Google Gemini Just Became a Fraud Tool

Google Gemini just became a fraud tool.

Last week in India, four men used the free version of Google Gemini to generate deepfake videos of a businessman. Those videos bypassed Aadhaar — the world's largest biometric identity system, with 1.4 billion people enrolled — without triggering a single one-time passcode (OTP).

They changed his registered mobile number. Redirected his one-time passwords. Opened bank accounts in his name. Took out loans. Accessed his digital document vault.

The tool was free. The attack took no coding skills. One of the four worked at an identity service centre.

This isn't a theoretical risk paper. It's a police report.

Here's where the numbers get uncomfortable:

→ 77% of fraud professionals say deepfake attacks are increasing (SAS/ACFE, Mar 2026)
→ Only 7% of organizations say they're prepared to detect AI-driven fraud (same report)
→ 62% of organizations faced a deepfake attack in the past 12 months (Gartner, Sep 2025)
→ 30% of enterprises will consider standalone IDV unreliable by year-end (Gartner)
→ Lending is the #2 deepfake target at 5.4% of all attacks (Stingrai, Apr 2026)
→ One deepfake attempt hits an IDV system every 5 minutes (Onfido/Entrust)

The attack chain maps directly to U.S. mortgage lending:

Static photo → AI-generated video → bypass liveness check → change credentials → take out loans in someone else's name.

4 questions every lender should be asking right now:

1. Does your verification rely on analyzing documents that AI can generate — or on source-level data from authoritative systems?
2. Can your IDV stack detect AI-generated video?
3. Are you relying on biometrics alone?
4. What's your fallback when liveness detection fails?

If the answer to #4 is "we don't have one," you have a gap that a free consumer AI tool can exploit today.

Congress introduced HR 7270 (Stop Identity Fraud Act) on April 21 — Treasury grants for deepfake defenses, expanded eCBSV, NIST liveness standards. Eight days later, Gemini proved why they were right to call it an infrastructure crisis.

The fraud isn't coming. It's here. The question is whether your verification stack was built for this.

— Stephen Schrump, CEO, PitchPoint Solutions