Deepfake hiccup unmasks suspected digital certificate fraudster
Spanish national police say they have arrested a man suspected of using deepfake software and a rigged lighting setup to fraudulently obtain digital certificates in other people's names. The suspect allegedly made 38 attempts to impersonate 30 different people, successfully tricking a certified security company's video identity checks on multiple occasions. Digital certificates carry significant weight in Spain and the wider EU, letting holders sign contracts, authorise transactions and deal with public bodies online, so certificates issued fraudulently could have handed the suspect a powerful tool for further impersonation and cybercrime.
Investigators say the man used forged documents, altered photographs and real-time deepfake face-swapping to pass live video verification, while household spotlights fitted with coloured bulbs were used to mimic the holograms and security flashes on genuine ID documents held up to the webcam. He was reportedly caught out when his face-swapping software glitched for "barely a second," briefly revealing his real face to the camera. A search of his home turned up an encrypted laptop, multiple phones and storage devices, and the probe was complicated by his alleged use of over 320 phone lines across 24 devices, many registered with stolen identities traced to sellers in the Murcia region.
In short
- Spanish police arrested a suspect who deepfaked ID checks to get digital certificates.
- A brief software glitch exposed his real face, leading to his capture.
- He allegedly used fake lighting rigs and 320+ phone lines under stolen identities.
Explained simply
Digital certificates are electronic credentials that let people prove their identity online. In Spain and across the European Union, they can be used to sign contracts, approve transactions and deal with public services.
Spain’s police say the arrested man is suspected of trying to obtain certificates in other people’s names. Investigators allege he used altered identity documents and software that changed his face during live video checks, with coloured lights intended to imitate document security features.
If issued to the wrong person, a certificate could allow them to act online as someone else. The case also highlights the role of video identity checks in protecting access to services and transactions.