Guest Post by Faryam Asif, Chief Technology Officer at Shufti
Apple recently made headlines with a major shift in strategy: the tech giant will begin releasing security updates earlier than usual. Their reasoning is a clear acknowledgement of our new reality: AI is helping attackers discover and exploit software vulnerabilities at a speed that traditional defense cycles simply cannot match. While this move is a necessary change for software security, it raises a much bigger question for the rest of the business world: if AI is moving this fast to break code, are we moving anywhere near fast enough to verify the human beings, and increasingly the AI agents, behind every digital interaction?
Working in digital identity, I see Apple’s announcement as an early warning sign. We are no longer just fighting a war over software vulnerabilities; we are fighting a fundamental battle over the foundation of digital trust. The uncomfortable truth is that many organizations are preparing for tomorrow’s fraud while continuing to trust identities they verified yesterday.
Identity Fraud at Scale
For decades, the “bad actor” had to be a skilled forger or a patient social engineer. Generative AI has changed that. It has turned identity fraud into a high-speed assembly line. Criminals can now mass-produce synthetic identities; “digital twins” that combine real stolen data with AI-generated faces and documents, in a matter of seconds.
Research increasingly shows that fraudsters are using AI to generate near-perfect document templates and even simulated holograms capable of fooling legacy camera-based checks. This has dramatically shortened the gap between “creating” a fake identity and using it to commit high-scale fraud. In this environment, the traditional “front gate” of security is no longer just being picked; it is being bypassed by a master forger that never sleeps.
When Fraud Is Already Inside
Perhaps the most concerning development over the last 12 to 18 months isn’t just how many new fake identities are being created, but how many are already sitting in corporate databases.
Between 2020 and 2023, the global shift to digital forced institutions, from Tier 1 banks to growing fintechs, to onboard millions of users at record speed. To keep growing, many used
verification systems optimized for speed rather than defense against advanced AI threats. According to Shufti’s Deepfake Fraud Index, many legacy verification approaches were not designed to detect sophisticated threats such as face morphing and AI-generated deepfakes.
The reality many businesses haven’t yet realized is that the fraud is often already inside the house. Bad actors have established sleeper accounts that look perfectly legitimate to older verification systems but are waiting for the right moment to be used for coordinated money laundering or automated theft.
The Problem with One-Time Verification
Historically, businesses have treated identity verification as a point-in-time event. You scan your ID during signup, you pass the test, and you are verified for life. In the age of AI, this approach is no longer sufficient.
Generative AI has dramatically lowered the cost of creating convincing fake identities, synthetic faces, forged documents, and deepfake videos and voices. As a result, identities that successfully passed verification just 12 to 24 months ago may no longer meet today’s security standards. What was once considered robust due diligence may now represent an unseen vulnerability. This means organizations must begin viewing identity remediation as an ongoing responsibility rather than an exceptional exercise.
Importantly, identity remediation goes beyond traditional KYC remediation. Updating expired documents, refreshing customer risk ratings, or correcting incomplete records strengthens compliance, but a complete KYC file can still belong to a synthetic identity. Compliance alone does not guarantee authenticity. Businesses increasingly need to re-establish that the person behind an existing account is genuine using modern, AI-resistant verification technologies.
Risk is dynamic, not static. A customer who appears legitimate on Monday could end up on a global sanctions list, be designated as a Politically Exposed Person (PEP), or appear in adverse media by Friday. At the same time, fraud techniques continue evolving, making older verification decisions progressively less reliable. Yesterday’s verification methods should therefore help determine which existing customers require re-verification today.
Rather than re-verifying every customer, organizations should adopt a risk-based remediation strategy. High-value accounts, customers onboarded using older verification technologies, suspicious behavioral patterns, device or IP anomalies, and other risk indicators should determine who is reviewed first. Those customers should then be re-verified using layered, AI-resistant controls, including advanced liveness detection, deepfake and injection attack detection, document authentication beyond visual inspection, biometric re-binding, and synthetic identity detection. Equally important is protecting the customer experience through step-up verification, transparent communication, proportionate timelines, and manual review pathways where appropriate.
Identity remediation should not be viewed as a one-off project. It should become part of an organization’s long-term identity strategy. This means moving beyond periodic remediation toward Identity Lifecycle Management, where verification becomes an ongoing, risk-based process triggered by customer behavior, regulatory changes, and emerging threats. Identity remediation is not the destination. It is the bridge to continuous assurance, enabling organizations to stay ahead in an AI-driven fraud landscape rather than constantly reacting to it.
What Technology Leaders Should Do Next
The speed at which Apple is moving should be a signal to every C-suite executive. AI isn’t just making hackers faster; it is rewriting the rules of human interaction.
Technology leaders today should not just be patching software; they should be auditing their identity foundations. They should be asking: Do we know who is actually in our database? Is our security dynamic enough to handle a threat that changes every 15 minutes?
The future of digital trust belongs to organizations that stop treating identity verification as a one-time hurdle and start managing identity as a continuous lifecycle. In the age of AI, continuous identity assurance is no longer a competitive advantage. It is becoming a business necessity.
This article is a guest contribution. The views, opinions, analysis, and claims expressed are those of the guest author alone and do not necessarily reflect the views of The Quantum Insider or it’s editorial staff.
