CardLab discusses the solutions that need to be considered to ensure that companies can reap the benefits of AI whilst overcoming the safety and security challenges that come with AI.
Artificial intelligence (AI) has come to stay and has proven very effective in our chase for efficiency, with implementation in many sectors of our society. It has undoubtedly been a great help in gaining overview of massive amounts of data and creating fairly reliable workflows, statistics, predictions, and diagnoses for use in our daily life, both privately and professionally.
With the simultaneous appearance of supercomputers and quantum computing, technological development is faster than ever before and will probably bring improvements to our life we couldn’t even imagine a few years ago. However, there is a flip side as these technologies are not exclusive to people that will use it responsibly, but are also available for malicious purposes.
This article will investigate both sides of the coin and introduce some of the methods recommended by CardLab to harvest the benefits of AI and get the best possible protection against malicious use of AI.
Understanding the benefits of AI
In a study made by Stanford University, researchers found that AI business in the US will increase by approximately a factor of six until 2030, and will at the same time contribute with a 21% net increase to the United States GDP. This indicates that AI can be a significant contributor to the general wealth of society.
From what we can see, this seems to be a general worldwide tendency. In studies made by Stanford HAI, PwC, McKensey and others, the tendencies and productivity gains are further explored with an absolute positive increase in productivity, wealth, and possible other benefits.
Concerns of AI use
In parallel to the increased use of AI, a major concern among consumers is the potential for AI to perpetuate the spread of misinformation. More than 75% of consumers are worried about the impact that AI has on their ability to trust information on the internet. Looking at the internet and the pictures on social media, the concern seems fully valid, with up to 60% of social media content being AI-generated.
In the old days, the saying was: “In love and war, the truth is the first victim.” Maybe we need to change that to: “In AI, love, and war, the truth is the first victim.” In the view of CardLab, it does not necessarily need to be like that, but the fact is that theft using synthetic identities now accounts for 11% of all reported fraud, making it the fastest-growing fraud type worldwide, according to an analysis from LexisNexis Risk Solutions.
An eight-fold increase in synthetic identity fraud in 2025 shows a shift in fraudsters’ tactics, according to the data analytics company’s latest Cybercrime Report. Fraudsters also look at return on investment, and a change in tactics towards investing time in learning technologies – like generative AI – to create sophisticated synthetic identities is an investment to get access to the highest valued assets of today – your data.
Solutions to make AI safer and more secure
Manufactured synthetic identities merge and blend with real identity details from different stolen identities or simply create fake identities from high-resolution pictures and voice snips. Despite advances in presentation attack detection systems, including deepfake detection, stopping such attacks has proven complex. From CardLab’s work with several high-level players in the industry, it has become clear that the main reason for the problem is moving to full digital solutions, where all is based on mathematical logical algorithms.
As one of our partners said: “All that is created by logic can also be broken by logic.” With the immense power of super and quantum computers, the speed at which encryption can be broken is breathtaking. CardLab has provided safety for the digital world for a long time by implementing a strategy to blend online and offline solutions to break and challenge the mathematical logic and secure the validity of data, meaning users can be trusted as real – and not AI-generated – identities, information, or data.
CardLab’s biometric system
In a world where data has become increasingly important and valuable, CardLab provides a solution in the form of a biometric card with data storage capacity and fingerprint recognition of the user to enable release of data and identities. This gives GDPR a totally new aspect as it’s now the user that controls its own data and when it should be exposed, and no one else will have access to the data without the user’s approval in the form of presenting a fingerprint to the card. Benefits include:
- No critical biometric data is stored centrally, with the risk of losing it in case of hacking;
- Tokenised identity and transactions are resistant to a ‘man in the middle attack’;
- Multi-factor authentication is available at a fraction of the time used in traditional MFA solutions; and
- Facility and IT management can be handled by the same card and platform.
CardLab’s experience is that use of online devices is no longer safe for high-security operations, as hackers have easy access to the communication layer on most devices via malware, spyware, or other sophisticated intrusion tools. Lately, we have seen Anthropic’s frontier model that can carry out multi-step cyberattacks that previously required days of human efforts and has shown that this AI model autonomously completed a full corporate network intrusion from initial reconnaissance to total takeover.
It does not mean AI tools and online devices should not be used, but companies and individuals should assess their risk appetite and decide on what security tools to implement. If data loss doesn’t affect your life or operations, full online setups could be fine, but as soon as you have data that is of value to you, you should start considering what security tools should be implemented. Today, the main source of data breaches is still, by far, lost, stolen, or abused passwords and human failure in the authentication process.
The solution made by CardLab is to move away from the use of traditional passwords and instead use biometric tokenised physical and digital access to protect both identity and data, but also very importantly to keep intruders from getting access to your vital data and infrastructure. CardLab’s system is FIDO-certified, both on the passkey and server side.
One could argue that many companies already use biometric access with the help of central fingerprint scanners, face scanners, or other similar methods, but they all rely on central databases, online connectivity, and a template created and transmitted either internally in a phone or in a company access management system, and are therefore prone to hacking. With the rise of synthetic fraud, this is exactly what is happening, and, with an online access management system, there is no certainty that it is the approved users who have entered.
Even with biometrics on an offline device, there are still attack vectors if you produce static data when the fingerprint is approved, as a ‘man in the middle attack’ is possible, picking up the static data by sniffing readers or skimming full systems. However, the first step in security is achieved by verifying the identity offline out of hacker space, which means the biometric data is protected. But, if the data generated is static, this can lead to abuse and fraud or, if your access control is based on central fingerprint, voice, face, vein or other types of access in a connected system, the risk of synthetic fraud has been shown to be significant, especially if you have interesting data in your system.
CardLab has chosen to provide the ultimate security umbrella for digital and physical systems, by providing a complete authentication system that contains these key elements to fully secure verified users:
- Offline biometric identity verification on a biometric card with a fingerprint sensor;
- Tokenisation of identity once the user is biometrically verified; and
- Verification of token and other gating requirements in the authentication system before access is granted to the operational system.
To keep companies’ digital lives safe and secure, it is important that only rightful users get access and only people with approved rights have the ability to make changes to your IT systems and perform updates, initiate encryption (often seen in ransomware attacks), etc. It is recommended that such changes cannot happen without the process being initiated by an authorised person. This can be ensured using the CardLab biometric authentication platform combined with strict company IT policies. To conquer looming threats from AI-assisted attacks, we have seen that at least putting the following precautionary measures in place will have a significant positive effect on synthetic fraud protection:
- Ensure offline biometric identity verification;
- Stop use of static passwords and change to dynamic passwords, FIDO or tokenised access;
- Once KYC is performed, lock the identity to the KYC documentation by issuing offline biometric identification tools;
- Scrap online identity verification methods; and
- Decentralise critical data (i.e., fingerprint, personal data, etc.) to be fully under user control, where the company has no need to hold the data.
KYC/AML requirements are strict in many ways but, with the growth of synthetic fraud, it is a total waste of time and money unless the person being checked at the end of the KYC process is locked to the data provided. With CardLab’s system, this is done with issuing the biometric card where it is required for the user to enrol the fingerprint as the last part of the KYC process. If this is not done, no one can be sure they are dealing with a real person the moment they have left the office, as identities can easily be faked or spoofed with the help of AI. With a biometric card that verifies the user offline and turns the user into a tokenised identity once the identity is verified, there is certainty that you are dealing with the right person, as the token cannot be generated without having the right fingerprint available on a live finger. The positive outcome is that there is now no more need for a KYC process in other places, as it has been performed and other actors will know this to be true as the person is a holder of the biometric card.
CardLab, as a service, helps companies to assess their risk profiles and learn how best to mitigate the risks and obtain the best solution that in most cases can be fitted directly into the company or organisation’s existing infrastructure without large implementation efforts. It has, from the beginning, been a leading star that CardLab’s solution should be user-friendly, convenient, and secure and offer the best protection physically and digitally to its users. It also means that the solutions are with a scalable security level to fit the users’ specific needs and security requirements, but always with the aim to: PROTECT THE WORLD’S MOST IMPORTANT DATA – YOUR DATA.
Please Note: This is a Commercial Profile
Please note, this article will also appear in the 26th edition of our quarterly publication.
