How deepfakes are threatening fintech and banking

In 2024, a Hong Kong firm employee was asked to transfer $25 million in a video call that included senior executives, including the company’s chief financial officer. However, it turned out that every participant in the call was a “deepfake,” a highly realistic AI-generated imitation, created specifically to scam money out of the company. This case has since exemplified how AI can be weaponized to commit large-scale financial fraud.

Fraudsters use AI to create deepfakes with the goal of mimicking real people so they can gain access to a company’s finances or data. Given the accessibility of AI tools, deepfakes now pose a major cybersecurity threat, resulting in catastrophic results such as the loss of $25 million.

In this article, I explore how deepfakes are disrupting fintech and banking, why financial institutions in particular are vulnerable to deepfakes, and what can be done to prevent being targeted by deepfake financial scams. Keep reading to find out more.

What are deepfakes?

Deepfakes are AI-generated videos, images, or audio clips that convincingly imitate real people. Fake footage such as deepfakes rely on generative models, trained on large datasets of photos, videos, and voice recordings to successfully mimic unique facial expressions, lip movements, and vocal patterns.

For malicious actors, deepfakes are a powerful new tool that can increase their chances of succeeding at fraud. Instead of faking company IDs or forging documents, they can generate AI audio, videos, and photos of company executives or employees. They then use these to trick other employees into revealing critical information, approving payments, and performing other fraudulent activities.

According to a 2023 report by Deloitte, deepfake-related incidents in the financial sector rose by over 780% in Europe, demonstrating the increasing widespread use of these AI-generated footage. Partnered with familiar tactics like phishing and spoofing, deepfakes are now a part of large-scale attempts to commit financial fraud.

How cybercriminals use deepfakes for financial scams

Malicious actors constantly adapt their methods to new technologies. By combining realistic AI-generated deepfakes with traditional tactics, fraudsters can attempt to steal millions from businesses and individuals around the world.

Here are some common and emerging uses of deepfakes when it comes to financial scams:

• Impersonating executives. Fraudsters can create convincing deepfake videos or voice calls of company leaders that instruct staff to authorize urgent transfers.
• KYC and ID verification fraud. Deepfake faces can be used to pass Know Your Customer (KYC) and onboarding checks, allowing scammers to open fraudulent accounts or transfer money into their own accounts.
• Voice cloning for phone scams. AI can clone a person’s voice using only a few seconds of audio. Criminals can then use these clones to call victims, often posing as relatives, financial advisors, or bank officials. They then request sensitive information or urgent payments.
• Deepfake-enhanced phishing. Traditional phishing emails or messages can now be paired with deepfake videos to show authenticity. For example, a deepfake video message of a manager or client can convince employees to click malicious links embedded in emails.
• Fake customer support or investor calls. Scammers can impersonate company representatives or investors in live video chats to obtain account details, passwords, or wire approvals.
• Fake vendor calls. Deepfakes can also impersonate suppliers or procurement officers in video calls, where fraudsters can change payment instructions, reroute invoices, or authorize fraudulent shipments.
• Fake identity creation. Criminals can merge real data from data breaches with AI-generated faces and documents to build entirely new digital personas that they use to pass background checks and credit screenings.
• Insurance and claims fraud. Fraudsters can use fabricated video or audio to support false insurance claims, making it harder to distinguish between legitimate from staged events.
• Extortion and blackmail. Attackers can create compromising fake videos of executives or customers and demand payment or else they release the sensitive media to the public.

Why fintech and banking are vulnerable to deepfakes

Fraudsters go where the money is. Naturally, the business and finance sectors hold special interest for them. However, it’s also true that these industries are especially vulnerable to the use of deepfakes. Here are several reasons why:

• Digital-first operations. Fintech firms rely heavily on remote onboarding and automated verification processes, which can be bypassed with deepfake-generated images, videos, or audio.
• Speed over security. Startups frequently prioritize user experience and fast onboarding over comprehensive security protocols. This can leave gaps in fraud detection systems.
• Biometric reliance. Many fintech and banking apps use facial recognition, voice authentication, or fingerprint scanning. Hyperrealistic deepfakes can trick these systems, allowing unauthorized access to accounts and sensitive information.
• Customer trust bias. Users tend to assume that financial apps are secure and properly verify identities. This confidence can make them less cautious when authorizing transactions, creating opportunities for deepfake-based scams.
• Cross-platform risk. Fraudsters can move quickly between payment apps, crypto exchanges, and online banking platforms. A compromised identity on one platform may be exploited across multiple financial services.
• Cost. Smaller fintech companies often lack the budget or expertise to implement advanced deepfake-detection infrastructure.
• Limited employee training. Staff may not be familiar with the latest deepfake threats, increasing the chance of human error in verifying requests or identities.
• Insecure hosting. Weak encryption, outdated infrastructure, or poor access controls make it easier for attackers to steal data and then deploy deepfake content.

How to prevent deepfake financial scams

Institutions can prevent deepfake financial scams by taking a proactive approach to security and training. No single solution can eliminate the risk completely; instead, multiple defense mechanisms must be used. Here’s how you can prevent your deepfake financial scams from impacting your company:

• Vulnerability identification. Assess existing systems and identify potential vulnerabilities in your infrastructure before they get exploited.
• Incident response planning. Establish clear procedures for suspected deepfake scams. This ensures swift containment, reporting, and mitigation of any financial damage that may occur.
• Threat intelligence monitoring. Continuous surveillance of AI trends, deepfake tool releases, and fraud tactics can help organizations stay ahead of emerging scams.
• Industry partnerships. Fintechs can collaborate with AI-security startups and cloud providers to implement deepfake-resistant onboarding and verification systems.
• Multi-layer verification. Combining biometrics with behavioral analytics, device fingerprinting, and one-time verification codes increases the difficulty for fraudsters to impersonate users successfully.
• Employee training. Regular staff education on deepfake threats, red flags in payment authorizations, and verification procedures can greatly reduce human error.
• User education. Inform customers about the risks of unsolicited calls, emails, and video chats, even if they appear authentic. Use your marketing channels to provide users with the best safety practices.
• Security-first hosting. Choose hosting providers that comply with strict security and privacy standards, such as the GDPR or SOC 3, as they ensure data encryption, continuous monitoring, and regulatory alignment. These standards help avoid compromised systems and stolen data, which then hinders the creation of deepfake content.

What to do if you fall victim to a deepfake scam

If you’ve fallen victim to a deepfake financial scam, acting quickly can reduce the damage and increase the chances of recovery. Follow these steps to protect your assets and data:

1. Prevent further transactions. Immediately halt any ongoing payments or transfers linked to the scam. Contact your bank or financial institution to freeze accounts if necessary.
2. Document everything. Save emails, video calls, messages, and any evidence of the scam. This information will be critical for investigations and insurance claims.
3. Report to authorities. Notify local law enforcement and, if applicable, financial regulators. In the UK, you can report to Action Fraud. In the US, contact the FTC and your local police.
4. Alert your financial institutions. Inform banks, credit card companies, and fintech platforms of the incident. They may provide fraud protection, reverse transactions, or monitor your accounts for suspicious activity.
5. Change credentials and tighten security. Reset passwords, enable multi-factor authentication, and review all linked accounts to prevent further access.

You should also consider seeking professional and legal advice to determine your best path forward. Speak with your lawyer and with cybersecurity experts or identity protection services to mitigate any further damage.

How deepfakes are being regulated

Regulating AI deepfakes poses a challenge for governments as it remains an emergent technology. Existing laws may cover many of the risks they pose, but many don’t explicitly discuss deepfakes, which can create a gray area when interpreting regulations and legislation. Legal approaches vary worldwide. Many rely on existing cybersecurity or financial regulations without having specific laws for deepfakes.

In the UK, the General Data Protection Regulation (GDPR) and the Financial Conduct Authority (FCA) require robust systems and extensive testing to manage cyber risks and protect data privacy. However, specific rules about deepfakes and financial institutions have yet to be implemented. What exists is the Online Safety Act (OSA), which addresses deepfakes in the context of victimizing adults and children online.

In the US, states such as California and Texas have laws targeting the creation and distribution of deepfake content, particularly for election interference or non-consensual sexual material. At the federal level, there is no comprehensive legislation specifically addressing deepfakes in financial services, though general fraud and cybersecurity laws apply to AI-driven scams. Agencies like the Federal Trade Commission (FTC) and the Securities and Exchange Commission (SEC) can take action against deceptive practices that defraud consumers or investors.

As deepfake technology continues to evolve, regulators will need to adapt quickly to address new risks in financial services. Firms and individuals must remain vigilant, following best practices and complying with existing laws.

Conclusion

Deepfake scams pose significant threats to fintech and banking as the technology becomes more accessible and realistic and as malicious actors improve upon their tactics. Already, deepfakes can be used to impersonate executives, customers, and vendors. By mimicking them, fraudsters can redirect funds, order shipments, or gain access to sensitive data.

The business and finance sectors are vulnerable to deepfake scams because of their reliance on remote and cloud-based services. Cybercriminals can hijack face and voice recognition using deepfake content. Fortunately, there are ways to avoid falling victim to deepfake scams. Invest in vulnerability and threat assessment, response planning, personnel training, and strict security measures to avoid damaging your financial and reputational assets.

Regulations will likely play catch up for a while, though existing laws and standards can provide a foundation for managing deepfake risks. Ultimately, institutions currently have to depend on a proactive approach to security and privacy to protect themselves from deepfake scams.

FAQs