This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Ahmedabad police arrested four individuals for operating an identity fraud racket that utilized AI-generated deepfake videos to bypass Aadhaar facial authentication. By creating manipulated videos from victims' photographs, the perpetrators successfully altered Aadhaar-linked mobile numbers, accessed DigiLocker, opened fraudulent bank accounts, and applied for personal loans. The investigation revealed the use of unauthorized Aadhaar update kits in conjunction with the deepfake technology to facilitate the fraud.
Ahmedabad Cyber Crime police reportedly arrested four people after businessman Amit Patel alleged that his Aadhaar-linked mobile number had been changed without consent. Police reportedly said the accused allegedly used purportedly AI-generated deepfake videos made from Patel's photo to bypass facial authentication, access DigiLocker/e-KYC services, open bank accounts, and apply for loans.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The perpetrators illegally accessed and updated the victims' Aadhaar profiles and DigiLocker accounts, compromising their sensitive personal data.
The incident involves malicious actors using AI-generated deepfake videos to impersonate specific victims for financial gain through fraudulent loan applications and bank accounts.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human actors who intentionally used deepfake generation tools post-deployment to bypass biometric security and commit identity fraud.
Added categories peak at 2: Minor (Psychological Harm, Inferred)
Local criminals in India successfully used AI-generated deepfakes to bypass facial biometric authentication on Aadhaar, the national identity system, to commit identity theft and financial fraud. While localized, the incident highlights a critical vulnerability in national digital infrastructure to AI-enabled spoofing.
The AI system was used as a tool to perform a specific, well-defined function: generating deepfake videos from static photographs to simulate facial movements. It operated on direct input without autonomous planning or decision-making.
Limited Risk: The report describes the use of AI-generated content such as deepfakes, which falls under Limited Risk due to transparency and manipulation concerns.
The AI system was specifically used to generate deepfake videos from static photographs to simulate facial movements and bypass biometric verification.
The report provides clear, detailed factual accounts of the fraud mechanism, the arrests, the specific victims, and the role of AI-generated deepfakes in bypassing biometric authentication. There is little ambiguity regarding how the AI was used or the nature of the incident.
None. The incident is clearly a case of targeted financial fraud and identity theft enabled by deepfake technology.
Technology
Vulnerable Facial Authentication
System failed to distinguish deepfake videos from live human faces.
Deepfake Video Generation
AI tools allowed creation of realistic blinking and facial movements.
Data Inputs
Unsecured Personal Photos
Victim's photograph was easily acquired to generate the deepfake.
Stolen Aadhaar Credentials
Aadhaar numbers and personal details were obtained via unauthorized means.
Human Factors
Collusion by CSC Operators
Operators compromised security by sharing kits for commission.
Lack of Operator Verification
Operators did not verify the physical presence of the Aadhaar holder.
Process and Methods
Flawed Aadhaar Update Process
Process allowed mobile number changes via remote facial authentication.
Inadequate Liveness Detection
Methods used to verify live presence were bypassed by simulated blinking.
Management
Insecure Aadhaar Kit Management
Aadhaar update kits were not properly secured against unauthorized use.
Poor Identity Verification Auditing
Lack of real-time monitoring to detect fraudulent biometric updates.
Regulatory Environment
Weak CSC Operator Oversight
Inadequate regulatory monitoring of Common Service Centre operators.
Lack of Deepfake Regulations
No strict controls on AI tools capable of synthesizing identity media.
AI system involved
An AI system was involved, but the reports do not identify it.
Identified by automated extraction; can differ from the alleged developers above.
