Deepfakes expose major weaknesses in mobile banking security

AI-driven fraud is outpacing banks’ current protections.

Singapore’s banks are facing a sharp rise in mobile fraud as cybercriminals weaponise AI, deepfakes, and easy-to-use attack tools that outpace existing security controls. According to Gil Hartman, Field CTO at Appdome, the industry’s current defences are no longer sufficient against the sophistication of 2025’s threat landscape.

At the sidelines of Singapore FinTech Festival 2025, Hartman said that even with multiple safeguards deployed, attackers benefit from the accessibility of AI-enabled tools. “It's very, very easy to use AI tools. It is really easy… to use scams and… it's just not coming up to speed.” He added that Appdome is increasingly seeing the need for institutions “to be in front of the curve.”

Hartman pointed to deepfakes, banking trojans and mobile identity manipulation as the biggest blind spots. Traditional KYC and biometrics struggle to keep pace because “it's not very simple… to make sure that the user is really the user.”

While tech giants Apple and Google offer real-time device-level alerts, banks cannot replicate this level of protection because they lack OS-level access. Hartman explained that banks, in contrast, “have to just understand what is in the device according to the signals.”

Appdome’s approach focuses on creating immutable device identifiers through its IDAnchor technology. “We're basically combining hundreds of signals… and giving… unique, immutable device identifiers,” Hartman said. This enables hardware blacklisting even when attackers attempt spoofing.

Looking ahead, Hartman says fraud detection must rely on multilayered signal correlation. “It's all about combining different signals… then you can combine it together and say, this is an attack,” he said. The goal, he added, is to stop account takeovers without harming user experience: “Once your app is usable… you don't get any pushback… but you're really stopping the fraud.”