The Anatomy of a Synthetic Criminal Persona

An apparently credible applicant joins a remote interview. Their CV looks convincing. Their professional profiles contain a plausible employment history. The person on the video call answers questions naturally, and the onboarding process ultimately issues them genuine corporate credentials.

What if the person never existed?

This is the risk posed by a synthetic criminal persona: an identity constructed from fabricated and sometimes real personal data, professional history, documents and media, then used to persuade an organisation to grant it trust. It is not merely a deepfake problem. It is an identity and access problem with fraud, espionage and insider-threat consequences.

What goes into a synthetic persona?

A convincing persona does not depend on one piece of technology. It can combine conventional identity fraud with modern generative tools. The components may reinforce one another even when none is individually persuasive.

1. Core identity data. Invented names and biographical details may be blended with misused real identifiers or information taken from breaches. That combination can complicate screening and create direct harm to legitimate individuals.
2. Professional footprint. Generated CVs, employment claims, portfolios and accounts on professional or development platforms provide an apparent history for a recruiter or procurement team to discover.
3. Synthetic media. Edited imagery, voice cloning or real-time face manipulation may be used to impersonate the person supposedly represented by the records.
4. Supporting documents. Fabricated identity and address documentation may be presented to satisfy onboarding checkpoints.
5. Operational consistency. Messaging, applications, interviews and account activity may be coordinated so the identity looks coherent across channels.

Generative AI can lower the time and skill required to produce some of these artefacts. It does not make every fake identity indistinguishable from a real one, and the effectiveness of any particular technique depends heavily on the verification environment.

The criminal operational chain

For defenders, the most useful way to analyse the threat is not by the deepfake tool used, but by the sequence of decisions that move an unverified persona into a trusted position.

The attack does not succeed simply because a video looks authentic. It succeeds when the organisation takes the next step: issuing an account, approving a payment relationship, accepting an identity or granting access to sensitive systems.

The point at which impersonation becomes insider risk

Imagine a fraudulent remote developer passing onboarding and receiving access to source repositories. From that point onwards, ordinary perimeter alerts may see valid authentication from an authorised account. The relevant questions become what permissions were granted, what changes that identity can make and which independent checks would reveal the inconsistency.

The same mechanism can affect procurement and banking. A convincing supplier identity can be used in payment diversion or third-party access attempts; manufactured customer identities can support financial crime and compliance exposure. The exact consequences depend on the permissions, processes and systems involved.

Why video verification alone is insufficient

Many identity checks focus on whether a photograph, recording or face presented to a camera appears genuine. But presentation attacks and digital injection attacks are different problems. The former presents manipulated material to a sensor; the latter attempts to place altered media into the capture or processing pipeline itself.

Controls based on blinking, turning a head or other predictable actions may be insufficient against capable interactive manipulation. Equally, sophisticated detectors are not a guarantee: their effectiveness varies with the threat model, device, integration and attacker adaptation. A single liveness pass should never carry the full burden of trust.

A layered response: verify the identity, then constrain the trust

1. Confirm the channel and device

For high-risk onboarding, assess whether the capture workflow can be tampered with. Application integrity controls, device attestation where technically supported, and checks for unauthorised virtual-camera or injection paths can provide useful signals. These are not universal proofs of a genuine physical camera, and legitimate devices or accessibility tools may introduce exceptions.

2. Strengthen identity verification

Use risk-proportionate checks that do not depend solely on the same interview or document channel. Independent reference verification, trusted identity services, and out-of-band contact through independently established details can help expose inconsistencies. Active liveness and media-forensic capabilities may assist, but should be evaluated against realistic attack simulations rather than accepted on marketing claims.

3. Keep privileged access narrow

Apply least privilege, time-bound access, approval for sensitive actions and segregation of duties to newly onboarded staff and contractors. Verify who sponsors the relationship, what access is justified and when that access expires. These measures reduce consequences even if initial identity checks fail.

4. Review behaviour after onboarding

Monitor appropriate risk indicators such as improbable account changes, unusual access to source code or sensitive data, rapid privilege escalation and inconsistent device or session histories. Investigate combinations of signals instead of treating an individual IP change or typing pattern as proof of fraud. Monitoring must remain proportionate and compliant with applicable privacy and employment obligations.

5. Extend the controls to suppliers

Identity assurance should include contractors, freelancers and third-party organisations. Independently verify payment-detail changes and supplier contacts, and distinguish a verified legal entity from the individual who is actually using its access.

What I would test in an intelligence-led engagement

At ThreatInsights, the useful output is not simply a catalogue of deepfake products. It is a defensible assessment of the adversary opportunity and the organisation's exposure.

• Threat hypothesis: Which adversary objectives would benefit from a synthetic employee, contractor, supplier or banking identity?
• Entry route: Which HR, procurement, KYC or remote-access journeys could be targeted?
• Required conditions: Which verification weaknesses and access permissions would need to coexist for the attack to matter?
• Observable indicators: What evidence might expose the attempted impersonation, and how would false positives be managed?
• Business impact: Could the result be payroll fraud, supplier payment diversion, intellectual-property theft or access to regulated data?
• Validation: Which approved tabletop or control-testing exercise would demonstrate whether the proposed safeguards actually work?

That moves the discussion from “Can AI fool a camera?” to a more useful intelligence question: “What would an adversary need to exploit our trust process, and what would happen next?”

Where intelligence professionals need to evolve

This threat also illustrates why traditional intelligence tradecraft needs to be applied to new AI-enabled workflows. A synthetic profile might deceive a recruiter, but it can also contaminate OSINT collection. A convincing online history is not the same thing as an independently verified identity.

Our developing CTI-CRAFT programme extends these ideas into AI-enabled adversary tradecraft, intelligence provenance, threats to AI systems and analytical assurance. The focus is on assessing evidence and realistic attack conditions, not simply recognising technology names.