Overview

A recent investigation revealed that Google’s Nano Banana Pro, an advanced AI image-generation tool, can be prompted to create hyper-realistic fake Indian identity documents, including Aadhaar cards and PAN cards.
The discovery raises immediate concerns for KYC verification, SIM registration, bank onboarding, and identity fraud prevention across India.

Synthetic IDs generated by simple prompts demonstrate how AI-assisted fraud has become scalable, fast, and accessible to non-technical attackers.

What Happened?

• Security researchers found that with a simple text prompt, Google’s AI tool could generate fully-designed, realistic Aadhaar and PAN cards.

• The generated IDs included:

  • Realistic fonts

  • High-quality document textures

  • Synthetic photos and demographic details

  • Near-accurate design elements

• Google applies SynthID invisible watermarking, but experts warn:

  • Watermarks can be stripped, cropped, or blurred

  • Most verification systems don’t detect watermarks

  • Fraudsters can reuse templates repeatedly

• The output is realistic enough to bypass image-based KYC systems used by banks, fintechs, and telecom companies.

Why It Matters

The ability to generate fake IDs within minutes fundamentally changes the fraud landscape:

• Identity Theft at Scale
  Fraudsters can mass-produce synthetic identities with no design skill or software expertise.

• KYC Systems at Risk
  Millions of onboarding workflows rely on static image uploads — now easily spoofed.

• Financial Crimes & SIM Fraud
  Fake IDs can be used to open accounts, secure loans, activate SIMs, or launder funds.

• Trust & Policy Breakdown
  Governments and enterprises must now rethink what “document verification” even means.

Incident Impact Analysis

How Attackers Could Exploit This

Clearphish threat modelling identifies three likely exploitation paths:

1. Banking & Fintech Fraud

Fraudsters can use AI-generated IDs to:

• open bank accounts

• apply for instant loans

• create mule accounts for laundering

• bypass fintech KYC processes

2. SIM Card Fraud & Fake Registrations

Telecom stores relying on document photos are at risk.
A fake Aadhaar + PAN combo can activate SIMs used for:

• phishing

• OTP interception

• fraud operations

3. Darknet Identity Marketplaces

Synthetic IDs can be mass-produced and sold anonymously.

How Organizations Should Respond

1. Move Beyond Image-Based Verification

Static images are no longer enough.
Adopt:

• Live video KYC

• Face match + liveness detection

• Government API validation (DigiLocker, Aadhaar XML, etc.)

2. AI-Driven Forgery Detection

Deploy tools that analyze:

• metadata anomalies

• texture inconsistencies

• font distortions

• generative-AI artifacts

3. Internal Training & Awareness

Fraud teams must be educated about synthetic ID threats.

4. Adopt Clearphish AI-Assisted Identity Threat Training

Clearphish provides specialized simulations that teach teams to detect:

• AI-generated IDs

• deepfake documents

• synthetic identity onboarding attacks

ClearPhish Perspective

The emergence of AI-generated identity documents marks a turning point in India’s fraud ecosystem.
This is not a hypothetical threat — it's operational now.

Organizations must rethink verification from foundational principles.
Clearphish is already working with institutions to:

• train teams

• design synthetic-ID defense playbooks

• model fraud pathways

• simulate real-world attacks using our hyper-realistic AI engine

Identity fraud just became AI-powered — and so must your defenses.

Disclaimer: ClearPhish maintains a strict policy of not participating in the theft, distribution, or handling of stolen data or files. The platform does not engage in exfiltration, downloading, hosting, or reposting any illegally obtained information. Any responsibility or legal inquiries regarding the data should be directed solely at the responsible cybercriminals or attackers, as ClearPhish is not involved in these activities. We encourage parties affected by any breach to seek resolution through legal channels directly with the attackers responsible for such incidents.