Deepfake Fraud Surged 3,000% This Year: Your Video Calls Are No Longer Proof of Identity
Somewhere around November 2023, a finance professional in Hong Kong joined a video call with several colleagues. The CFO was there. Other senior staff were present. The conversation was routine: a set of wire transfers needed to be authorized. The employee followed procedure, confirmed the instructions, and executed fifteen separate transfers totaling $25.6 million. Every person on that call except the employee was a deepfake.
The incident, which became public in early 2024 when Hong Kong police confirmed the details, is the single most expensive deepfake social engineering attack disclosed to date. But it didn’t happen in a vacuum. It happened at the tail end of a year in which deepfake fraud didn’t just grow: it detonated.
Sumsub’s 2023 Identity Fraud Report documented a tenfold increase in detected deepfakes globally between 2022 and 2023. Not 10%. Not 100%. A full order of magnitude. North America experienced a 1,740% increase. Asia-Pacific saw 1,530%. And those were just the deepfakes that automated systems caught.
The uncomfortable truth is this: 2023 was the year that seeing stopped being believing, and most organizations haven’t updated their processes to reflect that reality.
The technology crossed a line nobody was watching
The executive class had heard about deepfakes. They’d seen the entertainment demos, the celebrity face-swaps, the obviously manipulated videos circulating on social media. What they hadn’t internalized was that the technology crossed from “amusing novelty” to “operational weapon” sometime in mid-2023, and it did so with almost no public acknowledgment from the security industry.
Three capabilities converged simultaneously.
First, voice cloning collapsed from a multi-hour training process to a three-second sample. Microsoft’s VALL-E research, published in January 2023, demonstrated that a neural codec language model could synthesize remarkably accurate voice clones from just three seconds of audio. The system could preserve the speaker’s emotion, tone, and even the acoustic environment of the recording. Ross Rubin, principal analyst at Reticle Research, told TechNewsWorld that the speed was “very impressive” compared to existing systems that required hours of training material.
Second, real-time face-swapping tools matured enough to survive video calls. Not pre-recorded clips edited in post-production, but live, bidirectional video manipulation that could run on consumer hardware. The gap between a deepfake that fooled a YouTube viewer and one that fooled a colleague on a Zoom call effectively closed.
Third, and this is the piece most security teams missed, generative AI made the social engineering around the deepfake dramatically more convincing. The deepfake is the payload, but the phishing email that sets up the call, the pretextual context, the follow-up messages that confirm the instructions: all of that got better at the same time.
The result was a full-stack fraud capability that didn’t exist twelve months earlier.
The numbers the C-suite hasn’t seen
The Sumsub data is worth dwelling on because it captures something that anecdotal incident reports miss: the industrial scale of the shift.
The global tenfold increase in deepfake detections was unevenly distributed by region, but no region was spared. North America’s 1,740% surge was the highest. Europe saw 780%. The Middle East and Africa experienced 450%. Latin America, 410%. These aren’t sampling errors. These are tectonic shifts in fraud methodology.
The cryptocurrency sector was disproportionately affected, 88% of all detected deepfake fraud casesinvolved crypto platforms, but fintech (8%) and traditional banking were not far behind. And the fraud types were evolving in real time. Forced verification scams, where victims are manipulated into completing identity verification on behalf of a fraudster, grew 305% year-over-year. Account takeover attempts increased 155%.
Onfido’s Identity Fraud Report corroborated the trend from a different angle, documenting how cheaply available face-swap apps were being used to defeat identity verification systems that relied on video liveness checks. The counterfeit document industry was merging with the deepfake industry. A forged passport paired with a face-swapped video call was becoming a commodity offering.
Deloitte’s Center for Financial Services projected that AI-enabled fraud would reach $40 billion in annual losses by 2027. That number felt speculative in early 2023. By December 2023, it felt conservative.
Why traditional controls couldn’t keep up
Here is what makes the deepfake threat structurally different from previous fraud vectors: it attacks the one verification channel that humans trust implicitly.
Email compromise? We’ve trained people to be suspicious of unexpected emails. Phone-based social engineering? There’s awareness, even if compliance is imperfect. But a video call with a face you recognize, a voice that sounds right, and colleagues you work with every day? The human brain is wired to accept that as authentic.
This is the Andy Still problem. Still, then CTO and co-founder at Netacea, described the dynamic precisely in the firm’s 2024 research report: “AI’s power and low barrier to entry means that it will be used in many ways, including cyberattacks. While it’s heartening that so many leaders recognize the everyday threat they face from AI, there are gaps in understanding where the most damaging threats are coming from.”
The gap Still identified was this: organizations were investing in AI-powered defenses for high-frequency, low-impact attacks (DDoS, bot traffic) while leaving their highest-value processes, financial authorizations, executive communications, M&A discussions, protected by nothing more than visual recognition on a screen.
The traditional wire transfer approval workflow at most enterprises in December 2023 looked something like this: an email request comes in, someone picks up the phone or joins a video call to “verify” the request, the identity is confirmed visually or verbally, and the transfer is authorized. That workflow was designed for an era in which impersonating someone’s face and voice in real time was science fiction.
It is no longer science fiction. It’s a commodity.
The practitioner’s view from the inside
I spend my days building AI-powered enterprise systems, and I’m going to be blunt about something: the reason deepfake fraud succeeded at scale in 2023 wasn’t a failure of technology detection. It was a failure of process design.
Most organizations still treat identity verification as a binary: is this person who they say they are? Yes or no. That mental model assumes that the verification channel itself is trustworthy. When I look at how enterprises have designed their financial controls, approval chains, and executive communication flows, I see the same vulnerability pattern repeated: critical decisions authenticated by a single channel that is now compromised.
The security industry’s response has been predictable and insufficient: invest in deepfake detection tools. Run the incoming video through an AI that detects artifacts. The problem is that detection is an arms race that defenders will structurally lose. Every detection capability creates a training signal for the next generation of deepfakes. The same generative adversarial network architecture that creates deepfakes can be tuned to defeat detectors.
The answer is not better detection. The answer is process redesign that assumes any single channel is compromised.
What enterprises should have done in 2023, and still haven’t
The corrective actions are neither technically complex nor expensive. They require process changes, not product purchases.
First, eliminate video call confirmation as a standalone authorization mechanism for financial transactions. A video call can be one factor, but it cannot be the only factor. Any transfer above your defined threshold, and that threshold should be lower than you think, requires out-of-band confirmation through a pre-established second channel. If the request comes by email and is “confirmed” on Zoom, the authorization must go through a third channel: a phone call to a pre-registered number, a message through an internal chat system, or an in-person verification.
Second, implement challenge-response protocols for executive communications. A pre-agreed code word or phrase, exchanged through a channel separate from the one where the transaction is being discussed, defeats current deepfake capabilities completely. The deepfake can reproduce appearance and voice. It cannot reproduce a secret that was never spoken aloud in any recorded medium.
Third, conduct deepfake awareness exercises. Not the generic “watch this video about phishing” training that fills compliance checkboxes. A targeted simulation where your finance team receives a realistic deepfake-enhanced request and is evaluated on whether their response follows the new protocols. The Hong Kong police who investigated the Arup incident reported that the victim was initially suspicious of the phishing email that preceded the call. The video call with multiple “colleagues” eliminated that suspicion. Train for that specific scenario.
Fourth, brief your board and C-suite on synthetic media risk specifically. Not as a subset of “cyber threats” but as its own category. Executive impersonation via deepfake is fundamentally different from any previous attack vector because it exploits the trust that leaders have built with their teams. That trust, paradoxically, becomes the vulnerability.
Fifth, review every workflow in your organization that uses visual or audio identity as a control. Not just financial transfers. M&A discussions. HR decisions. Legal communications. Anywhere that someone says “I confirmed it was them on the call” as a basis for action.
The 2024 trajectory is worse
The data that has emerged since December 2023 confirms that the deepfake fraud surge wasn’t a spike; it was a step function.
Sumsub’s 2024 follow-up report documented another quadrupling from 2023 to 2024, with deepfakes growing to represent approximately 7% of all fraud attempts globally. Deep Instinct’s Voice of SecOps Report, released in mid-2024, found that 97% of security professionals were now concerned their organization would suffer an AI-generated security incident. Three-quarters had already changed their cybersecurity strategy specifically because of AI-powered threats.
But the budgets haven’t moved. The processes haven’t changed. And the technology keeps getting cheaper, faster, and more accessible.
The conversation about deepfakes in the security industry is still stuck on detection. It should have moved to process redesign in 2023. Every month it doesn’t is another month where organizations are protecting their most critical decisions with verification methods that a laptop running commodity software can defeat.
A video call is not proof of identity. It hasn’t been since 2023. The question is how many $25 million incidents it will take before that sentence appears in every organization’s security policy.
