ABN AMRO Bank N.V. · AI used against the institution · severity 3 of 5
Between 20 March and 13 November 2025 a 34-year-old man opened 47 ABN AMRO accounts in other people's names by submitting manipulated (deepfake) selfies and ID photos that the bank's online identity-verification system accepted, according to the Amsterdam District Court. Per the court's judgment of 17 June 2026, some accounts received money from bank-helpdesk fraud victims and cash was moved through others; the man had also asked ChatGPT how to get around banks' identity verification. ABN AMRO reported the fraud to police after its own investigation. The court sentenced him to 30 months in prison, six of them suspended, and ordered him to pay the bank €13,100 for reimbursed fraud losses and investigation costs. We found no public statement from ABN AMRO about changes to its onboarding.
Record last reviewed Oct 21, 2026 · Markdown
Date
Mar 20, 2025 · disclosed Mar 18, 2026
Institution
ABN AMRO Bank N.V.
Country
Netherlands
AI system
Deepfake face-manipulation used against the bank's remote ID-document-and-selfie onboarding check
AI?
Described as AI by the institution or regulator
The institution, a regulator or a court called the system AI.
Status
Resolved
Severity
3 of 5
Impact
€13,100 awarded to ABN AMRO for money it reimbursed to a bank-helpdesk fraud victim and for investigation costs · 47 accounts opened in other people's names; the court said several people became victims of identity fraud and a number of people lost money through helpdesk fraud routed into the accounts.
What happened?
ABN AMRO's online identity check asks applicants to submit photo ID and verify it by taking a selfie. According to the judgment, ABN AMRO reported to police that during this online onboarding process manipulated images were submitted in three ways: a selfie blended from the fraudster's face and the face on the ID document (a deepfake); an ID document with a photo of the real holder taken from social media or an earlier data leak pasted on; and an ID photo blended from both faces.[2][3]
The court's press release states: "Een 34-jarige man opende met behulp van deepfake-technologie 47 bankrekeningen op naam van anderen. Hij gebruikte gemanipuleerde foto's met biometrische kenmerken, zodat zij door het identiteitsverificatiesysteem van de bank als juist beoordeeld werden" ("A 34-year-old man used deepfake technology to open 47 bank accounts in the names of others. He used manipulated photos with biometric features so that the bank's identity-verification system assessed them as genuine"; our translation). ABN AMRO opened the accounts and sent debit cards to the named account holders.[1][2]
Per prosecutors at the March 2026 hearing, the fraud came to light when one application used a woman's photo ID with a selfie showing a man's face, and ABN AMRO's investigation then exposed it; some identity documents had been collected through an advert for an Amsterdam flat on Marktplaats whose respondents were asked to send ID. Investigators found 39 identity documents or bank-card photos of people named in the bank's report on the man's phone, along with ChatGPT queries about bypassing banks' face verification and an image advertising a "Jumio KYC Bypass Method".[2][3]
The man said he had made videos for what he thought was AI marketing and only realised in September 2025 that they were being misused. The court found that explanation not credible, because searches about opening bank accounts and victims' data on his phone pre-dated that month, and convicted him of fraud using deepfake technology, forging identity documents and possessing data for committing fraud.[2][3]
When did it happen?
- Mar 20, 2025
First of the fraudulent ABN AMRO account openings in the period charged.[2]
- Oct 23, 2025
ABN AMRO files its police report on the fraudulently opened accounts.[2]
- Nov 13, 2025
End of the period in which accounts were opened fraudulently.[2]
- Mar 17, 2026
Trial hearing in Amsterdam; prosecutors seek 30 months, six suspended.[2][3]
- Jun 17, 2026
The Amsterdam District Court sentences the man to 30 months in prison, six suspended, and awards ABN AMRO €13,100.[1][2]
What was the impact?
- Financial: €13,100 awarded to ABN AMRO for money it reimbursed to a bank-helpdesk fraud victim and for investigation costs[1][2]
- Customers: 47 accounts opened in other people's names; the court said several people became victims of identity fraud and a number of people lost money through helpdesk fraud routed into the accounts.[1][2]
Severity 3 of 5: Material harm and a criminal conviction: 47 accounts opened in other people's names, identity-fraud victims, some accounts used for bank-helpdesk fraud, and €13,100 in damages awarded to the bank; losses are small and confined to one institution.
How did ABN AMRO Bank N.V. respond?
No public statement found as of 2026-10-21 (we searched news coverage, the court record and ABN AMRO-related reporting). In the case itself ABN AMRO filed the police report, joined the criminal proceedings as an injured party and claimed €6,700 in material damage plus €6,240 in investigation costs; the court said the bank had reimbursed a customer who fell victim to bank-helpdesk fraud.[2]
What was the outcome, and did regulators act?
Convicted at first instance on 17 June 2026: 30 months in prison with six months suspended, and a compensation order of €13,100 plus statutory interest in favour of ABN AMRO. We found no report of an appeal, and no public information on whether ABN AMRO changed its remote onboarding checks.[1][2]
How did the fraudster beat ABN AMRO's selfie check?
According to the Amsterdam court, he submitted selfies and ID-document photos in which his face was blended with the real document holder's face (deepfakes), or pasted a holder's real photo from social media or a data leak onto the document, so the bank's online identity-verification system accepted them as genuine.
Was any money lost?
Yes, though the court record gives only partial figures. Some accounts received money from victims of bank-helpdesk fraud, and ABN AMRO reimbursed at least one customer. The court ordered the man to pay the bank €13,100 for that reimbursement and its investigation costs. No total loss across all 47 accounts has been published.
Was AI involved?
The court describes the method as deepfake technology: manipulated face images with biometric features made to pass the verification system. The judgment also records ChatGPT queries on the man's phone about getting around banks' face verification. The bank's own verification system is not described in the record.
What sentence did the court give?
On 17 June 2026 the Amsterdam District Court sentenced the 34-year-old man to 30 months in prison, six of them suspended, for fraud using deepfake technology, forging identity documents and possessing data for fraud, taking into account earlier convictions for property crimes in 2022 and 2023.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning