Estimated reading time: 7 minutes
Identity verification firm Shufti projects document deepfakes will rise about 40-fold this year. That would make fake documents about four in five of the AI fraud attempts it blocks. I asked CTO Faryam Asif what sits behind the number.
Document deepfakes are the fastest-growing type of AI fraud that Shufti blocks. They are identity documents created or altered with AI to pass online checks. Shufti projects they will rise 3,892% in 2026 over 2025, roughly 40 times. It projects a 495% rise across all four AI attack types it tracks, close to sixfold.
Both figures annualize data from January to May. Shufti labels them estimates. It published them in its Deepfake Identity Fraud Index 2026. Shufti sells identity verification and deepfake detection for remote customer onboarding. Its report draws on more than one million fraud attempts across its verification network. It closes by describing how Shufti’s own products catch each attack type.
Document Deepfakes Drive Most Of The Projected Rise
In 2025, synthetic identities made up 42.3% of the AI fraud attempts Shufti recorded. Live video deepfakes made up 28.1%, face swaps 17.6%, and document deepfakes 11.9%.
Combining Shufti’s two projections shows where the growth comes from. Start with document deepfakes at 11.9% of 2025 attempts. Grow them 40-fold and the total sixfold, and they become about four in five attempts in 2026. The other three types combined would grow by about 36%. That is a Cyber Insurance News calculation from Shufti’s published figures.
Shufti confirmed the calculation when I asked. “Your calculations align with the figures in our report,” Asif said by email. The figures are “projections based on fraud attempts observed across our verification network, rather than confirmed full-year 2026 results,” he added.
Shufti’s pitch made the same point more simply. The fastest-growing category, it said, “never needs a live face.” The fraud sits in the ID itself.
What The Document Deepfake Figures Leave Out
I asked Asif for the raw numbers behind the 40-fold projection. I also asked whether it holds after accounting for verification volumes, customer mix, and detection changes.
“The report shows the growth rates and trends rather than the exact number of document deepfake attempts,” Asif said in written answers to my questions.
“It’s also important to note that the report doesn’t establish whether this growth would remain the same after accounting for changes in verification volumes, customer profiles, industry mix, or detection capabilities,” he said.
That caveat matters most. Shufti counts the attacks it catches. More customers, riskier sectors, or another detector could each push the count up. Shufti also began tracking synthetic identities and face swaps as distinct categories only in 2025, its report says.
The report also left the video figures unclear. It says 2026 data for live video deepfakes is not yet annualized, but the 495% covers all four types. Shufti told me the 495% includes video and is annualized across the combined data. The report’s video-only chart stops at 2025. “We acknowledge that this distinction could have been clearer in the report, and we are updating the methodology note to explain it,” Zahra said.
Asif still reads the data as a warning. “The figures point to a concerning trend in document deepfake fraud,” he said.
Deepfake Identity Fraud And The Missing Claims Link
Shufti’s figures count blocked attempts. I asked whether Shufti had linked document deepfakes or synthetic identities to any cyber insurance claim.
“No, the report doesn’t link the fraud attempts detected to any cyber insurance claims,” Asif said. “Blocking an attempt shows that a security control caught a potential threat, but it doesn’t tell us whether the attack would have succeeded or resulted in a financial loss.”
He could not share an anonymized example of a loss. The report holds no verified losses or case details, he said. Publishing a real case would need a separate incident review and the client’s consent.
Gartner’s survey of CISOs on deepfake calls had the same limit. A detected attempt counted alongside a successful one, as Cyber Insurance News reported. Insurers’ own disclosures are quieter still. A review of 76 filings from 49 insurers and reinsurers found no mention of synthetic identity.
Liveness Checks And Synthetic Identity Fraud
Shufti’s pitch argued that the industry’s focus on liveness may have left the document layer under-defended. Liveness checks test whether a real person is in front of the camera.
I asked Asif for a case where an attacker passed liveness checks with a fabricated identity. “The report doesn’t include a confirmed case of an attacker passing liveness checks with a fabricated identity,” he said.
He described the gap in principle. “A liveness check can help establish that a face is present during verification, but it doesn’t confirm that the document is genuine or that the identity belongs to the person presenting it.”
The answer, he said, is layers. Document checks look for tampering. Facial matching compares the face with the photo on the document. Injection-attack detection catches manipulated video fed straight into the process. Device intelligence and checks against trusted identity databases add more signals.
Shufti’s report says manual review is “no longer a reliable backstop” against high-quality deepfakes. Mike Nelson, field CTO at DigiCert, made a similar point on the Cyber Insurance News podcast. “Human eyes are no longer good enough to detect modification and changes,” he said.
What Underwriters Should Ask About Identity Verification
I asked which verification controls insurers should scrutinize, and what evidence shows they work. Shufti sells several of the controls on his list.
Asif named document authenticity checks, facial matching, liveness detection, and protection against presentation and injection attacks. He added device intelligence, behavioral monitoring, repeat-identity detection and how suspicious applications get flagged for review.
“Just having these controls in place isn’t enough. Insurers need evidence that they actually work,” he said.
That evidence includes false-acceptance and false-rejection rates, as well as independent test results, he said. Underwriters should also ask how much fraud gets caught before onboarding, and how much surfaces after approval.
“This gives insurers a clearer picture of whether an [organisation’s] verification controls are genuinely helping prevent fraud or are simply in place on paper,” he said.
The gap between paper and practice is familiar. Lastwall’s Julien Richard raised it on the Cyber Insurance News podcast. He described a control present on the application form and absent at the moment of loss.
The wider direction has backing beyond Shufti’s network. In March, INTERPOL Secretary General Valdecy Urquiza said: “We are witnessing the industrialization of fraud.” INTERPOL found AI-enhanced fraud 4.5 times more profitable than traditional methods.
Shufti’s full-year data will show whether document deepfakes keep that pace. Until then, underwriters have Asif’s questions to ask.
Get Our Podcast
On the CINI podcast: Identity fraud runs on personal data. Marketing teams hold a lot of it. Graylog CMO Kimber Spradlin explains why the whole profile matters more than any single piece. Listen to the episode
FAQ – Document Deepfakes
What are document deepfakes?
Identity documents created or altered with AI to get past online identity verification during customer onboarding.
How fast are document deepfakes growing?
Shufti projects a 3,892 percent rise in 2026 over 2025, about 40-fold. The estimate annualizes data from January to May 2026.
What is a synthetic identity?
A fabricated persona with no real-world counterpart. Synthetic identities were the largest AI fraud type in Shufti’s 2025 data, at 42.3 percent.
Do Shufti’s figures show fraud losses?
No. They count fraud attempts Shufti blocked. CTO Faryam Asif says the report does not link them to cyber insurance claims or verified losses.
Why is a liveness check not enough on its own?
A liveness check helps show a real face is present. Asif says it does not confirm the document is genuine or belongs to the person presenting it.
What should insurers ask about identity verification?
Which controls are in place, their false-acceptance and false-rejection rates, independent test results, and how much fraud is caught before onboarding versus after approval.
Related Cyber Insurance Posts
- Marketing Runs On Customer Data. That Puts Every CMO In The Security Business.
- Cyber Incident Response Plan: Reasons It Fails & How to Fix It(Opens in a new browser tab)
- Cyber Insurers Grapple with AI Deepfakes(Opens in a new browser tab)
- Payment Fraud Controls Have To Work When Nobody Notices Anything Wrong(Opens in a new browser tab)
- Insurers Ranked The Controls That Work. Staff Training Came First.(Opens in a new browser tab)