Critical alert
A few days after starting the required registration of phone lines, they began to circulate strong evidence of a critical defect: anyone can register a line using another person's data.
We are talking about a sophisticated explosion. We are talking about basic suplanting of identity, available to anyone with internet access.
What's really going on
users with WhatsApp and Telegram channels have shown that it's possible:
- Use CURP e INE from public sources
- Present videos generated with artificial intelligence
- "Blow" facial monitoring of the system
- Record Lines Without The Royal Holder's Consent
The most visible case was Senator Gerardo Fernández Noroña, but it's not unique. The use of data from public figures such as AMLO and Claudia Sheinbaum was also reported.
The message's devastating: if they can do with them, they can do with you.
The background technical failure
The problem isn't "A"The problem isn't "people". The problem is system design.
The best man relies on three classic mistakes:
1. Facial monitoring without proof of real life
If the system agrees to:
- Unrecorded videos
- Deefakes
- Screenshots
Then No liveness detectionThat's just decorative facial recognition.
2. Identity without context control
The system does not valid:
- Device
- Session
- Risk
- Reattempts
- Signs of fraud
That turns the record into a procedureThat's true.
3. To merge data retention with an identity check
The government insists that data are protected by the Personal Data Protection Act.
That's no good if:
- You don't know who's signing up.
- Can't prove consent
- Can't avoid suplanting
Legal protection does not replace technical validation.
The result: a best man that amplifies fraud
The irony's brutal.
A law established to combat:
- Extortion
- Telephone offences
- Anonymous use of lines
It's creating:
- False identities
- Lines registered with third parties
- Legal risk to innocent citizens
It doesn't reduce crime. Redistribute the risk to the population.
How to avoid this disaster
The suplantation we are viewing isn't inevitable. It's avoidable if the system's been designed correctly from the start.
In JAAK we approach the problem from another angle:
1. Active and real-time liveness detection
We don't accept videos, images and reproductions.
The Liveness detection:
- That's dynamic.
- Reforms to real-time stimuli
- Detects deepfakes and replay attacks
No real life, no identity.
2. Identity as a process, and not as a procedure
Verification isn't a "check".
The following are evaluated:
- Risk signs
- Behave
- Device
- History
- Biometric coherence
Identity is built and isn't assumed.
3. Evidence, traceability and nonrepudiation
Each validation generates:
- Technical evidence
- Temporary sealing
- Legal liability
If anyone tries to purify:
- Detection
- It's locked
- Documentates
That protects both the citizen and the institution.
The lesson that Mexico cannot ignore
Identity systems are not improvised, especially if they are required.
If the registration:
- No real life valid
- No fraud
- Do not protect the user
Then isn't a best man, it's a factory of legal and reputiational problems.
Conclusion
Digital identities are not solved with decrees. They are solved with architecture, criterion and technical responsibility.
And what we're seeing today is exactly what happens when that's missing.