In early 2024, a finance worker at the engineering firm Arup joined what looked like a routine video call with the company’s Chief Financial Officer and several colleagues. The faces were familiar and the request was straightforward. Over the following days the employee arranged transfers of roughly $25 million. None of the people on the call were real. Every face and voice had been produced by artificial intelligence.
The Arup fraud drew attention for its size, but the method behind it has become routine. Banks across the Middle East and elsewhere now face a steady, smaller-scale version of the same threat. The tools they rely on to confirm who is on the other end of a transaction were not designed for a world in which a believable human face can be created on demand. Identity, rather than the network or the database, has become the most exposed part of a modern bank.
Consider how differently a bank handles the same customer in two settings. Walk into a branch to move a large sum and a teller compares the identification with the face, registers that a real person is present, and verifies it on camera with colleagues within earshot. Carry out the same transaction in the bank’s app and, until recently, the whole process came down to a password and a code sent by text. For 20 years the industry treated a digital transaction as deserving a lower standard of proof than one conducted in person. That assumption has become the gap through which fraud now travels.
The technique has shifted in a way many banks have not registered. Early deepfake attacks presented a fabricated image to a device’s camera, and software was trained to detect them. Newer attacks bypass the camera altogether, injecting a synthetic video stream directly into the application so that no genuine image is ever captured. The useful question is no longer only whether a face matches the one on record. It is also whether the face on the screen belongs to a living person who is actually present.
Newer attacks don’t fool the camera – they bypass it
Most fraud succeeds not by overpowering a bank’s strongest control but by slipping between two controls that do not communicate. Account recovery is the familiar example. A bank can run advanced biometric login and still hand an account to a caller who fails that login, reaches a help desk, and is cleared on a date of birth and a utility bill. The login was never the vulnerability. The procedure beside it was.
A similar blind spot divides a bank’s physical and digital defences, which in most institutions are managed by separate teams that seldom share information. If an employee’s badge records them entering headquarters at nine in the morning, and their credentials approve a large overseas transfer a few minutes later, neither system sees anything wrong on its own. Placed side by side, the two records describe something impossible. Comparing signals across the physical and digital worlds catches fraud that either system would miss alone, and few banks have begun to do it.
Don’t trust the vendor
None of this amounts to a case for simply buying more biometric technology; banks understand its value already. The harder task is distinguishing a system that genuinely withstands a manufactured attack from one that only claims to. As someone whose company builds these systems, I would urge buyers to trust no vendor’s assurances, including ours. Independent laboratories now test identity software against live impersonation and injection attacks and publish measured results. A supplier unable to point to that kind of outside verification is requesting faith rather than offering evidence.
Regulators have reached the same view. Authorities in the United Arab Emirates and Saudi Arabia have started requiring banks to move away from text-message codes towards stronger methods, for their own staff as much as for customers.
Underneath the technology sits a very old question, the one a teller answers every time someone steps up to the counter: Is this person who they say they are? Banks could once take the answer for granted. They no longer can. The institutions that come through the next few years intact will be the ones that decided their app deserved the same scrutiny as their front desk, and built the two to work as one. The alternative is a banking system full of customers and staff who, like the employee at Arup, are sure they are in good company when in fact they are entirely alone.
About the author
Rodolphe Hugel is Head of Smart Connect at Smart Biometrics, IDEMIA Public Security, which has spent decades building the biometric and identity systems used by governments and financial institutions around the world. The company works with banks across the Middle East on the questions raised here. www.idemia.com
