Chapter 65: Identity Verification in the Digital Age: When to Suspect and When to Verify

Throughout my professional career as an attorney and notary, I have encountered many cases where the ground beneath people's feet fell away. I have seen retirees who lost their savings and executives who discovered that the company they built had fallen victim to a sophisticated scam. But if there is one thin line that runs through all these cases, it is not necessarily a technological weakness or a security breach in servers. That line is trust. Basic human trust, which allows us to maintain a society, a family, and an economy, has become our most lethal vulnerability in the digital age.

Once, in the physical world, “identity verification” was a simple matter. We saw the person’s face in front of us, heard the sound of their familiar voice, and recognized their unique handshake. As a notary, part of the professional duty is to verify, through an identification document and physical presence, that the signing person is indeed who they claim to be. But in the virtual space, all these identity markers have disintegrated. The image is a file of pixels, the voice is a digital sample, and the text is a line of code. In this chapter, we will analyze the digital identity crisis, learn to identify the cracks in the masks of fraudsters, and understand how Israeli law might deal with a world where “seeing” is no longer “believing.”

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

Dahlia's Perfect Storm: When the Voice of Kinship Becomes a Trap

Dahlia (a pseudonym), 68, was a woman who knew the financial world well. As a former CFO, she was familiar with supplier workflow patterns and was aware of fraud attempts. She lived in her apartment, and her closest contact was her daughter, Maya, who was working as a journalist abroad at the time.

Tuesday, 2:00 PM. Dahlia was sitting on her balcony when her WhatsApp buzzed. A message from Maya. But something was different. “Mom, this is my temporary number. My phone was stolen along with my bag. I’m in terrible distress, please answer.”

Dahlia felt her pulse accelerate. She tried to call Maya's regular number, but it was off. She sent a message to the new number: “Maya? Are you okay?” Immediately, a voice message arrived. Dahlia pressed the play button. It was Maya’s voice. Exactly her voice—the slight rasp, the fast tone when she is stressed, even the special nickname she calls her by.

“Mom, I’m at a police station. I’m stuck with nothing. They stole my passport and wallet. I must pay an urgent fine and bail so they don’t arrest me tonight. Please, I’m sending you details for a quick transfer. I’m at my wit's end.”

Dahlia did not hesitate. Her maternal instinct overcame any internal skepticism. She tried to ask questions, but the “daughter” on the other side answered impatiently, crying, while incorporating details that Dahlia knew to be true—the fact that Maya was abroad and the family dog's name. What Dahlia did not know was that all this information could be visible on social media profiles, and that the voice she heard could be produced using artificial intelligence (Voice Cloning) based on existing videos online.

Dahlia logged into her banking app. The required amount was very significant—“for a local attorney and bail for the court,” she was told. She performed the transfer to an account at a foreign bank, as instructed. When the bank clerk called to verify the unusual transfer, Dahlia, under the weight of emotional pressure and the “daughter’s” instructions (“Don’t tell them it’s for me, they will delay everything due to money laundering procedures”), confirmed the transaction with full confidence.

An hour later, Maya’s regular phone rang. “Hi Mom, how are things? I just finished an interview.” Dahlia felt the blood drain from her face. “Maya? Are you... you’re not at the police station? Didn’t they steal your phone?” The silence on the other end of the line was the bitterest answer of all. The money was already on its way to an unknown destination. Dahlia’s fortress had been breached using an imitation of the person most dear to her.

The Anatomy of Impersonation: Why Are We Vulnerable?

Such cases do not stem from a lack of understanding, but from social engineering. To understand how to verify identity, we must first understand how scammers try to “steal” it in our eyes. Digital verification relies on three pillars, and scammers try to bypass all of them:

1. Something you know

In the past, a password or a “secret question” provided sufficient protection. Today, in an era of database leaks and social media, a lot of personal information may be accessible. A scammer can know details about vacations, family members' names, and other personal details posted online.

2. Something you have

A cell phone or a specific phone number. Through “spoofing” techniques (faking the caller ID), scammers can make the phone display the name of a known organization or contact. When a person sees the familiar name, the brain recognizes the logical context and projects it onto the physical identity.

3. Something you are

Here enters Deepfake technology. It is not just about images, but about voice and video imitation in real-time. Technologies exist that sample sound waves and produce new output at the same frequencies and intonations. For the human brain, which is accustomed to relying on hearing as an indicator of identity, this is a manipulation that is difficult to resist.

Legal Aspects: Between Financial Institution Liability and Customer Liability

In such scenarios, the central question is whether the financial institution should have prevented the action. Israeli law discusses the issue of digital fraud, and the answer depends on the specific circumstances of each case.

Payment Services Law, 5779-2019

This is the primary law governing the relationship between a customer and a financial institution in the event of “unauthorized use” of a payment instrument. As a rule, the law states that the customer may not be liable for use made of their payment instrument without their consent. However, there is a caveat: if the customer acted with “fraudulent intent” or if they provided the payment instrument details or the execution confirmation “under circumstances of gross negligence.”

In analyzing similar scenarios, a legal dispute may arise. On one hand, the customer is the one who initiated and approved the action. On the other hand, it can be examined whether in circumstances where a customer performs an extremely unusual transfer to a destination abroad, while displaying signs of stress, the financial institution has an increased “duty of care.”

Bank Duty of Loyalty and Care

Case law in Israel discusses the duties of trust and care that banks owe to their customers. In a general legal analysis, it can be said that when clear “red flags” exist, a requirement may arise for the bank to perform a deeper investigation. If it is found that a bank did not act in accordance with procedures or ignored a known fraud pattern, the possibilities for restitution can be examined according to the circumstances.

It is important to emphasize: Courts examine each case on its merits. The question is examined as to whether the customer should have been suspicious, and whether the technological means used by the scammer were so advanced that even a reasonable person might have erred. The more sophisticated the impersonation, the more the legal analysis of the parties' liability may change.

When to Suspect? Warning Signs of Faked Identity

In a world where digital may distort reality, it is worthwhile to develop higher awareness. Here are circumstances in which it is recommended to increase alertness:

1. A new and unexpected communication channel

If a close person, who always corresponds through a specific channel, suddenly sends a message from a “temporary number” or a new profile, this is a reason for suspicion. The explanations may sound logical (a lost or stolen phone), but this is a moment that requires additional verification.

2. Extreme urgency and emotional pressure

This is a common tool for impersonators. Creating pressure is sometimes intended to prevent a rational examination of the request. The more urgent the request is presented as, the more recommended it is to slow down the pace and check.

3. A request for secrecy

An attempt to isolate the person and ask them not to share the request with others may indicate a fraud attempt, out of a desire to prevent another party from pointing out the contradictions in the story.

4. Discrepancies in small details

Even advanced technology may make mistakes. Uncharacteristic language, unusual spelling errors, or evasion of personal questions should raise red flags.

The Verification Protocol: How to Really Verify Identity?

To defend yourself, you can adopt methods that combine common sense. If doubt arises, it is recommended not to continue the conversation on the same channel. Here are possible steps:

Out-of-Band Verification Method

If a message was received from a new number, it is worthwhile to try contacting through the familiar and old channel, or to contact other people in the environment of the person reaching out. If an official body calls, it is recommended to hang up and initiate a call to the official number of that body as it appears on its website.

The “Secret” Question

One can define in advance with family members a question that only the family members know the answer to, something that was not posted on social media. If the other party avoids answering—there is room for heavy suspicion.

Requirement for a Real-Time Video Call

One can ask the person to perform a certain physical action in front of the camera. Some technologies may struggle to track fast and complex movements, which might reveal the forgery. However, it should be remembered that technology continues to evolve.

Impersonating Authorities

Another type of impersonation is as law enforcement agencies or official authorities. In these cases, threats of sanctions or legal pressure are used.

It is important to know: Israeli law enforcement authorities do not usually request money transfers to accounts abroad or the disclosure of bank access codes over the phone. Official payment demands are usually sent through regulated means. Urgent financial activity requested by phone by someone claiming to be a person of authority should be checked with great caution.

Additional Legal Aspects: Privacy Protection and Fraud

Beyond the Payment Services Law, there are additional legal causes that can be examined. The Privacy Protection Law deals with the use of personal information. In cases where information has leaked from databases, the liability of the party that held the information can be examined. Additionally, there is the “tort of deceit” according to the Civil Wrongs Ordinance, which requires proof of a false representation made with knowledge and intent to mislead. In these cases, legal efforts often focus on examining the liability of intermediaries in the payment chain.

Recommended Steps in Case of Suspicion or Harm:

• Stop: Refrain from performing additional actions despite the pressure.
• Documentation: Saving screenshots, recordings, and phone numbers.
• Report to the Financial Institution: Immediate contact with the bank’s security center.
• Contact the Police: Filing a complaint is an important step for pursuing future rights.
• Account Security: Changing passwords and access details if these have been exposed.
• Legal Consultation: Consulting with a professional to examine options for action against relevant parties.

Warning Signs (Summary)

• A sudden change in the contact details of a known person.
• An urgent financial demand under stories of extreme pressure.
• Evasion of identity verification through direct methods.
• A request for money transfer through unconventional channels.

Legal Aspect (Summary)

The liability of banks and financial institutions is examined according to standards of care and loyalty. The Payment Services Law may provide protection to the customer, subject to an examination of their conduct. The legal trend examines cases according to technological development and the unique circumstances of each event. The more sophisticated the fraud, the more it may affect the distribution of legal liability.

In the digital world, awareness and healthy skepticism are important tools for self-protection. Strict identity verification may prevent heavy damage, and it is important to remember that asking for verification should not cause discomfort to the other party.