What is Deepfake Fraud?

Deepfake fraud has moved from science fiction to a multi-billion dollar criminal industry. Criminals now use AI to impersonate executives on video calls, bypass identity verification, and fabricate evidence.

Real-World Cases

The $25 Million Video Call (2024)

A finance employee at a Hong Kong multinational was invited to a video conference call with the company's CFO and other executives. Everyone on the call was a deepfake — AI-generated video recreations of real colleagues. The employee was convinced to transfer $25.6 million across 15 transactions.

CEO Voice Fraud ($243,000)

The CEO of a UK energy company received a phone call from his "boss" — the head of the parent company. The voice was an AI clone. He was instructed to urgently wire $243,000 to a Hungarian supplier. He complied because the voice was indistinguishable from the real person.

KYC Bypass

Criminals use deepfakes to pass Know Your Customer (KYC) identity verification — creating synthetic video of a person holding their ID, matching the photo and performing liveness checks that facial recognition systems accept.

Attack Methods

Real-Time Video Deepfakes

• AI generates a video feed that maps the attacker's face and expressions onto the victim's appearance
• Used in live video calls (Zoom, Teams, Google Meet)
• Quality has improved to the point where real-time deepfakes are difficult to detect without specialized tools

Pre-Recorded Deepfakes

• Higher quality since processing time isn't constrained
• Used for fabricated video evidence, social media manipulation, and pre-recorded messages

Voice Cloning

• As little as 3-30 seconds of audio creates a convincing voice clone
• Used for phone-based financial fraud, voicemail manipulation, and authorization bypasses

Detection Challenges

• Consumer deepfake detection tools are unreliable (high false positive/negative rates)
• Quality improves faster than detection capabilities
• Live video deepfakes are harder to detect than pre-recorded ones
• Most people cannot reliably identify deepfakes without AI assistance

How Organizations Can Protect Themselves

1. Multi-channel verification — Never authorize large transactions based on a single communication channel
2. Code words or phrases — Establish verbal passwords for high-value authorization
3. Callback procedures — Always call back on a known number, not the number used to contact you
4. Deepfake detection tools — Implement AI-based detection for video conferences
5. Transaction limits and delays — Require multiple approvals and mandatory waiting periods for large transfers