Deepfake hiccup unmasks suspected digital certificate fraudster

Spain's national police have apprehended a cybercriminal after a brief technical glitch exposed his face during a video identification process. The unnamed suspect allegedly attempted to impersonate 30 individuals and obtain 38 digital certificates, with success on several instances. Digital certificates are used to verify identities and authenticate electronic signatures in Spain and other EU countries.

Possessing a certificate in someone else's name would enable a scammer to impersonate the individual, posing a significant threat.

The suspect allegedly targeted a security company authorized to issue digital certificates and circumvented their identity checks using forged documents, altered photographs, deepfake tools, and a precisely arranged lighting rig. He utilized deepfake technology to manipulate his face in real-time and employed custom lighting to recreate the holograms present on official documents.

Police stated that the suspect arranged household spotlights with strategically positioned colored bulbs to simulate the security features found on physical identity documents under natural light. He balanced counterfeit documents in front of the webcam, perfectly replicating the official holograms. Additionally, he used VPNs to conceal his online connections and presented manipulated documents with apparent security features.

The suspect's operation collapsed when the deepfake software experienced a brief processing delay, revealing his real face to the verification camera for a split second. Upon identifying and locating the suspect, police arrested him on suspicion of repeatedly forging official documents. A search of his residence uncovered a protected laptop, multiple mobile phones, storage devices, and various documents.

The investigation was complicated by the use of over 320 phone lines across 24 devices, most registered under stolen identities. Police traced the sale of these lines to outlets in the Murcia region.