The new identity theft is no longer about impersonating you: it's about building a new you

A cybercriminal arrested in Spain used AI to alter his face in real time and impersonate more than 30 people using forged ID cards, marking a shift from traditional identity fraud to the creation of complete digital identities.

The Spanish National Police have arrested a Cybercrime suspect who used artificial intelligence to modify his face in real-time during verification video calls to impersonate the holders of falsified ID cards.

The cybercriminal did not need to resemble his victim. Artificial intelligence did the work for him. He would stand in front of the camera, show a falsified ID, and during the verification video call, a deepfake system would modify his features in real-time until his face became that of the person whose identity he intended to usurp.

The technique allowed the suspect to make 38 impersonation attempts on more than 30 real identities , with a particularly delicate goal: to pass the controls of a company responsible for issuing electronic certificates and thus obtain authorized digital signatures that could later be used to commit new frauds.

The case, investigated by National Police agents in the Spanish city of Murcia, shows to what extent artificial intelligence is transforming identity fraud. It is no longer just obtaining a fake document or stealing a password. The attacker can fabricate a complete identity and present it before a camera as if it were a real person.

The actions began after the company detected multiple fraudulent requests related to the issuance of electronic certificates.

The suspect had perfected a procedure that combined several layers of deception. He used falsified IDs with digitally manipulated photographs and simultaneously employed a deepfake tool capable of altering his face during the identification video conference.

But the setup did not end on the screen. To reinforce the appearance of authenticity of the documents, he used domestic lights with bulbs of different colors, strategically placed to reproduce the reflections and flashes that the security measures of identity documents produce when observed under certain lighting conditions.

In front of the camera, he moved the falsified documents to simulate their holograms and other security elements. At the same time, he used VPN networks to hide the origin of his connections and had built a complex anonymization infrastructure.

The result was a kind of "synthetic identity" live: a fake document, an AI-generated face, and a connection prepared to make traceability difficult.

The operation ended up failing due to a detail as small as it was revealing. During one of the video identification processes, the program responsible for modifying his features suffered a momentary delay. For just a second, the digital mask disappeared, and the suspect's real face appeared on the screen.

That instant was enough for the security officials of the entity to detect the anomaly and provide the investigators with a decisive clue. Subsequent investigations allowed identifying and locating the author, who was arrested accused of a continued crime of document falsification in an official document.

During the , an encrypted laptop with high-level software, numerous mobile phones, storage devices, and documentation related to the investigated activity were seized.

The sophistication of the setup was also reflected in the infrastructure used by the suspect. Investigations into emails and payment methods allowed identifying more than 320 phone lines linked to 24 mobile devices. Most of these lines would have been contracted using impersonated identities and acquired at different points of sale.

The criminal was not only trying to digitally become another person. He was also building a network of false identities and communications around that digital identity.

This recent case anticipates one of the problems that most concern security forces and companies using biometric identification systems: the camera can no longer be considered alone as proof that a person is who they say they are.

Europol has warned that artificial intelligence is allowing the combination of voice cloning, live video deepfakes, and synthetic identities to facilitate new modalities of fraud, extortion, and identity theft. In a specific report on biometrics, the European agency also notes that deepfakes can be used to try to bypass facial authentication mechanisms.

The problem is not only theoretical. In 2025, researchers linked a North Korean group to campaigns in which they used video and audio generated by AI to impersonate executives during Zoom calls and trick employees into installing malicious software. The goal was to take advantage of the trust generated during an apparently normal conversation to access systems and cause economic losses.

On another front, Europol has documented how fraud networks are incorporating deepfakes of public figures, politicians, and celebrities to promote false investments and attract victims. In an international operation against a cryptocurrency fraud network, the European agency highlighted precisely the role of manipulated ads through AI-generated videos to attract potential investors.

The difference with the Spanish case is particularly relevant: here, AI was not used to convince a victim through a previously fabricated video but to pass a live identification process. And that leap changes the rules of the game.

For years, security systems have tried to answer a simple question: Is the document authentic? Then came a second: Does the person presenting it match the photograph? Now a third appears, much more difficult to answer: Is the person I'm seeing really a person or a representation generated by a machine in real-time?

The evolution is significant because criminals can combine several techniques: stolen personal data, falsified documents, manipulated photographs, facial cloning, voice cloning, deepfakes, and devices or phone lines contracted with other identities.

Europol warns that this technological convergence is making data theft cease to be the final objective to become raw material for new identities and new frauds. The criminal organization can acquire data, build profiles, and later use them to impersonate a person, open accounts, pass controls, or access services.

The paradox is that the same technology that allows reinforcing identification can also be used to attack it. In Murcia, a failure of just a second in a digital mask ended up revealing the truth. But as these tools improve, the boundary between a real identity and an AI-fabricated identity will become increasingly difficult to distinguish at a glance.

The Spanish National Police have arrested a Cybercrime suspect who used artificial intelligence to modify his face in real-time during verification video calls to impersonate the holders of falsified ID cards.

The cybercriminal did not need to resemble his victim. Artificial intelligence did the work for him. He would stand in front of the camera, show a falsified ID, and during the verification video call, a deepfake system would modify his features in real-time until his face became that of the person whose identity he intended to usurp.

The technique allowed the suspect to make 38 impersonation attempts on more than 30 real identities , with a particularly delicate goal: to pass the controls of a company responsible for issuing electronic certificates and thus obtain authorized digital signatures that could later be used to commit new frauds.

The case, investigated by National Police agents in the Spanish city of Murcia, shows to what extent artificial intelligence is transforming identity fraud. It is no longer just obtaining a fake document or stealing a password. The attacker can fabricate a complete identity and present it before a camera as if it were a real person.

The actions began after the company detected multiple fraudulent requests related to the issuance of electronic certificates.

The suspect had perfected a procedure that combined several layers of deception. He used falsified IDs with digitally manipulated photographs and simultaneously employed a deepfake tool capable of altering his face during the identification video conference.

But the setup did not end on the screen. To reinforce the appearance of authenticity of the documents, he used domestic lights with bulbs of different colors, strategically placed to reproduce the reflections and flashes that the security measures of identity documents produce when observed under certain lighting conditions.

In front of the camera, he moved the falsified documents to simulate their holograms and other security elements. At the same time, he used VPN networks to hide the origin of his connections and had built a complex anonymization infrastructure.

The result was a kind of "synthetic identity" live: a fake document, an AI-generated face, and a connection prepared to make traceability difficult.

The operation ended up failing due to a detail as small as it was revealing. During one of the video identification processes, the program responsible for modifying his features suffered a momentary delay. For just a second, the digital mask disappeared, and the suspect's real face appeared on the screen.

That instant was enough for the security officials of the entity to detect the anomaly and provide the investigators with a decisive clue. Subsequent investigations allowed identifying and locating the author, who was arrested accused of a continued crime of document falsification in an official document.

During the , an encrypted laptop with high-level software, numerous mobile phones, storage devices, and documentation related to the investigated activity were seized.

The sophistication of the setup was also reflected in the infrastructure used by the suspect. Investigations into emails and payment methods allowed identifying more than 320 phone lines linked to 24 mobile devices. Most of these lines would have been contracted using impersonated identities and acquired at different points of sale.

The criminal was not only trying to digitally become another person. He was also building a network of false identities and communications around that digital identity.

This recent case anticipates one of the problems that most concern security forces and companies using biometric identification systems: the camera can no longer be considered alone as proof that a person is who they say they are.

Europol has warned that artificial intelligence is allowing the combination of voice cloning, live video deepfakes, and synthetic identities to facilitate new modalities of fraud, extortion, and identity theft. In a specific report on biometrics, the European agency also notes that deepfakes can be used to try to bypass facial authentication mechanisms.

The problem is not only theoretical. In 2025, researchers linked a North Korean group to campaigns in which they used video and audio generated by AI to impersonate executives during Zoom calls and trick employees into installing malicious software. The goal was to take advantage of the trust generated during an apparently normal conversation to access systems and cause economic losses.

On another front, Europol has documented how fraud networks are incorporating deepfakes of public figures, politicians, and celebrities to promote false investments and attract victims. In an international operation against a cryptocurrency fraud network, the European agency highlighted precisely the role of manipulated ads through AI-generated videos to attract potential investors.

The difference with the Spanish case is particularly relevant: here, AI was not used to convince a victim through a previously fabricated video but to pass a live identification process. And that leap changes the rules of the game.

For years, security systems have tried to answer a simple question: Is the document authentic? Then came a second: Does the person presenting it match the photograph? Now a third appears, much more difficult to answer: Is the person I'm seeing really a person or a representation generated by a machine in real-time?

The evolution is significant because criminals can combine several techniques: stolen personal data, falsified documents, manipulated photographs, facial cloning, voice cloning, deepfakes, and devices or phone lines contracted with other identities.

Europol warns that this technological convergence is making data theft cease to be the final objective to become raw material for new identities and new frauds. The criminal organization can acquire data, build profiles, and later use them to impersonate a person, open accounts, pass controls, or access services.

The paradox is that the same technology that allows reinforcing identification can also be used to attack it. In Murcia, a failure of just a second in a digital mask ended up revealing the truth. But as these tools improve, the boundary between a real identity and an AI-fabricated identity will become increasingly difficult to distinguish at a glance.

Become a premium member for free!