How adding a custom computer vision layer to the existing SaaS ID verification platform empowered a Dutch digital bank to keep up with the evolving threat landscape and stop 30% more AI-generated identity fraud, while reducing false positives for real users by 60% and decreasing manual document review workload by 40%.
When GenAI emerged as a viable tech capability, businesses weren’t the only ones who went for it. So did cybercriminals who used the technology to create highly realistic deepfakes and pass Know Your Customer (KYC) onboarding at digital banks. Since the mass adoption of artificial intelligence, the number of AI-generated identity fraud cases in fintech has increased by 2137%. Now, 1 in 15 attacks involves deepfakes, and 29% of them succeed.
Our client, a Netherlands-based digital bank serving customers across the European Economic Area, chose to be one step ahead of fraudsters. As the bank onboards 4-5 million new users annually, they must protect real customers from account takeover, not to mention safeguarding brand trust in a highly competitive digital banking market.
At the time, the client relied on a third-party SaaS identity verification (IDV) platform with OCR and NFC/RFID technologies at its core, which fell short on several fronts:
For a bank operating at a multi-million-user scale, the gap between their needs and software capabilities posed significant financial and reputational risk. They needed a tech partner with proven expertise in finance to address the issue.
Instinctools’ dedicated team looked into ways to strengthen the client’s identity verification algorithm. Investing in a custom computer vision-based deepfake detection to run alongside the SaaS IDV proved to be the most beneficial option, as it enabled hotfixes and retraining on confirmed internal fraud cases within days.
Our computer vision experts took full ownership of the system’s design, training, calibration, and production rollout.
The effectiveness of the custom CV detection mechanism hinged on the quality of the training data. Generic examples of ID fraud, that the off-the-shelf IDV platform had covered, were not enough. Therefore, our team prioritized assembling a solid dataset.
What is YOLO?
YOLO (You Only Look Once) is a computer vision object detection model. It’s an example of a leading-edge single-stage detector, known for its ability to locate and classify objects in a single pass through the network and, therefore, a go-to option for real-time object detection.
Our team built the solution around a single, well-controlled YOLO-based computer vision pipeline, tailored for identity document analysis. The model excels at:
This approach ensured consistency while keeping inference fast enough for real-time KYC flows.
The test dataset included:
This approach ensured the detection logic wasn’t tied to a specific deepfake tool or editing technique, but rather to the visual inconsistencies that tend to appear across AI-generated and manipulated documents, so the custom CV system remains effective even if fraudsters switch to new image generators.
One of the key challenges with the SaaS IDV platform was the sensitivity of its fraud calibrator, which sometimes caused it to reject legitimate customers due to minor issues (like glare in a photo) while overlooking more serious fraud attempts. To address this problem, we linked the decision thresholds to the risk scores.
The custom CV layer now follows a tiered decision logic:
This approach helped the client strengthen fraud controls and decrease the workload of human reviewers while ensuring fast onboarding for legitimate users.
To keep the onboarding experience unchanged for customers, we deployed the custom computer vision system as a decision microservice within the existing onboarding pipeline.
Still, before letting it influence real onboarding decisions, the team ran the custom CV system in observation mode. At this stage, it processed live KYC traffic alongside the existing systems, but its outputs were not used to approve or reject customers.
Once we validated that the model behaved as expected with real-world data, we rolled it out gradually by feeding it controlled portions of traffic, expanding coverage step by step. This phased approach ensured that the new detection layer strengthened fraud controls without unintended consequences, such as over-flagging legitimate users or missing edge cases.
Here’s how the client’s updated KYC flow works:
Since all checks run behind the scenes and in parallel, customer experience stays the same, with no extra waiting time or redundant requests. Meanwhile, under the hood, confirmed fraud cases are auto-labeled and folded into retraining cycles within days, enabling hotfixes. As a result, deepfake document detection had shifted from a static vendor capability to a living, bank-owned system evolving at the same pace as the threat landscape.
What matters most to us is staying ahead of a threat that is changing faster than traditional controls can keep up with. The *instinctools team treated this challenge as a risk management problem, not just a technology exercise, and that approach was reflected in how safely the solution was introduced into production. We now have stronger document checks, clearer signals for our fraud teams, and the confidence that we can respond quickly as new attack patterns emerge.
Computer vision threat detection use cases extend far beyond digital banking. Any company that relies on document checks or user verification, from insurance and healthcare to travel and ecommerce, faces the same growing risk from AI-generated identities and forged documents. A custom computer vision system trained on real-world fraud patterns can help businesses react faster than when relying on generic vendor tools.
