How Deepfakes and Injection Attacks Are Breaking Identity Verification