Fake AI Identity Reverification Scam: How It Works and What to Do If Your ID Is Exposed

"Your identity verification has expired. Re-verify within 24 hours to keep your account." You already verified once, so the request feels routine, and a polished message from what looks like your AI platform, bank, or favourite app seems to confirm it. The link opens a page that asks for a photo ID, a selfie, and a code. That is the whole trick. The scammer does not need to break anything. They need you to do the "verification" for them.

How fake identity reverification scams work

Scammers copy a request people already expect. Banks run know-your-customer checks, online services check ages and accounts, and some AI platforms ask users to verify their identity for certain features, often through a third-party provider. That makes "please verify again" sound normal. The European Banking Authority notes in its guidance on online fraud in an AI world that criminals use AI to make messages and impersonation more convincing, and it urges people to check the source carefully and use official channels to contact their bank.

1. The notice. An email, text, call, or pop-up says your verification expired, failed, or needs to be "refreshed."
2. The pressure. A short deadline and a threat: suspended access, frozen funds, a closed account.
3. The link. It opens a page that copies a real login or verification screen, sometimes using the name of a real verification provider.
4. The collection. You are asked for a password, a one-time code, a photo of your ID, and often a selfie, sometimes holding the ID.
5. The follow-up. A second request, a call from a "specialist," or an error page that makes you try again.

Who they pretend to be

What scammers do with what you give them

What many guides miss: real verification versus fake re-verification

Guides often say "never click verification links," then leave readers unsure what a legitimate check looks like. The difference is mostly where it starts and what it asks for.

A known verification provider's name does not prove a link is real. ID.me, an identity verification company, says on its help site that verifying with it requires you to create your own account, and that you should be cautious if someone asks you to take a selfie or join a video call without setting one up yourself. The same site warns about fake job offers that ask for a selfie to "verify" you. Whatever the provider, start from the official app or website of the service that asked.

Warning signs of a fake reverification request

• You did not trigger it. It arrived out of the blue, and nothing in your account mentions it.
• It says you must "re-verify" or that verification "expired," especially with a deadline of hours.
• It threatens suspension, loss of funds, or account closure.
• It asks for a password or OTP, alongside documents.
• It asks for a selfie holding your ID, or a video call, through a link or in a chat.
• The address is not the service's own, or includes extra words like "verify," "secure," or "id."
• The link goes through a redirect, a shortened link, or a QR code.
• The sender's address does not match the company, even if the display name does.
• It asks you to pay a fee to complete verification.
• It arrives with a call from a "specialist" who offers to guide you through it.

Realistic scam message examples

These are composite examples written to show the pattern. They are not reports about real people, and the details are made up.

How to check a suspicious URL

1. Do not click. Press and hold a link to read its address without opening it.
2. Find the domain. It is the part right after https:// and before the first single /. In https://account.service.id-verify.net/start, the real site is id-verify.net.
3. Read the ending first. The last parts decide who owns the page. Anything in front can be made up.
4. Compare with the official address, which you take from the service's app, your account, or a bookmark you made earlier.
5. Watch for tricks: extra words ("verify," "secure," "id"), hyphens, swapped letters, or odd endings.
6. Check redirects and shortened links. If the address contains the word "redirect" or another web address inside it, the real destination may differ.
7. Do not trust the padlock. https only means the connection is encrypted. Fake pages can have it too.
8. Look at the page, not just the link. A real verification page does not ask for your password and a one-time code together on a single form.

Try the link scanner

Paste a link, and if you know the company's real address, enter it too. The tool compares the two and looks for common tricks. It reads the text only. It does not open the link, and nothing you paste leaves your browser.

How to reverify safely through official channels

If you think a service may really need you to verify again, go to it yourself.

1. Leave the message alone. Do not click, reply, scan a QR code, or call a number in it.
2. Open the official app, or type the website address yourself. Use a bookmark you made earlier, or an app from your phone's official app store.
3. Sign in and look for a notice. A genuine request will usually appear in your account, such as in a banner, notifications, or a security or verification section.
4. If there is a request, finish it there. If the service hands you to a verification provider, that should happen from inside your signed-in account.
5. If there is no request, the message was probably a scam. You do not need to do anything.
6. Need to ask? Contact the service through the support options inside its app or website, or call the number on your card or official site for a bank.
7. Never share your password or a one-time code with anyone, including a "support agent."

Where did the request come from?

Prevention tips

• Never share passwords or one-time codes, even with someone who says they are from support or security.
• Bookmark the sign-in pages of your bank, email, and AI services, and use the bookmark instead of message links.
• Use stronger sign-in protection, such as passkeys or security keys where offered. Phishing-resistant sign-in is designed to fail on a fake site.
• Use a password manager. If it will not fill your saved login on a "verification" page, the address may be wrong.
• Keep ID photos out of chats and email. Share them only inside a service you opened yourself and trust.
• Use a different password for each important account, so one leak does not open others.
• Turn on alerts for sign-ins, new devices, and transactions.
• Treat unexpected sign-in prompts and codes as warnings. If you get a code you did not request, someone may be trying to get into your account. Do not share it.
• Slow down. Urgency is the scammer's tool, and a real problem will still be there after you check through the official app.
• Talk to family and colleagues, especially people who deal with accounts or ID checks for work.

What to do if your ID documents or login details are exposed

Act quickly, and do not be embarrassed. These pages are made to look routine. The right steps depend on what you shared.

If you entered a password or a one-time code

1. Change the password from the official site, which you typed yourself, and on any other account that used the same one. Start with your email.
2. Turn on two-step sign-in or a passkey, and sign out other sessions if the service allows it.
3. Review account activity, including recent sign-ins, changed details, connected apps, and billing.
4. If you use API keys or saved payment methods, rotate the keys and check the payment methods.

If you uploaded an ID document or a selfie

1. Report lost or exposed documents to the issuer. The UK government's fraud advice says to report lost or stolen documents to the organisation that issued them, such as the Passport Office or the DVLA, and your bank. In other countries, contact your own passport, licence, or national ID authority and ask what they recommend.
2. Check your credit reports for applications or accounts you did not make, and report mismatches to the credit reporting agencies.
3. Consider extra protection against new accounts. In the United States, the FTC's IdentityTheft.gov explains how to report identity theft, get a recovery plan, and place a fraud alert or a credit freeze with the credit bureaus. In the UK, Protective Registration with Cifas asks member organisations to carry out extra checks when your details are used.
4. Tell your bank and the services where you use that ID, so they can watch for misuse.
5. Watch for follow-up. Be ready for calls, texts, and emails that already know your details.

If you shared card or bank details

1. Call your bank or card issuer immediately, using the number on your card, and ask them to block the card and review recent transactions.
2. Dispute any charge you did not make, and ask about your options.
3. Do not move money to a "safe account" for anyone who calls you.

Keep evidence: the message, sender address, links, screenshots, and the details you entered. Be wary of anyone who contacts you offering to fix your identity or recover your money for a fee, which is often a second scam. Recovery cannot be promised, but quick action gives the best chance of limiting the damage.

Where to report, by country

Conclusion

The fake identity reverification scam works because "verify again" sounds like paperwork you have already done. You do not need to judge every message. Treat any unexpected request to verify your identity through a link as unverified, open the official website or app yourself, look for the request inside your account, and never give out passwords or one-time codes. If your documents or logins were exposed, secure your accounts, tell the document issuer and your bank, and watch your credit.

Related scams use the same pressure. Read our guides on the fake digital identity verification link scam (which includes India-specific steps), the fake AI subscription cancellation scam, the fake AI customer support chat scam, and the fake QR code verification scam.

Got a message or link you are unsure about? Paste the text into our free checker for a quick first read.

Frequently asked questions