Passport Photo Swaps Beat Online ID Checks in UK Fraud

Online identity checks ask for a passport and a selfie. In this case, the passport belonged to a real customer and the face on it did not.

By Siddharth ShankarUpdated October 11, 2026

Many financial services now verify customers online. You photograph a passport and take a selfie or short video, and software compares the two. This case shows what happens when someone gives that process a passport that has been altered to match their own face.

What happened

The CPS reported that two people were convicted at Inner London Crown Court on October 5, 2023. One received three years' imprisonment plus £1,200 in prosecution costs. The other, sentenced on December 22, 2023, received three months, suspended for nine months.

Potential losses were about £178,000. Actual loss was about £59,000, with a further potential loss of about £119,000. City of London Police built the case and the CPS prosecuted.

How it worked

They applied online for loans, banking and pension products using the identities of genuine customers. They swapped their own photographs into genuine passports that contained those customers' details. They then uploaded selfie images and videos to pass the online identity checks.

One defendant made 90 applications and the other made five. The scale suggests the method was repeatable: once a swapped passport passed one check, the same approach could be tried elsewhere.

What was exposed

The case relied on genuine customers' passport data and personal details. The release does not say how the criminals obtained them. What it does show is the value of a complete identity set: name, date of birth, address and passport details are enough to start a new financial product in someone else's name.

How it ended

The ending is a conviction and a mixed financial outcome. Actual losses were about £59,000, but the potential for a further £119,000 was prevented. For the people whose identities were used, the release does not describe what they had to do to clear their records.

A timeline of the case

The CPS places the convictions on October 5, 2023 and the second defendant's sentence on December 22, 2023. Between them, the two made 95 applications, 90 by one and five by the other, using the identities of genuine customers.

The numbers show a gap between attempt and loss. The potential loss across the applications was about £178,000, but the actual loss was about £59,000. Some checks worked, or the lenders stopped the rest, though the release does not say which.

Key facts at a glance

• Convictions: October 5, 2023, Inner London Crown Court
• Sentences: three years' imprisonment; three months suspended for nine months
• Potential losses: about £178,000
• Actual loss: about £59,000
• Applications: 90 by one defendant and five by the other
• Method: own photos swapped into genuine passports

Why this case matters

Identity verification systems are only as strong as the documents they accept. A passport with a swapped photo is a forgery, and automated comparison between a selfie and an altered photo can pass if the forgery is good enough.

For individuals, the lesson is to protect the documents that identity checks rely on. A scan of your passport that leaks is a ready-made starting point for this kind of fraud. Lenders also share responsibility, because the checks they choose decide how easily a forged document can pass, and you can ask a provider how it verifies identity before you hand over images.

What you can do

What the release does not say

The CPS release does not say how the passport data was originally obtained or how the lenders detected the fraud. For another case where bank staff misused customer data, see the Australian bank insider case.

Your own exposure is the part you can still change. These guides cover what to do if your identity is stolen, when to freeze your credit and how to prevent identity theft. You can also try our free find personal information exposed online.