Everyone's seen a teenager use a cousin's driver's license or a fake foreign ID card. These have long existed, and the history of all identification documents is a constant battle with counterfeits. But the AI era is not a continuation of that, it's a clear break with the past. Perfect-looking identification documents can be generated, and can be inserted into videos in real-time (or the entire video of the person can be faked). Anyone in doubt about how good these videos are should check out the latest OpenAI demo for generating videos from text prompts (released yesterday): https://openai.com/sora. High resolution video replicas of people are here, and they're available to anyone with a computer.

AI Impersonation

AI-generated videos of customers are currently, or are about to be, indistinguishable from real videos. Scammers can impersonate customers by creating video feeds that appear to be the person, with an authentic-looking ID, moving around naturally on video. With audio samples of the person's voice, convincing voice emulation can make the person speak in the same voice. These audio fakes have been used to steal enormous amounts of money from companies and individuals.

Rampant Creation Of Fake Identities And Impersonation Of Real Ones

Decades of poor technical security and a cavalier attitude towards privacy has led to huge amounts of personal data becoming available about just about everyone. This information can be used to create synthetic people that come complete with perfectly emulated ID cards, on video, with realistic voices. This completely undermines the premise that underlies the anti-money laundering laws passed worldwide over the last half century (but which particularly expanded following the 2001 terrorist attack on America). AI is a fundamental challenge to the concept of checking IDs. Meanwhile, regulators continue to pass new rules to try to enhance their anti-money laundering efforts, such as the Ontario Law Society's recently expanded rules for checking client IDs. Visual inspection can no longer be relied on.

Identification Document Cannot Be Static Images

For laws to be effective, there must be a new system that permits businesses to ask (using API) government issuers whether an ID is valid. But more than that, they must offer ways for people to assert control over their identification being used. If I'm not currently in the market for loans, why should my ID be possible to be used for loans? If I already have a mortgage and won't be getting a new one, no one should be able to use it for that. The concept of identification needs to change to meet the enormous technological change that has happened. The public needs to be able to gain control over their identity. This is necessary for the protection of customers and companies alike, but it's also essential to stop fraud that targets the government. Governments are being robbed by a tidal wave of fraud driven by AI-generated ID.

Reducing The Use Of Identification

At the same time as systems need to be enhanced for IDs, the ever-increasing use of identification must be ended. Far too many companies require identification from their customers, and far too many regulators reach for this as a solution to crime. There's hardly any evidence that money laundering rules have worked to stop financial crime, and there's little reason to believe that expanding these rules will suddenly work. But there's a lot of evidence that over use of identification causes leaks of IDs and personal information which cause further crime. Furthermore, identification is just not a solution to the problem, so overuse of identification causes a false sense of security that criminals are able to exploit. Over-reliance on identification disclosure means the public loses, and criminals gain.

Reforming Anti-Money Laundering Laws Or Expanding Policing

Identification is the basis of anti-money laundering laws. But the system hasn't worked even before AI, and it's falling apart in a world of remote work, remote learning, and remote verification of identification. Probably the best outcome would be that AML laws are scrapped and replaced by actual police investigation financial crime (rather than deputizing the private sector, which is not equivalent to police). When a system is so defective that 99% of criminal passes through (which is about what most domestic and foreign reports show), there's a very good case to be made that the idea should be thrown out and replaced by systems that work. Policing does work but it requires budgets, whereas making more rules for the private sector appears to be free (but obviously isn't free to the businesses that have to staff up).

I've been a consistent advocate for expansion of police services so that they can deal with online crime, and help stop the billions in losses every year that Canadians currently suffer. For various reasons, that hasn't happened. Perhaps one part of this is that regulators and lawmakers believe that passing more laws targetting the private sector (anti-money laundering rules) will work. But they haven't worked, and probably ought to be abandoned to the dustbin of history as another failed policy idea that's cost hundreds of billions in Canada but with very little to show for it.

If the system won't be thrown out, it is in dire need of reform to meet the reality of generative AI. The technology is here to stay, and no law can change that. Even if draconian laws could be passed in Canada, an enormous amount of crime comes from abroad, where these laws would not be effective.

AML reform would have to be done in parallel to upgrades on identification infrastructure, because static images aren't good enough. There are anti-counterfeiting measures built into identification documents, but business has moved online, thwarting that type of anti-counterfeiting. A new version of this needs to be made for the technological era. If AML laws and identification aren't upgraded, their effectiveness will continue to slip from the already very low standard to one that's even more meaningless. But even people who don't care about criminal money flows should be concerned about this because it also means fraudsters will be able to exploit systems and steal from Canadians.

The AI Era Of Identification

There's a new era of fake IDs. There's a new era of remote business. The laws haven't caught up. The government hasn't caught up. Even well-funded private businesses are struggling to keep up, in part because they haven't received the necessary support from lawmakers who have made these rules but then failed to build effective systems around them that would enable companies to know that the person behind the keyboard matches the ID on screen.