Case · DiggingBeagle record

Deepfake-assisted bank video verification preceded trusted-number replacement

KZ-CERT documented a May 2024 fraud sequence in which facial video captured during a messenger call was reused with DeepFake technology during bank video verification, followed by replacement of the trusted phone number and subsequent account access. The advisory does not identify the affected bank or establish that every bank or present-day implementation remains vulnerable to the same technique.

Evidence boundary

An explicit boundary statement has not yet been recorded. The evidence ledger defines what can be supported.

Not yet assessed. The record's Claims and Sources remain available; missing grades do not mean low impact.Assessment method

30-second account

Mechanism and trust boundary

Typed chronology

Dates retain their recorded precision. Partially dated events can overlap; display order does not establish a causal sequence.

  1. May 16, 2024
    Event type unspecified

    KZ-CERT publishes DeepFake bank-fraud advisory

    The advisory describes facial-video capture, DeepFake-assisted bank video verification, trusted-number replacement and subsequent authentication and transfer of funds.

  2. May 16, 2024
    disclosure

    Public disclosure

Claims & evidence

4 independently addressable Claims. Expand a Claim to inspect support, contradiction and scope.

CLM-KZCERT-RECOVERY-PIVOTThe reported sequence illustrates a high-impact recovery pivot: when successful video verification can authorize replacement of a trusted phone number, defeating that verification step can enable subsequent authentication through the newly trusted number.supported

Basis: inference

Scope: Inference from the specific KZ-CERT sequence; it is not evidence that every bank, every recovery flow or a current deepfake-aware implementation exposes the same transition.

Permanent Claim anchor
CLM-KZCERT-TRUSTED-NUMBERIn the same KZ-CERT sequence, video verification was followed by changing the trusted phone number to the attacker's number, authenticating through the changed number and transferring funds to accounts controlled through third parties.supported

Basis: reported finding

Permanent Claim anchor
CLM-KZCERT-DEEPFAKE-VERIFYKZ-CERT reported that an attacker recorded a bank customer's face during a messenger video call and then used the previously recorded material with DeepFake face substitution while confirming the customer's identity through bank video verification.supported

Basis: reported finding

Permanent Claim anchor
CLM-KZCERT-DEEPFAKE-CONFIRMEDKZ-CERT specialists explicitly stated that DeepFake technology was used in the fraud type described by the advisory.supported

Basis: reported finding

Permanent Claim anchor

Implications within the documented scope

Controls and mitigations

No controls or verified fix are recorded.

Unknowns and contradictions

No explicit unknowns are recorded; inspect the scope and Claim qualifications.

Sources and citation

Material revision history

  1. Sep 29, 2026 · Canonical change recorded · new in release · revision 54

Cite this record

DiggingBeagle. “Deepfake-assisted bank video verification preceded trusted-number replacement.” Public disclosure May 16, 2024. https://diggingbeagle.com/cases/deepfake-assisted-bank-video-verification-preceded-trusted-number-replacement/

Citation guidance

Independent research

The source stays with the story.

Claims, evidence and corrections remain inspectable. About the project · Our methodology