Recently, multiple headline news stories have exposed cases where criminals use "deepfake" technology to spread false information and carry out social engineering attacks. The social chaos caused by these highly realistic forged contents has drawn widespread public attention and concern. Due to the lack of comprehensive regulatory laws, coupled with the increasing prevalence of deepfake software-as-a-service (SaaS) tools, this issue has become even more intractable.

The payment industry plays a critical role in the fight against deepfakes. The current digital commerce landscape is flooded with numerous online services that leverage AI to assist in creating deepfakes. Since many of these deepfake software services accept credit card payments, payment service providers are on the front line of identifying these companies and preventing malicious actors from profiting from them.

In the past, creating deepfakes required specialized skills, demanding strong computing power and expertise. However, this situation is rapidly changing. Today, "deepfake-as-a-service" websites allow almost anyone with an internet connection, a credit card, and malicious intent to create highly convincing deepfake content. These platforms offer user-friendly interfaces, pre-trained AI models, and even access to databases of source materials. The cheap and easily accessible deepfake creation services make this serious problem highly scalable—and in the absence of comprehensive laws, extremely difficult to regulate.

Because many deepfake service providers accept credit card payments, payment systems are directly implicated in this issue. Credit card brands and the payment service providers that facilitate credit card payments for merchants often have standards that go far beyond current legislation. Currently, card networks are imposing hefty fines on banks and payment service providers that provide payment services to deepfake creation services, even if those services were provided unintentionally.

For financial, social, and ethical reasons, payment service providers must proactively identify these merchants and swiftly cut off payment services to cripple their operations. To identify and block deepfake creation services, the payment industry needs a combination of advanced technology and human expertise.

While some malicious merchant websites barely conceal their intentions, most employ evasion tactics, such as misrepresenting themselves during onboarding, omitting key information, or laundering transactions to mask the true nature of their business. With advanced technology, it is possible to process vast amounts of information across the global merchant landscape, flag suspicious websites, and identify deep and complex transaction patterns. However, technology alone cannot achieve fully accurate or nuanced assessment and investigation; human judgment remains essential.

To find these bad actors, payment risk analysts often need to play the role of detectives. In many cases, malicious actors process payments through unwitting third parties who are completely unaware that they are involved in illegal activities. The deepfake threat is severe, but combining technology with human intelligence can provide payment service providers with the necessary tools to build a more trustworthy digital commerce environment.