Bank Account Recovery Deepfake Detection Controls: Securing Resets and Profile Changes

Why Attackers Use Account Recovery Instead of Login

Recovery exists for customers who have lost the very factors that normally protect the account, so it accepts weaker evidence by design. That makes it the cheapest path to takeover. An attacker who holds a customer's email password, a ported phone number or a dossier of breached personal data can ask for a reset and let the institution's own process hand over a new credential.

Synthetic media adds a new kind of evidence to fake. The FBI's public service announcement I-120324, published 3 December 2024, says criminals have used AI-generated audio clips to impersonate individuals and get into their bank accounts. FinCEN's alert FIN-2024-Alert004, dated 13 November 2024, describes live verification checks where an attacker plays pre-generated video through a third-party webcam plugin, or claims technical glitches and asks to switch channels. Both behaviours show up at recovery, where a selfie or video call is often the last control before access is restored.

The cost of a bad recovery is not limited to one session. Once the attacker holds a fresh authenticator, every later control that trusts an authenticated session, from payee setup to limit increases, treats them as the customer.

Which Bank Account Recovery Deepfake Detection Controls Matter Most?

Rank recovery paths by how much they prove, and only drop to a weaker path when the stronger ones are unavailable. The FIDO Alliance's 2019 recovery guidance sets the order: reduce the need for recovery by having customers register more than one authenticator, and when none is available, re-run identity proofing at the same or higher assurance level as the original onboarding. Its authors say weaker recovery options are not recommended because they undo the value of strong authentication.

A selfie or video re-proofing step is where deepfake detection belongs. The capture should be checked for face manipulation, generative artefacts and signs that it came from a virtual camera rather than the device sensor, before it is compared with the onboarding image. A match against the onboarding portrait means little if the capture itself is a face swap built from that customer's social media photos.

A Recovery Review Sequence That Contains Old Access First

Contain before you restore. If the customer reports a lost or compromised device, revoke or quarantine the old authenticators before the new one is bound, so an attacker who holds the old device cannot race the real customer.

Then restore access in a reduced state. New sessions after a fallback recovery should carry temporary limits on payee additions, limit increases and outbound transfers until the customer has used the account normally or confirmed the recovery through an established channel.

• Record why recovery was requested and which factors the customer still has.
• Offer any registered authenticator or in-app approval before fallback proofing.
• For fallback, capture a selfie or short video in your own SDK and screen it for manipulation and injection before any face comparison.
• Check recent changes to phone number, SIM, email and device on the account; recent changes raise the review tier.
• Notify the previously registered email and phone that a recovery is under way, with a way to stop it.
• Bind the new authenticator, revoke the old ones and apply a cooling period with payment limits.

Why Should Profile Changes Get the Same Review as Recovery?

Because a changed phone number or email is the setup step for the next recovery. Attackers often change a low-visibility field first, wait, and then use the new channel to receive reset codes or approve payments. NIST SP 800-63B-4 treats setting or changing a pre-registered telephone number as the binding of a new authenticator, which is a useful test: if a field can later receive a code or approve an action, changing it is an authentication event.

Regulators have started to require delays. The Reserve Bank of India's Master Directions for non-bank payment system operators, dated 30 July 2024, require a cooling period of at least 12 hours after a change of registered mobile number or email, with no online payment transactions allowed in that window. Banks elsewhere can apply the same idea by policy: notify the old and new contact points, hold high-risk actions for a set period, and review a contact change followed by a reset or new payee as a single case.

How Neural Defend NeuroVerify Supports Recovery Re-Proofing

NeuroVerify takes the recovery selfie, video or audio in one API call and returns a unified risk score with evidence from six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. Eligible image requests complete in under 200 ms at p95 under defined test conditions, which keeps a re-proofing step usable on a phone while the customer waits.

The detector is built on ARCAS 1B, Neural Defend's foundation model, whose public arXiv paper reports pooled accuracy of 99.92% on WildFake and 99.09% on AIGIBench. On the public VendorBench-100 still-image benchmark, Neural Defend placed first of 36 systems by MCC (0.876, against 0.646 for the next vendor); that benchmark does not test video or injection, and one of its authors co-wrote the ARCAS paper.

Mobile SDKs for Android, iOS and Flutter capture the image inside your app rather than accepting an uploaded file, which removes one easy injection route. A recorded recovery call can go to NeuroDetect for frame-level and audio-segment review if the case is disputed later, and voice screening on live calls is available in NeuroCall (Beta).

What a Recovery Selfie Check Cannot Tell You

A clean deepfake score says the capture looks like an unaltered live face. It does not say the person is entitled to the account, that the customer is not being coached by a fraudster on another line, or that the email and phone on file are still under the customer's control. Coached victims pass every media check because they are real.

Keep the record that will matter in a dispute: the recovery reason, every factor offered and tried, device and network context, notifications and their delivery status, the media score and the model version, the operator's decision, and any high-risk action attempted in the first days after recovery. That chronology lets a reviewer reconstruct whether the process or the person failed.