Deepfake controls for remote onboarding
A face match does not establish that the image came from a genuine camera interaction. Assess how media enters the journey, what the check actually proves and what happens when it fails. A useful supplier review tests the complete onboarding process, including legitimate customers who are wrongly rejected.
Separate the attack from the detection label
ENISA's 2022 report examines attacks on remote identity proofing, including photos, replayed video, masks and deepfakes. It provides a threat vocabulary, not evidence that a current product stops them. A demonstration of one type should not be presented as coverage of every other type.
| Risk | Where the problem occurs | Buyer question |
|---|---|---|
| Presentation attack | Something misleading is shown to a capture sensor | Which presentation attacks were included in the test? |
| Digital injection | Substituted media enters the processing path | What evidence covers capture integrity as well as image analysis? |
| Process abuse | Retries, support or exceptions undermine the decision | Can a failed check be overridden without equivalent evidence? |
A deepfake describes manipulated media; it does not, by itself, identify the entry point. NIST SP 800-63A-4 explains that biometric comparison and presentation-attack detection do not address every injection or forged-media case. Its remote-proofing guidance includes capture-origin controls, media analysis, protected channels and testing against genuine and manipulated material. This is a useful technical reference, not a blanket Irish legal requirement.
Review the layers of the proposed journey
Ask the supplier to mark the capture component, transport, document checks, face comparison, attack detection and final decision on one diagram. Beside each component, record who operates it and what result your application receives. This avoids an integration in which the application receives one unexplained score and cannot tell a technical outage from suspicious evidence.
- Before capture: explain the task and supported device requirements, with an alternative for people who cannot use them.
- During capture: establish what the offered configuration can say about the media's origin and integrity.
- At assessment: keep document validity, face comparison and attack signals distinguishable.
- At decision: define when to accept, retry, review or stop, and who can override that outcome.
- Afterwards: monitor complaints, confirmed incidents and changes in performance without retaining unnecessary raw media.
These are review questions for your service design. They are not a claim that adding every available signal improves it. Extra checks can increase exclusion, delay and data collection. Require the team to explain which demonstrated risk each control addresses and how its effect will be measured.
Remote recruitment and worker identity checks in Ireland
Remote hiring creates a continuity question: is the person who applied, attended the interview and completed any checks the person who will receive organisational access? FBI complaint intelligence documents stolen identity information and manipulated audio or video in remote-job applications. A later FBI operational alert describes AI and face-swapping in interviews associated with North Korean IT-worker activity. These sources establish a threat, not its prevalence among Irish applicants.
A real person acting as a proxy may pass a liveness check. A genuine document, a live face, a verified qualification and permission to work also answer different questions. Do not turn an interview into a deepfake guessing exercise or treat poor video, an accent, captions or inability to perform a gesture as evidence of fraud.
| Stage | Proportionate control | Minimum record or next step |
|---|---|---|
| Role design | Classify access and potential harm before selecting identity checks. | Role-risk rationale, owner and candidate notice. |
| Application and interview | Use established contact channels and structured, job-relevant assessment. | Specific discrepancy, not a subjective appearance label. |
| Conditional offer | Separate identity, document-holder, work-entitlement and qualification checks. | Limited result, method, date and review route where justified. |
| Account and equipment | Bind the approved worker to an individual account and controlled hand-off. | Named worker, approver and least-privilege access. |
| Agency or contractor change | Define authorised substitution and rechecking before access changes. | Supplying organisation, worker and accountable approver. |
Begin with the role, not a selfie requirement. Lower-risk roles may need clear recruitment communications, relevant references, proportionate pre-start checks, individual accounts and strong authentication. Add more intrusive evidence only where the access and potential harm justify it. Higher risk does not itself create a lawful basis or an Article 9 condition for biometric processing.
Give a failed check a fair next step. A capture problem, unsupported document and unresolved discrepancy are different outcomes. Provide human review and another evidence route rather than allowing a software score to withdraw an offer automatically. EDPB consent guidance highlights the employment power imbalance, and Irish employment-equality guidance covers applicants. Consequential legal and biometric-processing decisions require qualified review.
Normally retain the limited outcome needed for the employment process, not an unrestricted archive of documents, selfies or biometric material in the applicant-tracking system. Do not quietly reuse recruitment images for monitoring, cross-client matching or model training. MyID provides independent information and does not accept identity documents, selfies or applicant records.
A supplier evidence worksheet
| Field | What to request |
|---|---|
| Scope | Product, component versions, configuration, threshold and supported platforms |
| Test population | Numbers of genuine and attack attempts, device coverage and relevant user groups |
| Attack coverage | Named categories tested and categories excluded |
| Results | Counts and rates for accepted attacks and rejected genuine attempts, with limitations |
| Independence | Who performed the test, when, and whether the report covers the offered configuration |
| Change control | What triggers retesting and how customers are told about a material change |
Do not compare suppliers using a single “accuracy” percentage when their test sets, thresholds and definitions differ. Keep unsuccessful captures and abandoned attempts visible. A report based only on completed checks may say little about people who could not reach a decision. A missing result is an evidence gap, not a zero error rate.
Worked example: an authorised pilot review
Consider a fictional pilot with 200 genuine attempts and 50 agreed attack samples. Suppose 12 genuine attempts are rejected and two attack samples are accepted. Those observations are 6% and 4% of their respective test sets. They are not forecasts of production fraud or evidence of performance against attack types that were not included.
The next useful question is why the failures happened. If most genuine failures share an older supported phone, inspect that journey before tightening the threshold globally. If accepted attacks cluster in a route excluded from the supplier's report, the issue is coverage as well as detection. Keep the test identifiers and configuration in the record so a fix can be assessed against the same cases.
Run security exercises only in an agreed environment with permission, appropriate test material and a named owner. This article does not provide bypass instructions. Agree the acceptance and stop conditions before the results arrive; otherwise an impressive demonstration can redefine success after the fact.
Make rejection and recovery part of the control
A customer needs a clear route after a failed check. Separate a poor-quality capture from an unsupported device or a case needing review. Support staff need enough information to help, but an agent should not be able to wave through a high-risk result simply because a caller is persistent. Record escalation authority and the evidence needed for an exception.
Use the liveness and test-evidence guide for test terminology, the pilot plan for acceptance criteria and the recovery guide for later account access. Keep incident response separate from routine retries so genuine customers are not left in an unexplained loop.
Reviewed 5 October 2026. Worked examples, role tiers and worksheets are MyID editorial guidance. No transparent source reviewed establishes the prevalence of remote-hiring impersonation in Ireland. Check the linked primary material and obtain qualified review before making a consequential employment or biometric-processing decision.
In this topic: Fraud and security
How can remote onboarding and recovery be attacked and controlled?
View all 6 pages in this topic
Next useful pages
Follow the Irish evidence
Get the business briefing when Irish wallet, verification and age-assurance evidence changes.
Join the business briefing