A photo check cannot know a card was reported lost.
A deepfake syndicate opened bank accounts with lost Hong Kong ID cards. The HKMA's new remote on-boarding circular asks banks to make sure what they rely on is genuine.
By Matthew Lee
21 lost Hong Kong ID cards. 44 bank account applications. 8 arrests.
One syndicate used AI to merge their own faces onto the photos from lost ID cards, as reported by the South China Morning Post. The images passed photo checks at account opening.
What the HKMA now expects
On 3 September 2026 the HKMA issued a new circular on remote on-boarding of individual customers. It supersedes the 2019 circular on remote on-boarding and the 2021 circular on remote on-boarding and iAM Smart.
The circular names deepfakes directly and asks banks to make sure the "document, data or information" they rely on is genuine.
What an image check cannot establish
An image check can examine the document presented, but the image alone cannot establish whether the card has been reported lost. The question for a bank is how its full verification process checks authenticity, the applicant and any relevant document status.
With iAM Smart, the customer authenticates through the government digital identity service and authorises the release of supported identity information. That gives the bank another route to obtain identity evidence. It still needs to assess the complete onboarding process, including exceptions and fraud controls.
What share of your new customers come through iAM Smart today?