Organisations should also consider applicable data protection obligations, contractual duties and sector specific regulatory requirements. Where a cybersecurity incident falls within the categories covered by the Indian Computer Emergency Response Team's directions, the relevant reporting requirements must be assessed promptly.

Seeking [cybersecurity legal advice services] can help businesses evaluate potential exposure, review identity verification policies, assess applicable reporting obligations and develop procedures for responding to suspected impersonation or data breaches.

How Can Organisations Strengthen Identity Verification?

Effective protection requires multiple layers of security. Organisations should avoid relying exclusively on facial recognition, voice matching or visual inspection. Instead, they should combine appropriate technical safeguards with independent verification procedures.

For high risk transactions, a request should be confirmed through a separate, trusted channel. For example, a change to bank account details should require verification using previously established contact information rather than details supplied in the request itself.

Businesses should also consider whether their technology providers can identify synthetic media, monitor suspicious login behaviour and flag unusual device or session activity. Detection tools require careful evaluation because no single system can identify every deepfake accurately.

Employee awareness is equally important. Staff should understand how impersonation attempts work and feel comfortable questioning unusual instructions, even when they appear to come from senior management.

Organisations must also maintain a clear incident response process. If fraudulent verification is suspected, relevant logs, original recordings, transaction records and communications should be preserved. Early action may help limit financial losses and support subsequent investigation.

Where identity fraud has caused financial harm or involved deliberate impersonation, [criminal lawyers for identity fraud]can assist in assessing the available legal remedies, preparing a complaint and understanding the criminal investigation process.

The Future of Identity Verification in India

Identity verification is likely to become more sophisticated as AI driven fraud develops. Organisations may increasingly combine document verification, liveness checks, behavioural analysis, device intelligence and independent authentication methods.

However, stronger security must not come at the expense of privacy, accessibility or legitimate customer access. Verification systems should collect only appropriate information, apply proportionate checks and provide a route for genuine users who are incorrectly flagged.

Businesses must also review their systems regularly. A verification process which performed adequately against earlier fraud methods may become less effective as attackers adopt new techniques.

Conclusion

Deepfake fraud is changing identity verification in India by challenging the assumption that a convincing face, familiar voice or matching identity document is sufficient proof of authenticity. Digital onboarding and remote transactions remain valuable, but they require stronger safeguards against sophisticated impersonation.

For businesses and financial institutions, the priority should be a layered verification process supported by appropriate technology, independent confirmation, employee awareness and clear incident response procedures. Legal compliance and evidence preservation must form part of this approach.

As synthetic media continues to evolve, trust in digital transactions will depend less on appearances and more on reliable verification. Organisations which adapt their security controls and legal response frameworks will be better placed to protect customers, reduce fraud and maintain confidence in India's digital economy.

Why Deepfakes Are Becoming a Serious Corporate Security Concern

Garima Limaye — Mon, 19 Oct 2026 09:38:09 +0000

Artificial intelligence has changed how businesses communicate, verify information and make decisions. However, it has also created a new security challenge. Deepfakes can imitate a person's face, voice or manner of speaking with convincing accuracy. For companies, this technology creates risks extending beyond misinformation to financial fraud, data theft, reputational damage and legal liability.

A fraudulent video call from a senior executive or a voice message appearing to come from a trusted supplier may be enough to persuade an employee to transfer funds or disclose confidential information. As synthetic media becomes easier to produce, businesses can no longer rely on familiar voices and recognisable faces as proof of identity.

Understanding how deepfakes operate, where corporate vulnerabilities arise and what legal safeguards are available has become an important part of modern risk management.

What Are Deepfakes and How Do They Work?

Deepfakes are digitally generated or manipulated images, audio recordings and videos created using artificial intelligence. They can reproduce a person's appearance, voice and expressions, making fabricated content appear authentic.

The technology can serve legitimate purposes, including film production, training and accessibility. The concern arises when it is used to impersonate individuals, manipulate business communications or facilitate fraud.

Attackers may use publicly available interviews, corporate videos, webinars and social media recordings to create convincing imitations of executives or employees. They can then use these materials in emails, video meetings or voice calls designed to exploit trust and prompt immediate action.

Traditional phishing attacks often rely on suspicious links or poorly written messages. Deepfake enabled attacks can appear far more credible because they imitate familiar people and established working relationships.

Why Are Deepfakes a Growing Threat to Corporate Security?

Financial Fraud and Executive Impersonation

One of the most serious risks is the impersonation of senior executives, finance directors or business partners. An employee may receive a voice note or join a video meeting in which an apparent senior officer requests an urgent payment, a change to supplier bank details or access to sensitive financial information.

Such requests often rely on pressure and confidentiality. Employees may feel reluctant to question instructions from senior management, particularly during a transaction presented as urgent.

The danger is not limited to large corporations. Small and medium sized businesses may have fewer verification controls, allowing a convincing impersonation to bypass routine checks.

Corporate Data Theft and Unauthorised Access

Deepfakes can also support social engineering attacks designed to obtain passwords, verification codes, confidential documents or access to internal systems. An attacker posing as an IT administrator or trusted service provider may persuade an employee to disclose information or approve an access request.

Once inside a corporate network, a criminal may attempt to access customer records, financial information, intellectual property or commercially sensitive communications.

This makes deepfakes more than a problem of misleading content. They can become the entry point for wider cyber incidents, particularly when organisations depend heavily on remote communication and digital identity verification.

Reputational Damage and Loss of Trust

A fabricated video of a chief executive making controversial statements or announcing false business decisions can spread quickly across social media and messaging platforms. Even after the content is disproved, the company may face customer concern, investor uncertainty and difficult questions from business partners.

The risk is particularly significant for listed companies and businesses operating in regulated sectors. False announcements may affect market perceptions, disrupt operations and place additional pressure on investor relations teams.

Organisations must therefore consider how they will verify public statements, respond to manipulated media and communicate credible information during a developing incident.

How Can Businesses Identify and Prevent Deepfake Attacks?

Visual inspection alone is not a reliable safeguard. Some manipulated recordings contain unusual facial movements, inconsistent lighting or unnatural speech patterns, but more sophisticated examples may show few obvious signs of alteration.

Businesses should instead build verification into their normal operating procedures. Financial transfers, changes to payment instructions and requests for sensitive information should require independent confirmation through a trusted communication channel. A telephone number supplied during a suspicious call should not be treated as independent verification.

Multi factor authentication, restricted access permissions and clear approval hierarchies can further reduce exposure. Organisations should also train employees to question unusual requests, even when they appear to come from senior colleagues.

Technical detection tools may help identify synthetic media, but they should form only one part of a broader security framework. Detection systems can produce false results, and attackers continually adapt their methods.

A written incident response plan is equally important. It should establish who investigates suspicious communications, who can authorise account restrictions and how evidence will be preserved. Regular simulations can help employees practise responding to realistic impersonation attempts without creating unnecessary disruption.

What Is the Legal Position on Deepfake Fraud in India?

India does not rely on a single law to address every deepfake related offence. The applicable legal provisions depend on the conduct involved, the harm caused and the evidence available.

The Information Technology Act, 2000 contains provisions relevant to certain forms of identity theft, including Section 66C, and cheating by personation using a computer resource, under Section 66D. Depending on the circumstances, other provisions may apply to privacy violations or unlawful digital content.

The Bharatiya Nyaya Sanhita, 2023 may also be relevant where the conduct involves cheating, forgery related offences or other criminal activity. The precise charges depend on the facts and the legal requirements of each offence. A manipulated recording does not automatically establish every element of a criminal offence.

For businesses, the legal response should address both the underlying fraud and any associated data breach, misuse of confidential information or unlawful publication. Organisations should review applicable contractual obligations, regulatory requirements and incident reporting duties.

The Indian Computer Emergency Response Team (CERT In) has issued directions under Section 70B of the Information Technology Act concerning specified cybersecurity incidents. These directions include reporting requirements for covered entities and incidents, with a prescribed reporting timeline for applicable cases. Businesses should assess whether an incident falls within the relevant categories rather than assuming every deepfake automatically triggers the same reporting obligation.

Early advice from cybersecurity lawyers for businesses can help organisations assess potential legal exposure, preserve relevant evidence, evaluate reporting duties and coordinate an appropriate response. Legal advice should complement technical investigation rather than replace it.

What Should a Company Do After a Deepfake Incident?

The first priority is to prevent further harm. If a suspected impersonation has led to a payment, the company should contact its bank immediately and follow its fraud response procedures. If accounts or systems may have been compromised, access should be secured while the incident is investigated.

Evidence preservation is essential. Businesses should retain original messages, email headers, call records, transaction details, relevant system logs and available copies of the suspected recording. Screenshots may help document an incident, but they should not replace original digital files where these are available.

Records should be handled carefully to maintain their integrity and support subsequent investigation. Organisations should avoid publicly accusing an individual or circulating manipulated content unnecessarily before the facts have been established.

Where criminal conduct is suspected, reporting to the appropriate authorities may be necessary. criminal lawyers for fraud cases can assist with assessing potential offences, preparing relevant documentation and navigating the criminal complaint process.

Communication also matters. Employees, customers and business partners may need clear instructions on verifying genuine messages or recognising fraudulent requests. Public statements should be accurate, measured and consistent with the facts established during the investigation.

Why Deepfake Preparedness Must Become a Boardroom Priority

Deepfakes expose a weakness in conventional corporate security: people often trust what they can see and hear. As synthetic media becomes more convincing, organisations must strengthen the processes used to verify identity, approve transactions and protect sensitive information.

Responsibility should not rest solely with the IT department. Senior management, finance teams, human resources, legal advisers and communications professionals all have a role in reducing the risk. Regular risk assessments should consider how attackers could exploit executive impersonation, supplier relationships and remote working arrangements.

Deepfakes are unlikely to disappear as artificial intelligence develops. Businesses that combine technical safeguards, employee awareness, independent verification and sound legal planning will be better positioned to manage the threat.

The objective is not to distrust every digital interaction. It is to ensure that important corporate decisions are supported by reliable verification, documented controls and a clear response plan when something goes wrong.

How India’s New Criminal Laws Are Changing Police Investigations

Garima Limaye — Thu, 15 Oct 2026 10:32:56 +0000

India’s criminal justice system has undergone a significant transformation with the introduction of three new criminal laws, which came into force on 1 July 2024. The Bharatiya Nyaya Sanhita, 2023 (BNS), the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), and the Bharatiya Sakshya Adhiniyam, 2023 (BSA) have replaced the Indian Penal Code, 1860, the Code of Criminal Procedure, 1973, and the Indian Evidence Act, 1872, respectively, subject to applicable savings and transitional provisions.

The reforms aim to modernise criminal law, improve investigative procedures, strengthen the use of technology, and make criminal proceedings more responsive to contemporary challenges. For police officers, investigating agencies, accused persons, and victims, the changes affect how complaints are recorded, evidence is collected, suspects are examined, and cases progress through the justice system.

Understanding these changes is essential to appreciating how criminal investigations in India are evolving.

Understanding the Three New Criminal Laws

The three statutes serve different but interconnected purposes. The Bharatiya Nyaya Sanhita defines criminal offences and their punishments. The Bharatiya Nagarik Suraksha Sanhita governs criminal procedure, including the registration of cases, police investigations, arrests, and court proceedings. The Bharatiya Sakshya Adhiniyam deals with the admissibility and evaluation of evidence in judicial proceedings.

For police investigations, the BNSS is particularly significant because it introduces procedural changes, while the BSA provides a framework for handling electronic and digital evidence. The BNS also affects investigative priorities by introducing and reorganising offences and penalties.

Together, these laws seek to create a criminal justice framework suited to modern India. Their practical impact, however, depends on effective implementation, adequate training, forensic capacity, and compliance with constitutional safeguards.

1. Greater Emphasis on Digital Registration of Complaints

One of the notable changes under the BNSS is the formal recognition of electronic communication in reporting offences. Section 173 permits information relating to a cognisable offence to be given orally or by electronic communication, irrespective of where the offence occurred, subject to the statutory requirements.

This supports the concept commonly known as a Zero FIR, allowing information about a cognisable offence to be recorded without initially restricting the complainant to the police station having territorial jurisdiction. The case can subsequently be transferred to the appropriate police station for investigation.

Where information is provided electronically, it must be signed by the person giving it within three days. The law also contains specific safeguards concerning the recording of information in certain offences against women.

These provisions can reduce procedural obstacles for complainants, particularly those reporting offences from another city or using digital channels. They also place greater responsibility on police stations to maintain accurate records, verify information, and ensure timely transfer of cases.

Electronic reporting does not remove the need for proper investigation. Police officers must still establish the facts, preserve relevant evidence, and follow the applicable legal procedure.

2. Forensic Investigation Becomes More Important

Scientific investigation is a central feature of the reforms. Section 176(3) of the BNSS provides for forensic experts to visit crime scenes and collect forensic evidence for offences punishable with imprisonment of seven years or more, subject to implementation by the State Government and the applicable commencement arrangements specified in the provision.

The requirement is intended to improve the collection and preservation of scientific evidence. Depending on the nature of the alleged offence, investigators may need to consider fingerprints, DNA samples, biological traces, digital devices, CCTV recordings, and other material capable of supporting or contradicting witness accounts.

Greater reliance on forensic evidence can help investigators reconstruct events more objectively. It can also expose weaknesses in a prosecution case when physical evidence does not support the initial allegations.

However, forensic evidence is only as reliable as the process used to collect, document, store, and analyse it. Contamination, inadequate laboratory facilities, delays in testing, and gaps in the chain of custody can undermine its evidentiary value. Police training and investment in forensic infrastructure will therefore be crucial to achieving the intended results.

3. Digital Evidence Gains Greater Legal Recognition

Modern investigations frequently involve mobile phones, emails, messaging applications, social media accounts, surveillance footage, and financial transaction records. The Bharatiya Sakshya Adhiniyam expressly addresses electronic and digital records within the law of evidence.

This development is particularly relevant to cybercrime, financial fraud, online harassment, corporate misconduct, and other offences involving electronic communications or digitally stored information.

Investigators must do more than obtain screenshots or printouts. They may need to secure original devices, preserve relevant metadata, establish the source and integrity of records, and comply with the applicable statutory requirements for proving electronic evidence in court.

For example, an investigation into an online financial fraud may involve bank transaction records, IP logs, device data, email communications, and records obtained from intermediaries. Each item must be assessed in context and connected to the alleged offence through a legally sustainable evidentiary process.

The increased importance of digital evidence also makes technical expertise essential. A failure to preserve data correctly or establish its authenticity may weaken an otherwise substantial investigation.

4. Changes to Arrest, Custody and Police Remand

The BNSS also changes the procedural framework governing police custody and remand. Section 187 allows police custody, where authorised by the Magistrate, for a period not exceeding fifteen days in total, which may be authorised in whole or in parts during the initial forty days or sixty days of the applicable sixty day or ninety day detention period, depending on the offence.

This provision differs from the earlier framework under the Code of Criminal Procedure, where the timing of police custody was more restricted. The change gives investigators greater procedural flexibility, but it does not create an unrestricted power to detain an accused person.

Every remand remains subject to judicial authorisation and the statutory conditions. Constitutional protections, including the right to legal representation and safeguards against unlawful detention, continue to apply. Investigators must justify the need for custody rather than treat it as an automatic step in every criminal case.

For individuals facing arrest or questioning, understanding the applicable procedure can be important to protecting their rights. Seeking timely advice from the best criminal lawyer may help an accused person understand the grounds of arrest, the remand process, and the available legal remedies.

5. Greater Focus on Timelines and Accountability

The new procedural framework introduces or specifies timelines for several stages of criminal proceedings. These include requirements relating to investigation, reporting, and the progress of cases, although the applicable period depends on the nature of the offence and the particular statutory provision.

For certain sexual offences against women and offences under the Protection of Children from Sexual Offences Act, the BNSS prescribes a two month period for completing the investigation, as specified in Section 193. The provision also addresses communication of investigation progress to the informant or victim within ninety days.

Such requirements can encourage more structured case management and improve communication with victims. They also require investigating officers to organise evidence collection, witness examination, forensic requests, and reporting more efficiently.

However, statutory deadlines do not guarantee a quick or successful prosecution. Complex investigations may involve multiple jurisdictions, large volumes of electronic data, overseas evidence requests, or delays in forensic analysis. Meeting deadlines must not come at the expense of accuracy, fairness, or a thorough examination of the evidence.

6. Implications for White Collar Crime Investigations

Corporate fraud, money laundering related offences, cybercrime, and financial misconduct often require investigators to examine transactions, company records, communications, and complex digital trails. The new laws reinforce the importance of evidence management and procedural compliance in such cases.

Investigations may involve material obtained from banks, companies, digital platforms, and other third parties. Investigators must establish the relevance of each record, preserve its integrity, and connect the material to the alleged offence. The applicable special legislation, such as the Prevention of Money Laundering Act, 2002, may also govern specific aspects of an investigation.

For businesses and individuals facing allegations, early legal assessment can help identify procedural issues, preserve relevant records, and ensure appropriate responses to investigative notices. A white collar crime defense lawyer may assist in evaluating the allegations, advising on cooperation with investigative agencies, and protecting the client's legal rights throughout the process.

The new criminal laws do not replace the separate statutory requirements applicable to specialised offences. Investigators and defence teams must consider the relevant legislation together rather than rely on the BNSS, BNS, or BSA in isolation.

7. Challenges in Implementing the New Framework

Legislative reform is only one part of improving criminal investigations. Police departments must adapt their procedures, train officers, strengthen forensic capacity, and ensure reliable digital infrastructure. The transition also requires coordination between police stations, laboratories, prosecutors, and courts.

The Ministry of Home Affairs has reported training initiatives and the development of digital applications to support implementation. Even so, practical outcomes will depend on consistent adoption across States and Union Territories, where resources and investigative capabilities may vary.

There is also a continuing need to balance investigative efficiency with individual rights. Stronger technological capabilities must be accompanied by lawful evidence collection, appropriate safeguards for personal data, and meaningful judicial oversight.

Conclusion

India's new criminal laws are changing police investigations by placing greater emphasis on electronic reporting, forensic examination, digital evidence, procedural timelines, and structured case management. They provide investigators with an updated legal framework for addressing both traditional offences and crimes involving modern technology.

Their success will depend on more than statutory changes. Effective training, sound forensic practices, transparent procedures, and respect for constitutional protections remain essential to fair and credible investigations.

For citizens, businesses, and legal professionals, understanding the new framework is increasingly important. As courts interpret the provisions and investigative practices develop, the practical impact of these reforms will become clearer. The central challenge is to ensure the law delivers not merely faster investigations, but also accurate findings, fair procedures, and justice consistent with the rule of law.