Fraudsters in Kazakhstan have learned to bypass biometric verification at banks and microfinance organizations using deepfakes. At risk are clients on whom loans are issued without their knowledge, and responsibility for unreliable protection falls on the financial organizations themselves.
The financial market regulator has recorded such incidents over the past three years. Requirements for biometric verification also extend to the conclusion of loan agreements at banks and MFIs — and it is precisely at this stage that attackers find gaps in protection.
How deepfake protection works
According to established rules, the biometric system must randomly issue the client at least three different commands and analyze their execution via real-time video. This makes it possible to filter out pre-recorded clips, static photographs, and other methods of identity substitution.
Authentication is deemed failed after three unsuccessful attempts, and the client's image must match the reference by at least 95%. The verification program is required to monitor its own integrity, detect launch in an emulator, and protect the device camera from substitution. It is precisely the camera protection that prevents fraudsters from transmitting AI-generated video instead of the image of a real person.
Each procedure is accompanied by an electronic document with the verification results, the client's IIN, a list of completed commands, the date and time. The document is certified by the provider's electronic digital signature and stored in the financial organization. The client's image during remote servicing is compared against the reference from state databases or from the provider's database of verified images.
Biometric data must be protected from unauthorized access, copying, and dissemination and stored in encrypted form for at least five years. If credentials end up in the hands of unauthorized persons, the client is advised to immediately contact the financial organization, file a statement with the police, and send an appeal to the regulator with the available materials.
Kazakhstan strengthens control in finance
Biometrics protect creditors from fake clients, and for bona fide borrowers an additional filter is emerging: starting in 2027, large companies will undergo an ESG check before receiving a loan. Business access to financing will depend on the results of the assessment of environmental and social risks.
The same logic of automatic verification is being extended to state money: a neural network will search for unjustified spending in the budget, and four key financial systems of the country will be combined into a single ecosystem. The Smart Data Finance system already cross-checks data from 80 sources and identifies discrepancies between citizens' official incomes and their property.
Cryptalist analysis: The case demonstrates a systemic vulnerability of biometric verification to generative AI — static "liveness" checks are no longer a reliable barrier. For the market, this is a signal to transition to multi-factor and behavioral authentication models, as well as to redistribute responsibility for fraudulent loans toward financial organizations. Investors and fintech companies should consider anti-deepfake and digital identity solutions as one of the most in-demand segments of the coming years.