The CEO was on the video call. He explained why the transfer needed to happen today, why it had to stay confidential, and why the normal approval process had to be bypassed. He was convincing. Authoritative. And entirely generated by AI.

Deepfakes - synthetically generated audio, video, and images that convincingly depict real people saying or doing things they never did - have crossed from a technology curiosity into an active fraud tool. What required a specialized research lab in 2018 can be produced in real time on a consumer device in 2025.

How fraudsters deploy deepfakes:

📄 AI-generated document fraud - Generative AI produces convincing fake payslips, bank statements, invoices, and proof-of-income documents. Used for loan fraud, rental applications, visa fraud, and vendor impersonation. No forger needed - just a prompt. Many standard document verification checks cannot detect AI-generated documents without forensic analysis.

💕 Romance fraud with synthetic personas - AI-generated profile photos establish fraudulent online relationships. Unlike stolen photos, freshly generated images have no prior existence on the internet - reverse image search finds nothing.

🎤 Voice cloning for executive and family impersonation - AI voice clones of executives authorize wire transfers or override security controls. The same technique powers grandparent scam variants - a synthetic grandchild's voice calls an elderly relative claiming to be in crisis. The FTC documented voice cloning as one of the fastest-growing fraud vectors in 2024.^[ref]

📱 Sextortion and manipulation - Deepfake videos placing real individuals in compromising situations are used for extortion. Synthetic endorsements by public figures promote fraudulent investments.

🪪 KYC bypass - Deepfake faces matched to stolen identity documents defeat liveness detection at account opening. A 2024 Onfido report found deepfake attacks on identity verification increased by 3,000% between 2022 and 2024.^[ref]

📹 Video call impersonation in business fraud - A finance employee at a Hong Kong multinational was deceived into transferring HK$200 million (US$25 million) after a video conference where all participants - including the apparent CFO - were AI-generated deepfakes.^[ref] The deception was only discovered after the transfer.

🤖 Real-time deepfake in live calls - Technology now enables live face and voice replacement in video calls - not a pre-recorded clip, but a live overlay. Video call verification has become significantly less reliable as a fraud control.

The challenge is profound: deepfakes attack verification mechanisms humans instinctively trust. We evolved to recognize faces and voices as reliable identity signals. Synthetic media exploits that trust directly.

What can we do:

For organizations:

- Establish out-of-band verification for high-value financial instructions. Never authorize a significant transfer based solely on a video or voice call - verify through a separate, pre-agreed channel.

- Implement pre-agreed code words for executive communications about financial matters. If the code word isn't provided, the instruction isn't authorized.

- Update KYC liveness detection to account for AI-generated video, not just static image swaps.

- Train employees on deepfake impersonation: urgency, secrecy, and authority are the three levers being pulled. If a video call instruction triggers all three, treat it as a red flag.

For individuals:

- Establish a family code word for emergency calls. Absence of the code word = pause and verify independently.

- Be skeptical of any video endorsement of investments by public figures shared on social media.

You trusted your eyes. That was exactly what they were counting on.