150 million stolen IDs just became raw material for deepfake identity fraud

More than 150 million driver's licenses are now searchable on the dark web. On September 10, ID verification provider IDScan confirmed that hackers stole driver's licenses and other government ID data from its cloud, a week after Krebs on Security reported a dark web service selling searchable scans of North American identity documents. The FBI is investigating. For fraud teams, the scary part isn't the size of the leak. It's what fraudsters can build with it.

Why this breach is different

Most breaches leak credentials: passwords, card numbers, account logins. Those can be reset. This one leaked the raw materials of identity verification itself. According to Malwarebytes, the service advertised records for more than 170 million people, including 153 million driver's licenses, roughly 10 million other ID cards and about 3 million travel documents. Some records reportedly include front-and-back images plus infrared and ultraviolet scans, the same security features document checks rely on to spot forgeries.

You can't reset a face. You can't reissue a date of birth. And every one of these records was already verified as genuine by the time it was stolen. That's what makes a verification-provider breach so valuable: the data is pre-validated, and it plugs straight into the onboarding flows of every bank, fintech and platform that checks IDs the same way.

From stolen ID to synthetic applicant

A high-resolution ID photo is all a modern face-swap tool needs. Pair it with the matching document, and a fraudster can present a "customer" whose face matches the license perfectly because both were generated from the same stolen record. The tooling to do this at scale already exists:

• Deepfake fraud is now about 6.5% of all fraud attempts, up from 0.1% in 2023, a 65-fold rise, according to Entrust data summarized by Proof.
• Injection attacks rose 40% year over year. Instead of holding a fake up to a camera, attackers feed synthetic video straight into the verification stream, bypassing the sensor that presentation-attack checks are designed to watch.
• New account fraud victims jumped 31%, from 4.2 million to 5.4 million, in Javelin's 2026 Identity Fraud Study. Javelin warns that scammers are stealing information now to fuel fraud that shows up in loss figures later.

Put those trends next to 150 million leaked licenses and the math is uncomfortable. The documents are real. The faces match. The only thing missing is the actual person.

Why document-plus-selfie checks are exposed

Most digital onboarding still rests on two questions: is this document genuine, and does the selfie match the photo on it? A breach like this weakens both answers at once.

The document check

If the attacker is presenting a real license, or a high-fidelity copy of one complete with IR and UV scans, document authenticity checks have little to catch. The artifact is legitimate. The person holding it is not.

The face match

Face matching compares the selfie to the ID photo. When both come from the same stolen image, the match succeeds by design. Unless liveness detection can tell a real camera feed from an injected deepfake, the check confirms the fraud instead of stopping it.

There's also a third-party risk problem. Few institutions can quickly say which verification vendors, and which of their vendors' sub-processors, hold their customers' identity data. In the EU, DORA enforcement now makes that a regulatory question, not just a security one.

What fraud teams should do now

The answer isn't to abandon ID verification. It's to stop treating an artifact that can be stolen as proof of identity. Priorities for the next quarter:

1. Assume leaked data is in play. Treat any applicant whose identity could be in the IDScan dataset as higher risk, and tighten step-up verification for high-value actions like account opening, credential resets and large transfers.
2. Detect synthetic media, not just mismatches. Add real-time deepfake detection to video and audio channels so injected or face-swapped streams are flagged before a match score is ever calculated.
3. Verify signals the breach didn't leak. A driver's license carries a photo but no voice. Checking whether a live voice is consistent with a live face adds a layer that a stolen ID image alone can't satisfy.
4. Map your verification supply chain. Know which vendors store customer ID images, for how long, and how you'll respond if one of them is breached.

Verify the person, not the paperwork

The IDScan breach is a reminder that any identity signal stored in a database can eventually be stolen and replayed. The strongest defenses rely on signals captured live, checked across modalities, and never kept in a central store. Corsound AI's Voice-to-Face AI matches a speaker's voice to their face without a database, and Deepfake Detect flags synthetic audio and video in real time. See how Corsound AI helps prevent identity fraud before stolen identities become new accounts.