Deepfake Detection for Telecom SIM Registration: Stopping Fake Subscribers at Activation

Why Fraudsters Target SIM Registration

A phone number is a key to other services. Banks send one-time passcodes to it, messaging apps use it as the account identity, and payment wallets bind to it. A SIM registered in a false name gives a fraudster a number that cannot easily be traced back to them, and a batch of such SIMs supports scam call centres, mule accounts and throwaway messaging profiles.

Many countries require proof of identity to register a prepaid SIM. GSMA research published in 2018 counted 147 countries where prepaid SIM registration with proof of identity was mandatory, and noted a small but growing number adopting biometrics for registration. Wherever registration depends on a photo or selfie matched to an ID, that image becomes the thing to fake.

What India's ASTR Programme Found

India's Department of Telecommunications offers the largest public example. On 16 May 2023 it described ASTR, an Artificial Intelligence and Facial Recognition powered Solution for Telecom SIM Subscriber Verification, built to identify SIMs issued using fraudulent or forged documents. In its first phase ASTR analysed more than 87 crore mobile connections. The department reported multiple cases where one photograph had been used to obtain hundreds of connections, detected 40.87 lakh (about 4.1 million) suspected connections, and had disconnected 36.61 lakh after verification.

A later release, dated 21 March 2025, reported 3.40 crore disconnections under the Sanchar Saathi initiative, of which 0.78 crore were based on ASTR analysis. Those figures describe face-matching across the subscriber base, not deepfake detection. They show the scale of photo-based registration fraud that exists before generative tools are even involved, and they show the value of checking each new registration photo against existing ones.

How Attacks Differ Between Retail and Self-Service Activation

Operators register subscribers through retail points of sale, assisted kiosks and, increasingly, self-service apps with eKYC. The attack changes with the channel, so the controls should too.

Controls to Run Before a SIM Goes Live

Treat activation as the decision point. Once a number is live and linked to a bank or messaging account, undoing the damage is far harder. A practical order of checks:

• Bind the capture to the activation session, the agent or app instance, and a short time window.
• Check capture integrity for virtual cameras, emulators and rooted devices in self-service flows, as NIST SP 800-63A-4 Section 3.14 describes for remote proofing.
• Run manipulation and liveness analysis on the selfie or subscriber photo before trusting any face match.
• Search the new face against recent registrations to catch one face behind many SIMs, and flag agents whose registrations cluster.
• Validate the identity document and check it against the authoritative register where the regulator provides one.
• Hold or route flagged registrations for review instead of activating and disconnecting later.

Where Deepfake Detection for Telecom SIM Registration Helps, and Where It Does Not

Manipulation analysis catches what a face match cannot: a generated face built to resemble an ID portrait, a face swap, a replayed video or an edited photo. It complements duplicate-face search rather than replacing it, because a reused genuine photo shows no generation artifacts at all. Operators need both.

Detection does not prove that a real subscriber is not acting as a paid front for someone else, a common pattern in mule SIM recruitment. It does not validate documents, and it does not see agent collusion directly. Retail photos taken in poor light on old devices will also cause some false alerts, so thresholds should be tuned per channel and flagged genuine customers should get a quick assisted path.

Measuring Whether Registration Controls Work

Disconnection counts show how much fraud got through, not how much was stopped. Operators get a clearer picture by measuring at the point of registration and following each cohort of new SIMs for several months. A registration control is working when fewer of the SIMs it approved later turn up in fraud reports, mule account investigations or regulator disconnection lists, without a matching rise in abandoned genuine activations.

Keep the measures per channel and per agent, because fraud concentrates. A handful of retail points of sale often account for a large share of bad registrations, and after the first ASTR phase, service providers blacklisted 40,123 points of sale involved in selling such connections. Useful measures include:

• Share of activations flagged, by channel and by agent.
• Outcome of flagged cases after review: confirmed fraud, genuine customer, or unresolved.
• Fraud reports and disconnections per thousand SIMs, by registration month and channel.
• Time added to genuine activations, and abandonment after a flag.
• Model version in use, so changes in rates can be tied to updates.

How NeuroVerify Fits SIM Activation

NeuroVerify, Neural Defend's face, video and audio API, checks the activation selfie, video or subscriber photo for deepfakes and manipulation beyond liveness. One request returns six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance, combined into a unified risk score with signal-level evidence. The operator's policy decides whether activation proceeds, retries or goes to review.

Activation volumes are high, and NeuroVerify returns results in under 200 ms at p95 on eligible image requests under defined test conditions. Android, iOS and Flutter SDKs cover retail agent apps and self-service apps; Python, TypeScript, Go and Java SDKs cover the backend. Operators with subscriber data localisation rules can deploy in a private cloud or VPC, as a secure container, on premises or air-gapped, as well as through the managed cloud API. On the public VendorBench-100 still-image benchmark, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next-best vendor; that benchmark does not cover video or injection attacks, so pilots should test the operator's own channels. NeuroVerify does not analyse ID documents.