A photo check cannot know a card was reported lost.
A deepfake syndicate opened bank accounts with lost Hong Kong ID cards. The HKMA's new remote on-boarding circular asks banks to make sure what they rely on is genuine.
21 lost Hong Kong ID cards. 44 bank account applications. 8 arrests.
One syndicate used AI to merge their own faces onto the photos from lost ID cards, as reported by the South China Morning Post. The images passed photo checks at account opening.
What the HKMA now expects
On 3 September 2026 the HKMA issued a new circular on remote on-boarding of individual customers. It supersedes the 2019 circular on remote on-boarding and the 2021 circular on remote on-boarding and iAM Smart.
The circular names deepfakes directly and asks banks to make sure the "document, data or information" they rely on is genuine.
The weakest of the three
Most on-boarding still relies on the first of those three: a photo of a card. A photo check cannot know a card was reported lost.
With iAM Smart there is no photo to fake. The customer confirms on their own phone and the data comes from the government.
What share of your new customers come through iAM Smart today?