Man impersonated 30 people in Spain with AI to obtain their digital certificates

The face on screen matched the photo on the ID card, and the card even caught the light like a real one. What the man was trying to walk away with would have let him sign legal documents and deal with the Spanish state as somebody else. 

The second-long glitch that undid the attempt

The man was not playing a previously edited video of someone else, he was sitting in front of the camera himself and holding up a forged DNI (Spanish national identity card) while software altered his features live so they matched the photograph on the document, and let him move, speak and respond naturally through the check. According to the National Police, it worked well enough to be attempted 38 times, using more than 30 identities belonging to real people. 

During one of those checks the program lagged and for roughly a second the digital mask disappeared and the camera recorded the face of the person actually making the request, before the disguise reappeared. The certificate company had kept the full recording of the session, and that single second became one of the main leads in the investigation, police said.

What a certificate in someone else’s name unlocks

An electronic certificate is the master key to dealing with the Spanish state online. It carries a qualified electronic signature, which under Spanish and European law has the same legal weight as a signature written by hand. Anyone holding one in another person’s name can log in as them at Hacienda (the Spanish tax agency) and see their full income and tax history, file or amend a return, and alter the account a refund is paid into. The same credential opens Seguridad Social (the social security system), where benefits are claimed and workers are registered, along with town hall paperwork, vehicle records and company filings.

That is why police said the aim was later financial fraud rather than the video call itself. A forged card only had to survive a few minutes in front of a webcam, as a certificate issued by a legitimate provider keeps working afterwards, and it carries the real person’s identity wherever it is used.

More than 30 people had their details put through that process. Some may have no idea their information was even circulating at all.

Coloured bulbs and a tilted card to fake the holograms 

Changing his face was only half the man’s problem and the first step to being believable. The operator on the other end also had to be satisfied by the document itself. Police said the man used forged DNI cards with altered photographs and personal details, then built a small studio around them. Household lamps fitted with coloured bulbs were positioned to reproduce the flashes and reflections a genuine card gives off under light. A fairly genius idea. He also rocked the card in front of the webcam to imitate the way holograms shift on a real document. Officers described the combination as a pioneering technique.

More than 320 phone lines traced back to 24 handsets

Working from the real face, investigators began cross-checking the applications against each other: emails, telephone numbers, payment methods, devices and connection data. Then requests that looked entirely unrelated started pointing at the same person. Police identified more than 320 telephone lines linked to just 24 mobile devices, most contracted using other people’s identities and bought from outlets in Murcia. 

The man had also used tools to obscure where his connections came from. Police noted those tools are legal and widely used for ordinary privacy reasons, but said here they formed part of a structure designed to separate the activity from his real identity.

How to check whether a name has been used

The man was arrested in Murcia on suspicion of a continued offence of forgery of an official document. Officers searched his home and seized an encrypted laptop, several mobile phones, storage devices and paperwork, all of which still has to be analysed to establish whether more identities were involved. Police have documented 38 fraudulent attempts rather than 38 completed frauds, and no figure has been released for money taken.

Anyone worried their details have been used elsewhere can request a free report from CIRBE, the Bank of Spain’s credit risk register, which lists loans and credit registered against their name. Suspected identity theft should be reported to the Policía Nacional or Guardia Civil.