r/FraudPrevention

I've been looking into this lately and I'm still not sure if paying for identity theft protection makes sense.

There are free options like freezing your credit, checking your reports, and setting up account alerts. Those seem like a good place to start, but I'm wondering what happens if someone actually steals your identity. Would a paid monitoring service make the recovery process any easier, or can you handle most of it yourself without paying for extra help?

For those who've looked into these services or had to deal with identity theft, what do you think is worth paying for, if anything?

Deepfakes got really cheap really fast. Face swap tools earlier used to need a powerful GPU and what now requires next to nothing. Same story with fake IDs, all you need is couple of prompts and you've got a driver's license, plus a thousand variations as needed

So for how detection actually works, beyond the usual "we use AI to catch AI." From what I've seen, and working in the industry, 3 things mainly:

- the face doesn't match the rest of the image: lighting, edges and blending around the face are slightly off

- the movement looks weird over time: blinks, head turns and expressions get glitchy between frames

- the face is too clean: it's missing the tiny skin pores and hair detail the rest of the frame still has

But the more tricky thing is doing it at scale, on every channel, without making the user experience a nightmare. And since a fraudster can retry a thousand times easily, even a tiny miss rate turns into a real headache.

This is pretty much my day job, im working at microblink so, i can be a lil bit biased. But we did score 100% on the IDNet deepfake benchmark, but I m not claiming any single check wins this on its own. It's more about stacking signals: document, face, liveness and behavior together.

If you’re also in this field, how are you seeing deepfakes show up in onboarding or support calls yet? And are you catching them or slipping yet?

We are Citigold. Recently we noticed there was a record of an in-person withdraw from a branch in California (at the teller, not ATM). The amount was $650. That wasn't us. We are in Maryland and have nothing to do with that region, never went there, etc. We reported this to Citibank. We switched all our funds to a new Citi account. We filed the fraud report with Citi. Today we got a letter in the mail saying their decision is this transaction was not fraud and the claim was denied. Clearly they are incompetent. Please advise on what we need to do to get our money back ASAP. After that, we are certainly quitting Citibank. Thank you for any help!

Please help,if any one having some solution

If someone you know sends you something like "hey, is this your photo?" on WhatsApp with a link, don't open it. CERT-In flagged this one last December and banks are still warning about it. It's worth understanding because it doesn't steal your password or OTP. It gets you to approve the scammer's device yourself.

How it works:

1. The message comes from a real contact whose WhatsApp has already been taken over. That's why it feels safe.
2. The link opens a page made to look like Facebook or a photo viewer. It asks you to "verify" before you can see the picture, and wants your phone number.
3. Meanwhile, the scammer opens WhatsApp Web on their own browser, picks "link with phone number" and enters your number. WhatsApp gives them an 8-digit code, which they show on the fake page.
4. The page tells you to enter that code in WhatsApp to finish verifying. You do.
5. Their browser is now one of your linked devices. They can read your chats and message your contacts as you, usually with the same photo bait or a request to borrow money.

There's also a QR version, where the page shows a WhatsApp Web QR code and asks you to scan it "to verify". Same result.

What makes it bad is that your phone keeps working normally. Nothing logs you out, so a lot of people only find out when a friend asks why they sent a weird link late at night.

To check right now, open WhatsApp > Settings (or the three-dot menu on Android) > Linked devices. If there's a browser or device you don't recognise, tap it and log out.

The rule to remember: only enter a WhatsApp pairing code or scan a WhatsApp QR when you're linking your own laptop or tablet. If a website, a "support agent" or anyone else hands you a code to put into WhatsApp, someone is trying to log in as you.

If it already happened to you:

- Log out the unknown device from Linked devices.
- Turn on two-step verification (Settings > Account > Two-step verification). It won't undo a linked device, but it makes it harder for someone to register your number on another phone.
- Tell your contacts to ignore money requests from you for a while.
- If anyone already sent money, they should call 1930 or file at cybercrime.gov.in quickly. Faster reports give a better chance of freezing the funds.

You can also report the original message on Chakshu through Sanchar Saathi.

If you've seen this with a different opening line, share it here (with names and numbers removed). The bait text changes but the code step stays the same.