22/10/2026
Malaysia’s MyDigital ID steps up defences against AI-powered identity fraud
Identity theft is no longer confined to a single compromised account.
Today, personal information can let a fraudster impersonate someone across multiple digital services, coupled with artificial intelligence (AI)-powered deepfakes and cloned voices which make fraud increasingly difficult to detect.
“What has changed is scale and speed at which a stolen identity information and personal information can be reused across multiple digital institutions,” says MyDigital ID's Deputy CEO Ts Azrin Aris.
MyDigital ID is the official digital identity platform launched by the Malaysian government.
According to Aris, identity fraud often succeeds because organisations can verify users through a range of different means, whether it’s a stolen identity card number, a password, or a photograph. MyDigital ID is tackling this risk by verifying users against a single source of truth: records held by Malaysia’s National Registration Department.
“Identity is established once, directly against government records at the National Registration Department, using facial verification and liveness detection to confirm that a real person is indeed present during enrolment," he adds.
MyDigital ID currently has 14.1 million unique users and is integrated with 204 apps and websites.
Making identity theft harder to exploit
After verification, users receive an encrypted digital identity certificate stored in their devices.
The certificate is used for authentication, instead of relying on documents or personal information that can be reused.
“Verification isn't based on that information; it's based on matching the source [of government records],” Aris says.If a certificate is suspected of being compromised, it can be revoked to prevent further authentication with integrated services.
Additionally, MyDigital ID does not retain biometric data after the initial verification process.
Government agencies and banks remain responsible for their own data, platforms, and access rules.
A compromised credential should therefore not automatically provide access to the wider ecosystem of services.
Tackling AI-powered identity fraud
To address AI-powered fraud, MyDigital ID tests its liveness detection technology against spoofing methods, including deepfake-style attacks.
Testing and certification must continue as attack techniques evolve, says Aris.
“Certification isn't a finish line. We continue testing against new and emerging attack methods as they surface, since the threat landscape shifts faster than any single certification cycle,” he explains.
Protection also continues beyond enrolment through controls that check credential validity and unusual authentication activity.
Aris cautions against treating identity verification as a standalone solution to AI-powered fraud.
“Identity verification is necessary, but it works best as one layer within that wider system,” he notes.
Banks, telecommunications providers, digital platforms, and regulators need to share information securely to detect fraud patterns that may not be visible to any single organisation.
Detecting fake content and coordinating responses across institutions remain essential to complement identity protection.
Applying zero-trust principles
Aris highlights that MyDigital ID’s zero-trust approach means that an identity or device is not automatically trusted simply because it has passed an earlier verification check.
"Not assuming that something verified once stays trustworthy indefinitely,” he says.
Every time a digital identity certificate is used, it is checked in real-time to confirm that it remains valid.
The platform also checks device integrity, including identifying signs that a device has been rooted or jailbroken.
“So, if a certificate was legitimate yesterday but has since been revoked, it will not continue to be trusted today,” he says.
The level of verification is adjusted according to the risk of a transaction.
Routine interactions remain straightforward, while higher-risk actions may require multi-factor authentication or additional checks.
This approach is also designed to avoid placing unnecessary burden on users.
A shared digital identity can reduce the need for multiple passwords and repeated forms, while service providers do not have to build their own identity verification systems.
“The technology behind this is genuinely complex, involving digital certificates, real-time validation, device attestation, but none of that complexity should be visible to the person just trying to log in,” shares Aris.
Preparing for emerging threats
Beyond identity fraud, MyDigital ID is anticipating software supply chain risks, including attacks targeting third-party components and software update mechanisms.
Digital identity infrastructure must also protect certificate authorities and the hardware used to secure cryptographic keys.
The platform is monitoring developments in post-quantum cryptography (PQC), which could eventually affect the public key infrastructure used to issue and validate digital certificates.
“We are working with the National Cyber Security Agency and the National Cryptography Centre to understand what that transition could mean for Malaysia's digital identity infrastructure,” Aris says.
Another challenge is ensuring that digital identity can support AI agents that may eventually carry out transactions on behalf of individuals.
This raises the need to establish whether an AI agent is authorised to act on someone's behalf and whether it operates within the limits of that authority.
The long-term challenge for MyDigital is not only to provide a convenient way to log into digital services, but also to sustain trust through continuous testing, clear accountability and cooperation across the wider digital ecosystem.
As AI makes identity frauds more convincing, Malaysia’s digital identity platform is strengthening verification, applying zero-trust principles, and preparing for emerging threats, says MyDigital ID deputy CEO Ts Azrin Aris.
