In an era of rampant identity theft and artificial intelligence's ability to clone voices and create deepfaked videos, it is getting harder to know what is real. That is giving financial advisors something else to worry about.

Advisors undertake a series of verification steps when adding new clients-a process known as onboarding-to ensure they are who they say they are. That typically includes verifying IDs, basic personal information, and prospective clients' financial history. Some registered investment advisor firms rely on their custodian to handle identity verification. Others outsource the process to a vendor or handle it themselves.

The problem is that identity checks, including videoconferencing, can be fabricated, which has created a sense of vulnerability in the wealth management space and uncertainty among advisors about who they are dealing with.

"A video call used to be the thing that made you feel better, and now even that can be faked," says Steven Crane, founder of Financial Legacy Builders.

One advisor, who spoke on condition of anonymity to describe a sensitive, continuing situation, recounted bringing on a new client who wanted to move money from a large national brokerage firm. The prospective client seemed a perfect fit for the advisor's practice, provided the requested documentation, and passed all the identity-verification questions posed by the firm's custodian-no red flags. Then things got weird.

Fraud alert. The client seemed in a hurry to move her accounts from the brokerage firm to the advisor's RIA. She contacted the custodian to request a distribution from an IRA account, then called the custodian to reverse it, and instead asked to set up a series of $40,000 wire transfers from her advisory account. That triggered a fraud alert, prompting the custodian to freeze her accounts and notify the RIA.

At that point, the advisor says she made numerous attempts to get the client to explain what was going on. The client had told the custodian that she needed the money to help her sister with her business. The RIA contacted the sister, who said she had made no such request. The client was evasive in her interactions with the advisor, telling her at one point, "I can't talk to you on this phone line," the advisor says. In a subsequent meeting on Zoom, the advisor told the client that if she couldn't provide an explanation, her $3.5 million-money the client originally said she needed to live on-would remain frozen at the custodian. The client was unfazed. "There's no hysteria," the advisor recalls. "There's no nothing."

Impostor or real person? The experience was unsettling, and remains a mystery. The advisor says she ultimately cut ties with the client, leaving her accounts locked up with the custodian. The advisor wonders whether the client was being extorted, attempting to launder money, or was an AI deepfake, though at one point on a Zoom meeting the advisor asked the client to walk into another room and produce identification, which she did.

"I don't know what just happened, and it really bothers me," the advisor says. "Is this an impostor? Is this a real person?"

At the moment, the primary threats RIAs face relating to client verification involve fraudulent documents and stolen personal information that is easily and cheaply obtainable on the dark Web, along with emails and phone calls impersonating real clients. Deepfaked video and voice-cloning technologies, while very much available today, are still relatively rare scams targeting financial advisors, according to Bryan Lewis, CEO of the identity-verification provider Intellicheck. For now.

"It's coming. I think people are getting more and more aware of it," he says. "I would expect as [the technology gets] better you're going to see more and more attempts."

Lewis sees two primary types of identity scams targeting advisors: account takeover and account opening. From the crook's perspective, the goal of taking over a legitimate client's account and gaining access to their funds is straightforward. Fabricating an identity to create and fund a new account could be an attempt to launder money. It could also aim to create a legitimate-seeming identity that could then be used to obtain loans that the scammer would never intend to repay.

Those efforts sometimes come with red flags that are easy to spot. Meredith Schneider, founder of Schneider Wealth Management, says her firm has been receiving inquiries purportedly from prospective clients who insist on providing their own Zoom link and claim that they are deaf and need to "provide a certain technology to enable the conversation." She adds, "When we try to respond with a reasonable email, they always disappear." Schneider suspects that her firm is dealing with scammers attempting to gain access to its computer systems. "Many of my colleagues have experienced the same thing."

Impostors who take a more conventional approach to engaging with an RIA often come equipped with a trove of personal identifying information required to open an account. Lewis says that a high-quality driver's license can be obtained online for about $60. "[The] cost of a complete identity on the dark Web for a person-name, address, date of birth, and Social Security number, email and phone (this is called a 'fullz')-averages $30 to $40," he says.

Verification challenges. The ready availability of that material can create a problem that advisor Joshua Mangoubi, founder of Considerate Capital, calls "circular verification," in which advisors might accept a "client" who is actually a synthetic fabrication wrapped around a real person's identity based solely on information provided by the impostor.

"A driver's license, a matching selfie, a cellphone, an email address, and an appearance on Zoom may feel like five separate checks being validated," he says. "But if the applicant can provide all five, they're not actually independent."

He says he looks for odd blinking patterns and lips moving out of sync with the voice on video calls, but also makes independent checks into areas such as a prospective client's account ownership history and their sources of funding.

It can be an asymmetric battle. As the tools of identity become more sophisticated and more cheaply and widely available, the cost of trying and failing to fabricate an identity falls. Advisors are on the losing end of that cycle of commoditization, according to Taylor Faw, chief compliance officer and chief operating officer at Strathmore Capital. Faw likens the challenge to "garden-variety phishing attempts," where "the threat is about quantity, not quality. Threat actors can afford to fail hundreds of thousands of times. Advisors can't afford to fail once."

Faw and other advisors argue for taking a broader and perhaps slower approach to onboarding clients. He says his suspicions mount when multiple red flags pile up, such as a sense of urgency on the part of the prospective client, a reluctance to engage in a live verification, emails that seem scripted, or discrepancies in documentation or personal information.

Brandon Cox, an advisor with Coastline Complete Wealth, argues that one of the best defenses against impostors setting up fraudulent accounts with an RIA is "pretty old-fashioned: Actually know your client," he says. "Talk to them, ask unscripted questions, understand where their money came from, and independently verify things that matter."

If that means the onboarding process takes longer than the prospective client would like, so be it, Crane says. "If something feels weird, I am stopping the process and checking it again, even if it annoys the person," he says. "I would rather lose a prospect than let a fake person into the system and spend the next six months cleaning up a mess."

Write to advisor.editors@barrons.com