Your Face Just Became a Password You Can't Change

To get into a social media account in twenty-five U.S. states right now, you may have to hand over your face. Not a password. Your actual face — scanned, measured, stored. And here's the part that should stop you cold. That same face scan is now the easiest thing for a criminal to fake.

If you've ever uploaded a photo to verify your age

If you've ever uploaded a photo to verify your age online, this story is about you. Lawmakers had a reasonable goal — keep kids off adult sites and risky apps. So as of early this year, twenty-five states, plus the U.K., Australia, and Spain, passed laws requiring age checks. To prove your age, many systems now want your biometric data — your face, your unique features. But the tool built to confirm you're really you has become the front door for fraud. So who's actually being protected here?

Let's start with the numbers, because they're hard to ignore. According to fraud researchers, deepfake attempts on identity systems jumped nearly sixty percent in a single year. A deepfake is just an A.I.-generated fake — a face or voice that looks real but isn't. Criminals are feeding these fakes straight into verification systems to slip past the checks. That means the selfie you take to prove your identity? Someone can now manufacture a convincing version of it.

It gets worse. Security analysts read the data on something called injection attacks — where a fraudster slips a fake image directly into the system, skipping the camera entirely. Those attacks rose more than eleven times over the past year. Eleven times. For the rest of us, that means the systems guarding our accounts are being picked apart faster than anyone can patch them.

Here's a twist nobody planned for

Now, here's a twist nobody planned for. When everyone knows deepfakes exist, criminals get a free escape hatch. Policymakers call it the "liar's dividend." It works like this — a real record, a real video, a real piece of evidence shows up. And the guilty party just says, that's a deepfake, it's fake. The flood of fakes lets people dismiss the truth. If you ever end up in a dispute, that's the world your evidence now lives in.

And the laws themselves? They're backfiring in a measurable way. Researchers found that in states with age-verification rules, VPN use spiked roughly fifteen times. A VPN hides your location and lets you sidestep those checks. So instead of complying, people are routing around the rules — into channels with even less oversight. The mandate meant to protect kids is quietly pushing users somewhere harder to watch.

But let's be fair to the regulators. They didn't act in a vacuum. According to fraud researchers, U.S. consumers lost forty-seven billion dollars to identity fraud and scams in a single year. Eighteen million people had their identities stolen. Without rules, platforms had zero reason to lift a finger.