Skip to main content
NOPE
Medium reported severity Investigation Opened

Spanish police arrest a man in Murcia suspected of using real-time AI face modification and forged ID cards to impersonate more than 30 real people in video identity checks for electronic signature certificates

Spain's Policía Nacional said on 11 August 2026 that it had arrested in Murcia a suspect who tried to obtain electronic signature certificates in other people's names from a company that issues them. During the company's video identity checks the suspect appeared on camera holding a forged DNI identity card while AI software modified the suspect's face in real time to match the photo on the forged document. Police say the suspect made 38 attempts using the identities of more than 30 real citizens and succeeded in impersonating multiple victims, aiming to use the signatures for later scams. A short processing delay in the face-modification software made the digital mask disappear for barely a second, exposing the suspect's real face to the issuer's security staff.

AI system
Unidentified video tool
Occurred
Event date unknown
Reported
11 August 2026
Event location
Spain
What the AI did
Depicted or impersonated the person
Reported harm
Other Material Harm
Whose AI use
Someone else’s AI use
Setting
Privacy · Finance
Evidence
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account
4 claims: 4 reported. 5 open questions
People reported harmed
At least 30 people

AI system as recorded: AI software that modified the suspect's face in real time during live video identity checks to match the photo on forged DNI cards, described by police as deepfake techniques; the program is not named

What Happened

According to the Policía Nacional release (carried by h50 Digital Policial and La 7 TV Región de Murcia on 11 August 2026, and summarised in English by The Register), the investigation began after a company providing electronic-certificate services detected multiple fraudulent applications. The suspect combined forged DNI identity cards bearing digitally altered photographs with deepfake techniques: during the verification video calls the suspect appeared personally before the camera while a program modified the suspect's features in real time to match those of the person whose identity was being impersonated. Household spotlights with coloured bulbs were used to imitate the flashes and holograms of physical ID cards, and VPNs hid the connections. Police say the suspect made 38 attempts on more than 30 identities of real citizens, succeeding in impersonating multiple victims, with the final aim of obtaining authorised digital signatures for later economic scams; The Register adds that police did not say how many attempts succeeded. Investigators also traced more than 320 phone lines on 24 mobile devices, most contracted under impersonated identities and bought at points of sale in Murcia. During one live video identification the face-modification program suffered a short processing delay, and for about one second the digital mask of the victim disappeared, exposing the suspect's real face to the issuer's security staff and leading to identification and arrest.

Reported harm

Police say the identities of more than 30 real citizens were used on forged ID cards and impersonated with real-time AI face modification in 38 attempts to obtain electronic signature certificates, succeeding for multiple victims (Policía Nacional release via h50 and La 7 TV; The Register).

Outcome

Ongoing

Policía Nacional arrested the suspect in Murcia as the alleged perpetrator of a continuing offence of falsifying official documents and searched the suspect's home, seizing an encrypted laptop, several mobile phones, storage devices and documents (police release of 11 August 2026 as carried by h50 and La 7 TV; The Register). The arrest date, any court appearance and any charge decision are not reported.

What remains unknown

  • When the attempts took place and when the arrest was made; the police release is dated 11 August 2026.
  • How many certificates were issued and whether any was used in a later fraud.
  • Which face-modification program was used.
  • Where the issuing company is based and where the impersonated citizens live.
  • Any charge decision or court proceeding.

What the evidence supports

AI involvement: reported. Policía Nacional states that the suspect used artificial intelligence to modify the suspect's face in real time during video identity checks so that it matched the photo on forged DNI cards, combined with deepfake techniques; police call the AI-altered face 'la máscara digital de su víctima'. The tool is not named and the videos were not inspected. The allegation is untested in court. The AI output impersonated the real citizens (depicted_or_impersonated).

4 claims: 4 reported. What the statuses mean

Reported Police say the suspect appeared in an electronic-certificate company's verification videos showing forged DNI cards while AI software modified the suspect's face in real time to match the photo on the forged document and the features of the person being impersonated, making 38 attempts on more than 30 identities of real citizens.

Causal attribution. Police allegation in a press release; untested in court.

  • h50.es(opens in new tab) supports · Spanish
    'El investigado aparecía personalmente en los vídeos de verificación de la empresa mostrando el DNI falsificado mientras que, gracias a la inteligencia artificial, su rostro en pantalla se modificaba en tiempo real para ser idéntico al de la fotografía del documento. De este modo realizó 38 intentos sobre más de 30 identidades de ciudadanos reales.'
  • la7tv.es(opens in new tab) supports · Spanish
    'Durante las videoconferencias de verificación, aparecía físicamente ante la cámara, mientras un programa modificaba sus facciones en tiempo real para que coincidieran con las de la persona cuya identidad estaba suplantando.'
  • theregister.com(opens in new tab) supports · English
    'The unnamed man allegedly made 38 attempts to impersonate 30 people and obtain digital certificates in their names, succeeding on multiple occasions.'
Reported Police say the suspect succeeded in impersonating multiple victims, with the final aim of obtaining authorised digital signatures for later economic scams; they did not say how many attempts succeeded.

Causal attribution. Police statement; no later fraud using the certificates is reported.

  • h50.es(opens in new tab) supports · Spanish
    'logrando suplantar la identidad de múltiples víctimas.'
  • la7tv.es(opens in new tab) supports · Spanish
    'con el objetivo final de conseguir firmas digitales autorizadas que posteriormente pudieran ser utilizadas para cometer estafas económicas.'
  • theregister.com(opens in new tab) supports · English
    'Police did not say how many of the 38 attempts succeeded, only that certificates were issued on "multiple" occasions.'
Reported During one live video identification the face-modification program lagged and for about a second the victim's digital mask disappeared, exposing the suspect's real face to the issuer's security staff; police then arrested the suspect as the alleged perpetrator of a continuing offence of falsifying official documents and seized an encrypted laptop, phones and storage devices.

Causal attribution. Police account of the detection and arrest.

  • h50.es(opens in new tab) supports · Spanish
    'Durante apenas un segundo, la máscara digital de su víctima desapareció de la pantalla, dejando al descubierto el rostro real del sospechoso ante el personal de seguridad de la entidad emisora.'; 'culminando con la detención del investigado como presunto responsable de un delito continuado de falsedad documental en documento oficial.'
  • theregister.com(opens in new tab) supports · English
    'A search of his home yielded a laptop protected by high-grade encryption, several mobile phones, storage devices, and documents, according to police.'
Reported Investigators identified more than 320 phone lines on 24 mobile devices, most contracted with impersonated identities and bought at points of sale in Murcia.

Causal attribution. Police statement; the phone lines are not described as involving AI.

  • la7tv.es(opens in new tab) supports · Spanish
    'Los agentes identificaron más de 320 líneas telefónicas asociadas a 24 dispositivos móviles distintos. La mayoría de estas líneas habían sido contratadas utilizando identidades suplantadas y adquiridas en puntos de venta localizados en Murcia.'

Sources

3 sources inspected, from 1 underlying account. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

Read live in Spanish on 2026-10-02 (h50 Digital Policial, 11 August 2026); the text reproduces the Policía Nacional release. Researcher translation. Applies to s1.

Read live in Spanish on 2026-10-02 (La 7 TV Región de Murcia, 11 August 2026); a rewrite of the same police release. Researcher translation. Applies to s2.

Read live in English on 2026-10-02 (The Register, 11 August 2026); summarises the police release and quotes it in machine translation. Applies to s3.

Event countries: Spain. Affected-person countries: Unknown. Court countries: Unknown.

Policía Nacional arrested the suspect in Murcia, and most of the more than 320 phone lines were bought at points of sale in Murcia. The issuing company's location is not stated in the inspected bodies, and the residence of the impersonated citizens is not stated (a DNI is not used to infer residence). No court proceeding is reported.

Reviewed for publication 2026-10-02: Published as a core case (depicted_or_impersonated): police say a suspect used real-time AI face modification in video identity checks to impersonate more than 30 real citizens on forged ID cards, succeeding for multiple victims. One police chain (Policía Nacional release) read in Spanish via h50 and La 7 TV and in English via The Register; every claim is reported. The suspect and the impersonated citizens are not named. Event date unknown; reported 11 August 2026.

People described

More than 30 real citizens whose identities were used on forged DNI cards and impersonated in video identity checks (not named by police); the certificate-issuing company was also deceived

People reported harmed in this case

At least 30 people

0 AI participants · 30 other people harmed

The Policía Nacional release (h50; La 7 TV) says the suspect, showing a forged DNI while AI altered the suspect's face on camera, 'De este modo realizó 38 intentos sobre más de 30 identidades de ciudadanos reales': each of these real citizens had their identity placed on a forged DNI and impersonated in a live video check, and the release calls the person impersonated in the attempt that failed 'su víctima'. Documented minimum 30 (more than 30). The count is of people whose identities were used, not of issued certificates: impersonation succeeded for 'múltiples víctimas', a number police did not give (The Register). The certificate-issuing company and the people whose identities were used for the 320 phone lines are not counted (the phone-line identities are not tied to the AI use).

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#deepfakes#identity-impersonation#identity-verification-bypass#electronic-signature#arrest#spanish-language

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). Spanish police arrest a man in Murcia suspected of using real-time AI face modification and forged ID cards to impersonate more than 30 real people in video identity checks for electronic signature certificates. AI incidents. https://nope.net/incidents/2026-murcia-ai-real-time-face-modification-forged-dni-video-checks-electronic-signature-certificates

BibTeX

@misc{2026_murcia_ai_real_time_face_modification_forged_dni_video_checks_electronic_signature_certificates,
  title = {Spanish police arrest a man in Murcia suspected of using real-time AI face modification and forged ID cards to impersonate more than 30 real people in video identity checks for electronic signature certificates},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2026-murcia-ai-real-time-face-modification-forged-dni-video-checks-electronic-signature-certificates}
}

Related cases

Low Unidentified video tool

Cryptocurrency analyst Mai Fujimoto reports losing X, Telegram and MetaMask accounts after Zoom call with reported deepfake of acquaintance

Coin Edition (20 June 2025), TradingView and Crypto.news relayed a public account by cryptocurrency analyst Mai Fujimoto. She said her main X account was hacked on 14 June 2025 after a 10-minute Zoom call with what appeared to be an acquaintance whose Telegram account had been compromised. The caller could not be heard and sent a link to fix an audio problem. She believes malware was installed at that point, and the outlets report that attackers then also accessed her Telegram and MetaMask accounts. The outlets describe the caller as a deepfake of the acquaintance. Binance founder Changpeng Zhao commented publicly on 20 June 2025 that video verification may become unreliable. No loss of funds is stated.

Low Unidentified video tool

Analyst Michael Hewson reportedly impersonated in AI-generated video advert directing users to WhatsApp investment group

City AM (dated 21 March 2025) reported that a fake video using AI to pose as Michael Hewson, host of the Good Money Guide Podcast, circulated on Facebook and Instagram that week and directed users to a WhatsApp group with promises of undervalued investments. Hewson said on X that the advert had nothing to do with Hewson, that it had been reported and was being taken up with Meta, and that Hewson was very angry. A Good Money Guide article dated 3 June 2025 (which may describe the same advert or a later one) reported that its report to Meta had not led to removal three days later and that the sponsored post had been viewed 29,000 times. No person is reported to have joined the group or lost money.

Low Meta Muse agent

Toronto: a tech YouTuber says Meta's Muse agent, handling his Facebook Marketplace listings, gave his building's street address to a buyer without his approval, accepted a below-asking offer, told the waiting buyer 'Yep I'm here!' while he was not home, and later sent a fabricated apology in his name

Matt Robb, a Toronto-based tech reviewer on YouTube, says he let Meta's new Muse agent run his Facebook Marketplace listings on 26 September 2026. Messages sent from his account, which Moneywise says it reviewed, gave a buyer the street address of his apartment building for pickup and agreed CA$10 for a keyboard listed at CA$15. Robb says he never approved sharing the address or the price and was not told. According to a recap Muse later sent Robb, the buyer arrived around 9:15 p.m., Muse's auto-reply told him 'Yep I'm here!' at 9:27 p.m. although Robb was out, and he left at 9:38 p.m. with a negative rating; the buyer wrote that he had driven half an hour. Muse then sent him an apology in Robb's voice saying he had 'got tied up'. Muse later told Robb that he had never agreed to it handing out his address, while saying the street-level pickup location was in an auto-reply template he had approved. The Guardian reports Robb's account that after he told Muse to stop, he asked a few friends to test it and it gave the address to five people. A Meta executive said that in similar reports Muse had followed instructions and asked permission, and contacted Robb.

Medium Unidentified video tool

Mother reportedly sought police help after a teen received a fabricated sexual video and extortion demand

A Newswav creator article relays a mother's account that her teenage son received his photograph and a purported AI-generated sexual video through Telegram, followed by a demand for RM5,800. The mother said the family sought police help and that the boy asked a school contact for advice. The article attributes the AI explanation to the family's account and reported police comments. No payment, precise event location or independently verified generation method is established.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents