Deepfake is more than a swapped face in a video[1][4]
Popular culture reduces deepfakes to a celebrity face swapped into a clip. For fraudsters, the more useful concept is a whole synthetic toolkit: generated profile photos, fake identity documents, voice cloning, real-time video, automated translation and text tailored to a specific victim.
The FBI/IC3 warns that generative AI can increase both the scale and credibility of existing financial-fraud schemes. Criminals can create profiles, websites, messages, document images and video faster while eliminating the spelling and language errors that once acted as warning signs.
That is the central shift. AI rarely invents a completely new crime. It lowers the cost of running an old one and increases the number of believable attempts a criminal can launch.
The typical attack chain
A convincing deepfake scam rarely starts with generating a video. First comes data collection: social-media photos, voice samples, job titles, family relationships, suppliers or company structure. The attacker then builds a synthetic persona or a clone of a real person.
The second stage is context. A cloned CEO voice is not convincing if the conversation does not fit the organisation. Generative AI helps prepare messages, translations and a plausible scenario. Only then comes pressure: an urgent transfer, new bank details, an authentication code, system access or a confidential document.
The most dangerous moment is when synthetic audio or video is not the first contact but the “final confirmation” designed to disable the victim's remaining suspicion.
FBI data: AI is already visible in real loss categories[2]
The FBI's 2025 IC3 report identifies complaint categories with an explicitly reported AI nexus. Victims reported almost $13 million in losses from AI-involved employment scams. In investment complaints with a reported AI nexus, losses exceeded $632 million.
Those figures should not be read as the total size of “AI fraud”. The FBI notes that many victims may not realise how AI was used. The numbers are better understood as the visible, labelled layer of a broader problem rather than a complete measurement.
The report describes voice spoofing or potential voice deepfakes in remote job interviews and AI-generated videos or voices of celebrities, CEOs and trusted figures used to reinforce investment scams.
The important shift is not that AI invents fraud. It increases the credibility and throughput of schemes that were already profitable.
Voice cloning: why your ears are not authentication[3]
Voice cloning is powerful because people treat a familiar voice as a strong identity signal. The FTC describes scams where synthetic speech impersonates relatives or executives to obtain money or sensitive information.
The FTC also emphasises that there is no single technology that solves the problem. Watermarks can be altered or removed, detection performance varies, and authentication mechanisms need to be built into communications systems and business processes.
The practical conclusion is simple: asking whether a voice “sounds real” is weak control. Independent verification through a channel the caller does not control is much stronger.
Images and video are often used to manufacture trust[1][5]
The FBI lists generated profile photos, identification documents and videos depicting public figures, executives or authority figures. In some schemes, private video communication is used to “prove” that an online contact is a real person.
That means authenticity must be treated as a process question. A convincing-looking file should still be checked for provenance, metadata, synthetic signals and context. Conversely, a detector score should not replace identity verification.
INTERPOL's 2026 global financial-fraud assessment also describes deepfake-as-a-service and synthetic identity kits that combine video avatars, voice clones and biometric material. Fraud technology is increasingly becoming a purchasable service rather than a specialist skill.
A company control set: how not to approve a payment because of a deepfake[1][3]
The best controls are often boring — which is exactly why they work. Assume that email, caller ID, voice, profile photo and a video-call image can all be forged. Authorisation must therefore not depend on any one of them.
- A supplier bank-account change must be verified through a channel known before the change request arrived.
- Payments above a defined threshold should require a second person or an independent second factor.
- Use a call-back procedure: end the call and dial a number stored in the company's trusted directory.
- Do not treat video calls as strong authentication simply because a face is visible.
- Preserve suspicious files and message headers so they can be analysed and reported later.
- Train staff to recognise the social-engineering pattern: urgency, secrecy and requests to bypass normal procedure are part of the attack.
Controls for individuals: family emergencies, investments and urgent requests[1][2]
The FBI recommends agreeing a secret word or phrase within a family and independently calling the person who supposedly needs help. This is simple but robust against many scenarios where the attacker has a voice sample but not the shared secret.
Investment fraud can involve an entire synthetic environment: a generated expert, professional videos, fake user comments, a chatbot and a fabricated account dashboard. Verification has to cover the company, licence, domain and money flow rather than only the person appearing in the advert.
If someone demands an immediate bank transfer, cryptocurrency, gift card or access code while discouraging independent verification, the technical quality of their voice or video is secondary.
Deepfake detection should support controls, not become a binary gate[3][4]
Detection tools matter, but they are strongest as decision support. High-risk media can be routed to manual review, an original file can be requested, provenance can be checked and additional identity controls can be triggered.
That approach matches the broader institutional picture: the FTC says there is no single silver bullet, while law-enforcement organisations describe fraud as a combination of technology, social engineering and criminal infrastructure. Defensive technology must also combine layers.
The worst possible social outcome of deepfakes would be to conclude that nothing can be trusted. A better model is trust by verification: less trust in a single signal and more trust in a process that can be repeated, documented and audited.