FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Mortgage brokers
Digital ID and liveness tools help brokers verify borrowers remotely, but they can be fooled by deepfakes and synthetic identities. When a false identity gets through, losses may fall on a lender, a client or the broker, and different policies respond to each.
Part of: AI in Mortgage brokers
In short
Brokers may onboard borrowers remotely using digital ID checks, document scanning and liveness tests that compare a selfie or video with an ID document. AI makes these checks faster but also makes forgery easier: deepfake video and synthetic identities built from real and invented data can pass weak checks. Brokers must meet whatever anti-money laundering obligations apply to them and the identity requirements in lender agreements, and SYSC 8.1.6R keeps them responsible for outsourced checks. A lender claim for negligent checks is usually a PI matter; theft of the firm's own money is a crime matter; a hack is usually cyber.
Remote onboarding tools ask the borrower to photograph an ID document and take a selfie or short video. AI checks the document's security features, reads the data, compares the face with the photo and tests for "liveness" to catch photos of photos or replayed video. Some tools also check electoral roll and credit reference data. FS25/6 notes FCA support for digitising house buying, including streamlining AML checks.
Illustrative scenario: a fraudster creates a synthetic identity using a real address, a fabricated name and a forged passport, and passes the liveness test with a deepfake video. The broker's tool approves the check, and the adviser, who never meets the applicant, packages a buy to let case with forged income documents. The lender completes, the fraudster disappears and the property turns out to be worth far less than the loan. The lender alleges the broker's checks were inadequate.
Other problems include tools that wrongly reject genuine borrowers, particularly those with older documents or less common nationalities, and impersonation of existing clients to redirect funds or change contact details.
Remote onboarding also changes who the adviser is dealing with. Where a borrower is never met in person or on a live call, the broker relies entirely on the tool and the documents. That is efficient for most clients, but it means the broker has fewer chances to notice the small signals, such as hesitation over personal details or someone else answering questions, that experienced advisers often pick up. A risk-based approach, adding human contact where a case looks unusual, keeps the efficiency without relying on the tool alone.
| Loss | Policy usually concerned |
|---|---|
| Lender or client claims the broker negligently failed to verify identity | PI, subject to the wording and any fraud or dishonesty exclusions |
| Fraudster tricks the firm into paying out its own money | Crime or social engineering cover, if bought |
| Hacker accesses the firm's systems or client data | Cyber |
| Regulatory investigation costs | Depends on the policy; check each |
A policy meeting MIPRU 3.2.4R must cover legal defence costs for claims within its scope. The boundaries between policies vary, so check them together. See cyber insurance and AI risks, commercial crime insurance and social engineering fraud.
Apex arranges PI for mortgage brokers. A broker can review where gaps sit between PI, cyber and crime cover. See the mortgage broker AI hub for more.
Some tools are better at detecting deepfakes than others, and the technology on both sides is changing quickly. A passed check reduces the risk but does not remove it, so higher-risk cases may need extra steps such as a live video call.
It depends on whether the broker's checks were reasonable in the circumstances and what the lender agreement required. Under SYSC 8.1.6R the broker remains responsible for outsourced functions, so it cannot simply blame the provider.
Yes. Face matching uses biometric data, which is special category data when used to identify someone, and automated rejections may trigger the safeguards in UK GDPR Art. 22C. Check the provider's data handling and explain the checks in your privacy notice.
That is usually a crime or social engineering matter rather than PI, and not every firm holds crime cover. PI usually responds to claims by third parties alleging the broker was negligent.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
