Deepfake Scams: How AI Voice and Video Fraud Actually Works

Are deepfake scams actually happening, or is this still theoretical? They're happening now, and the money involved isn't small — the clearest example is the roughly $25 million wire fraud against engineering firm Arup's Hong Kong office in 2024, pulled off with a video call full of deepfaked participants. This page covers the fraud angle specifically: how these scams are structured, what they've cost real companies and real people, and how to spot one while it's happening to you. For general deepfake detection skills, see How to Spot a Deepfake and Audio Deepfakes — this page assumes you already have those basics and want the scam-specific playbook.

• The Arup case: a deepfake video call fraud
• CEO and executive voice-cloning fraud
• Deepfake romance scams
• Deepfakes as evidence in criminal fraud cases
• How to spot a deepfake scam in the moment
• Which Ban the Bots page do you actually need?
• Frequently asked questions

The Arup case: a deepfake video call fraud

The single most widely reported deepfake fraud case to date involves Arup, a global engineering firm. In 2024, an employee at the company's Hong Kong office received a message that appeared to be from the firm's UK-based chief financial officer, requesting a confidential transaction. Wary of a possible scam, the employee joined a video call to verify — and saw what looked like the CFO and several other familiar colleagues on screen. Every other person on that call was an AI-generated deepfake, recreated from publicly available audio and video of the real employees. Reassured by seeing "colleagues" he recognized, the employee proceeded to make multiple wire transfers totaling roughly $25 million before the fraud was discovered.

The case matters beyond its size because of what it demonstrates: the scam didn't rely on a single cloned voice on a phone call, which is already a known risk. It faked an entire multi-person video conference convincingly enough to defeat an employee's own attempt at verification. That's a meaningfully higher bar of sophistication than earlier voice-only scams, and it's a preview of where this fraud category is heading.

CEO and executive voice-cloning fraud

The more common and lower-tech version of this scam doesn't require faking video at all — just a cloned voice. Executives who give earnings calls, conference talks, podcast interviews, or even just appear in company marketing videos leave behind plenty of public audio, which is exactly the raw material a voice-cloning tool needs to produce a convincing fake.

The typical version of the scam plays out like this: a scammer clones the voice of a company's CEO or CFO, then calls or leaves a voicemail for someone in the finance department, often timed for end-of-day or during travel when the real executive is harder to reach for confirmation. The message is urgent, references a plausible business reason — an acquisition, a vendor payment, a confidential deal — and pushes for a wire transfer to be completed quickly and quietly, often specifically asking the employee not to loop in the usual approval chain "just this once."

Why finance employees specifically get targeted

Finance and accounts-payable staff are targeted disproportionately because they're the people with actual authority to move money, and because urgent, unusual payment requests from leadership are, unfortunately, sometimes a normal part of the job — which is exactly the ambiguity these scams are built to exploit.

Deepfake romance scams

Romance scams are an older fraud category, but deepfake tools have given them a new layer of believability. Traditionally, a romance scammer relies on text-only communication and stock photos to build a fabricated relationship over weeks or months before asking for money. Deepfake video and voice tools let a scammer go further, conducting brief video calls or sending voice messages using a synthetic likeness, which addresses one of the oldest pieces of advice for spotting a romance scam — "insist on a video call" — by faking the video call itself.

These calls are often kept deliberately short, low-quality, or interrupted by a conveniently bad connection, which both limits the amount of deepfake material that needs to be generated convincingly and gives the scammer a built-in excuse if something looks slightly off.

Deepfakes as evidence in criminal fraud cases

As deepfake-enabled fraud has grown more common, prosecutors have begun explicitly citing AI-generated or deepfake material in criminal fraud charges, rather than treating it as an incidental detail. This is a meaningful shift: it means courts and law enforcement are increasingly building specific evidentiary frameworks around identifying and presenting synthetic media as part of proving a fraud occurred, rather than folding it into generic wire fraud or impersonation statutes without addressing the AI-generated element directly. Expect this to keep evolving as more cases work through the legal system and as deepfake generation tools keep getting more accessible.

How to spot a deepfake scam in the moment

You don't need to be a forensic audio analyst to catch most of these scams. The strongest tell isn't a visual or audio glitch — it's the behavioral pattern around the request. Watch for this combination specifically:

• Unusual urgency — the request has to happen right now, with no time for normal review.
• A request for secrecy — you're asked not to mention it to colleagues, other approvers, or the person's own assistant.
• Pressure to bypass normal verification channels — skip the usual second-approval step, the callback-to-a-known-number step, or the standard purchase-order process, just this once.
• Refusal to do an unscripted live verification — the caller won't do an unplanned live video call, won't answer a specific personal question only the real person would know, or has a conveniently bad connection whenever you try to verify.

Any one of these alone might have an innocent explanation. All four together, especially around a request involving money or sensitive access, is close to a guaranteed scam. The single best practical defense is a simple rule: verify any urgent financial request through a separate, previously known communication channel — call the person back on a number you already had, not one provided in the suspicious message — before acting, no matter how convincing the call or video looked.

Which Ban the Bots page do you actually need?

• Want the general checklist for spotting any deepfake, not just scam calls? Read How to Spot a Deepfake.
• Dealing specifically with a suspicious phone call or voicemail? See Audio Deepfakes.
• Want to understand the legal landscape around deepfakes generally? Check Deepfake Laws.
• Looking for broader steps to protect yourself from AI-driven harms? Visit Fighting Back.

Frequently asked questions

How much audio does someone need to clone a voice convincingly? Modern voice-cloning tools can produce a usable clone from a surprisingly small amount of clean audio, which is part of why executives with any public speaking presence are a realistic target.

Should I trust a video call more than a phone call for verification? Not automatically — the Arup case specifically shows that a fabricated video call can defeat that instinct, so a live, unscripted, two-way verification through a separately confirmed channel matters more than the format of the call itself.

What should a company do to reduce this risk? Require a callback to a previously known number or a separate approval step for any urgent wire transfer request, regardless of how the request arrived or how convincing it sounded, and train finance staff specifically on this scam pattern rather than assuming general fraud training covers it.

Conclusion

Deepfake fraud has moved from a hypothetical risk to a documented, expensive reality — Arup's roughly $25 million loss is the clearest proof, but voice-cloning wire fraud and deepfake-assisted romance scams are running constantly at smaller scale, and prosecutors are starting to build criminal cases specifically around the deepfake evidence involved. The defense that actually works isn't spotting a glitch in the video — it's noticing the urgency, secrecy, and verification-avoidance pattern, and simply calling back on a number you already trust before you act.

For the general deepfake-detection skills this page builds on, see How to Spot a Deepfake and Audio Deepfakes. For the legal side, read Deepfake Laws, and for broader protective steps, visit Fighting Back.