Deepfake scams: the question a fake CEO failed
Deepfake scams pair a message about a secret deal with a cloned voice or video and pressure to act fast; one video call cost Arup $25.6 million, while a Ferrari executive stopped one by asking for a book title only the real chief executive knew. Spotting fakes by eye or software is unreliable, so the defenses that hold move the proof away from the face: a one-time code from an authenticator app, a callback on a known number, and a signed record of how a file was made.
Deepfake scams no longer arrive as a warning in a slide deck. They arrive as a video call, in the right accent, with the right faces. In Hong Kong, a finance worker who had just pegged a message as phishing joined one such call. Everyone on it was fake. He made 15 transfers worth $25.6 million. Here is how these scams run, what stopped the ones that failed, and two tools you can use this week.
How does a deepfake scam unfold?
Deepfake scams unfold in three moves: a message that sets up a secret deal, a voice or video that matches the person you expect, and pressure to act before anyone can check.
The Hong Kong case shows all three. In early 2024, the worker received a message from his company's UK-based chief financial officer about a transaction that had to stay secret. He suspected phishing, police said. Then came the video call with the CFO and several colleagues. They looked and sounded like the people he knew, so he put his doubts aside and sent HK$200 million in 15 transactions. "It turns out that everyone [he saw] was fake," senior superintendent Baron Chan told Hong Kong's public broadcaster. In May, the engineering firm Arup confirmed it was the victim and that "fake voices and images were used".
At Ferrari, the same play ran a few months later and failed. An executive got WhatsApp messages from "Benedetto Vigna", the chief executive, from a new number with a different profile picture: a confidential deal, a non-disclosure agreement on the way, "utmost discretion". Then the follow-up call came through. According to Bloomberg's account in Fortune, the voice was a spot-on imitation of Vigna's southern Italian accent, and it asked for a currency-hedge transaction. The executive caught "the slightest of mechanical intonations" and said: "Sorry, Benedetto, but I need to identify you." What was the title of the book Vigna had recommended to him days earlier? The call ended.
At WPP, the world's largest advertising group, the fraudsters built a WhatsApp account from a public photo of chief executive Mark Read and used it to set up a Microsoft Teams meeting. The Guardian reported that the meeting used a voice clone and YouTube footage of Read, while the impostor typed in the chat window. The target, an agency leader, was asked to set up a new business and hand over money and personal details. That one failed too.
Why deepfake scams keep working
Because the fake only has to hold up for a few minutes, and urgency does the rest. The numbers behind that are the FBI's, and they are large.
Between January 2025 and July 2026, the FBI's complaint centre received nearly 61,000 reports of criminals posing as police or government officials, with losses above $1.6 billion. Its September 2026 warning says scammers now use AI "to appear as law enforcement and government officials on video calls with victims". Since at least 2023, AI-generated voice messages have impersonated senior US officials, nudging targets onto Signal, Telegram or WhatsApp and then asking for an authentication code that syncs the victim's contact list. By July 2026 the FBI was warning about deepfake videos of one of its own senior leaders, steering past scam victims to a spoofed complaint site.
Banks see deepfake scams from the other side. The US Treasury's financial crimes unit, FinCEN, reported in November 2024 that suspicious-activity reports describing deepfake media had been rising since 2023, often involving fake identity documents used to get past account checks. Its alert even has a filing code for the pattern: FIN-2024-DEEPFAKEFRAUD.
How cheap is a convincing deepfake now?
About 70 minutes of work on a graphics card bought in 2020, according to an experiment by Palo Alto Networks' Unit 42.
In April 2025, a researcher with no image-editing experience built a real-time deepfake persona for job interviews using an AI search engine, free tools, a GTX 3070 card and a face from a this-person-does-not-exist generator. The point of the exercise was North Korea's remote IT workers, who use such personas to get hired at Western companies. By October 2026 the FBI's warning about those workers described paid "facilitators" in the US who appear on camera, sit interviews and keep company laptops online, plus a tool kit of OBS Studio with the VDO.Ninja plugin, remote desktop software and keyboard-video-mouse devices.
So the person on the screen may be assembled from parts: a generated face, a hired American on camera, and the real worker somewhere else entirely.
Can you spot a deepfake by looking?
Sometimes, for a live fake you can test. Rarely, for a finished video. And the software you might lean on is not much better.
Live deepfake scams have known weak points. Unit 42 found that rapid head turns, sudden lighting changes and lip-sync lag all produced visible artifacts, and that one move worked best: passing a hand across the face, which breaks the facial tracking. The FBI's list of tells runs to distorted hands, odd accessories, bad shadows and call lag, but the same notice admits that AI content "has advanced to the point that it is often difficult to identify".
The detection software struggles with them too. Deepfake-Eval-2024, a benchmark of fakes collected from social media and detection services in 2024 (45 hours of video, 56.5 hours of audio and 1,975 images from 88 websites), found that open-source detectors lost about half their accuracy on it: AUC fell 50% for video, 48% for audio and 45% for images against the older academic test sets. Commercial tools and fine-tuned models did better and still fell short of human forensic analysts.
Google's own checker shows the limits from the other side. The Gemini app can tell you whether an image, video or audio clip carries SynthID, Google's invisible watermark: 100 MB files, videos under 90 seconds, about ten checks of each kind a day. A hit means a Google model made it. A miss means only that Google's models didn't, not that nothing did.
Which deepfake defenses still work?
The ones that move the proof away from the face and the voice: a code the caller can't know, a channel the attacker doesn't control, and a signed record of how a file was made.
Ferrari's executive did the first of these by hand. A book title is a shared secret, and the fake didn't hold it. The weakness is that a secret works once and has to be fresh. The FBI tells families to agree a secret word; CERT-In, in its November 2024 deepfake advisory, tells organisations to add callback procedures and multi-factor authentication to every request for a sensitive transaction. Both say the same thing: don't judge the face, check something it can't have.
How to beat a cloned voice with a callback code
Give every person who could ask for money a key in an ordinary authenticator app, and ask for the six-digit code before you act. I wrote callcode.py to do the checking. It needs Python 3.10 and nothing else.
python3 callcode.py selftest # RFC 6238 and RFC 4226 test vectors
python3 callcode.py enroll "Priya Sharma (CFO)" # once, in person: a key for her app
python3 callcode.py check "Priya Sharma (CFO)" 492817The codes are standard time-based one-time passwords, so Google Authenticator, Microsoft Authenticator or Aegis all work. Each code is accepted once; five wrong codes in ten minutes lock that person out for ten minutes; every check is logged with the result but never the code. A cloned voice can read a script. It can't read a code off a phone it doesn't hold.
Two things make this stronger than a secret word. The code changes every 30 seconds, so a scammer who overhears one has nothing. And the check is a habit rather than a judgement: nobody has to feel awkward about challenging the boss, because the boss asked for the rule.
How to check whether a photo or video was made by AI
Read its Content Credentials, the signed record that cameras, editors and AI generators can embed under the C2PA standard. The second tool in the repository, check_media.py, does that with the open-source c2pa-python library, and reports three things separately:
pip install c2pa-python
python3 check_media.py suspect.jpg
Content Credentials: present (1 manifest(s))
Integrity: FAILED
Trust: signer not on official C2PA trust list
Signer: C2PA Signer (issuer: C2PA Test Signing Cert), signed time not recorded
Made with: trickyworld deepfake-defense fixtures 1.0
Origin: Created using generative AII tested it on files I signed myself with the C2PA project's public test certificate. An image recorded as "created using generative AI" validated cleanly. The same image with eight bytes of picture data flipped came back broken, with the code assertion.dataHash.mismatch. The same image opened and saved again by an image library, which is what a screenshot and many upload pipelines do, came back with no credentials at all.
That last result is the catch. A missing record proves nothing at all, and a present record proves only what its signer vouches for, so the tool checks signers against the official C2PA trust list. On 12 November 2026 the C2PA conforming products list held 340 entries, 11 of them at assurance level 2, the stricter tier for how signing keys are protected; Google's Pixel Camera is one. Adobe, OpenAI, Cloudflare and Amazon Bedrock are on the list. Samsung and Apple are not.
How to harden a video identity check
Treat the camera feed as untrusted input. NIST's identity-proofing guidelines, final since July 2025, list "video or image injection" as a threat ("a deepfake video is used to impersonate an individual portrayed on a stolen driver's license") and answer it with a combination of active and passive liveness checks, authenticated channels between device and server, and authentication of the camera itself.
FinCEN's red flags are blunter. A customer who uses a third-party webcam plugin during a live check, or who asks to switch channels because of "excessive or suspicious technological glitches", is showing you the attack. So is an identity photo that a reverse-image search matches to a gallery of AI-generated faces. For hiring, Unit 42 adds the practical version: block virtual-camera software on interview machines, log applicants' IP addresses, flag VoIP numbers, and ask candidates to turn their head or pass a hand over their face. The FBI warns that blunt filters produce false positives that hurt real applicants, and suggests the friction of E-Verify, a passport check or a live verification instead.
What India and the EU now require
Labels on synthetic media, with a short clock on takedowns. Neither law stops a scammer, but both change what platforms must show you.
India amended its IT Rules on 10 February 2026. "Synthetically generated information" now means audio, visual or audio-visual content made or altered by a computer resource so that it appears real. Platforms that enable it must label it prominently, prefix audio with a spoken disclosure, embed permanent metadata with a unique identifier of the tool, and refuse to let users strip either. Large social platforms must ask users to declare synthetic content and verify the declaration with technical measures. And unlawful content must come down within three hours of a court order or an authorised notice, where the rule used to say 36.
In the EU, the AI Act's transparency duties have applied since 2 August 2026. Deployers who generate or manipulate image, audio or video that passes as real must disclose it, and providers must mark their outputs in a machine-readable way. A voluntary code of practice spells out how; about 190 companies and organisations had signed it by the end of July 2026.
The gap in both is the same one check_media.py runs into: honest tools label, scam tools don't. The laws make labels common enough that a missing one starts to look odd. They don't make the missing label proof.
What to do this week
Pick the defenses against deepfake scams that don't depend on anyone spotting a fake:
Enrol the three people most likely to ask for money or access in callback codes, and agree that no transfer, password reset or new payee happens on a call without one.
Keep a Ferrari question in reserve for anyone not enrolled: something the two of you discussed recently, used once.
Call back on a number you already have. The FBI's advice is the same for cloned officials and cloned relatives: hang up, look the number up yourself, dial it.
Block virtual-camera software on machines used for interviews and identity checks, and ask for a head turn or a hand across the face on video.
Check files that matter with Content Credentials before you act on them, and remember what a blank result means: nothing.
Report attempts. In India, call 1930 or use cybercrime.gov.in; in the US, ic3.gov.
None of this needs a detector that can out-see an AI. It needs a secret the AI doesn't have and a habit of asking for it. Our guides to spotting phishing and to device-code phishing cover the messages that usually arrive first, and the online privacy guide covers the photos and recordings that feed the clones.
Frequently asked questions
Does a callback code still work if a scammer steals my phone number?
Yes. A SIM swap moves your number, so text-message codes and calls go to the attacker, but the authenticator key never leaves the app on your handset. The scammer would need the unlocked phone itself. Enrol people in person and remove anyone whose phone is lost.
What if the caller says their authenticator app isn't working?
Treat it as a no. FinCEN lists a request to switch channels because of technical glitches during a live check as a red flag. Hang up, call the person back on a number you already have, and only then take the request. A real colleague will understand; a scammer will push.
Will the Gemini app flag a deepfake made with another company's tool?
Not through SynthID, which only marks content from Google's own models. Gemini can also read Content Credentials if the file still carries them, which most platforms strip. A clean result from Gemini tells you Google didn't make it, nothing more.
Is it illegal to make a deepfake of someone in India?
It can be. The 2026 IT Rules require platforms to block synthetic content that falsely depicts a real person in a way likely to deceive, and say that creating such content may attract punishment under laws including the Bharatiya Nyaya Sanhita. Whether a specific clip is an offence depends on its content and use.
Sources
Primary sources
- Write-upScammers Impersonating Law Enforcement and Government Officials in Fraud Schemes (FBI IC3, 17 September 2026) · ic3.gov
Reports of the story
About the author
Vishal · Software & security engineerVishal writes Trickyworld's tutorials and interview-preparation guides on programming, databases, cyber security and AI. Vishal has been shipping production software long enough to have firm opinions about Python, PHP, Node.js, and JavaScript, and to have been wrong about each of them at least once. The work has run the whole stack: Drupal and Laravel applications, React front ends, MySQL and MongoDB underneath, Redis and Memcached for the things that had to be fast, Apache Solr for the things that had to be findable. That last part turned out to matter more than anyone expected. Tune a Solr index for a season, then watch a language model confidently retrieve the wrong document, and you recognise an old problem wearing new clothes. Most of what is hard about AI systems is not the model. It is retrieval, caching, latency budgets, and deciding what the system does when the answer comes back wrong — which is work he has been doing since well before anyone called it AI engineering. He plays a lot of games, which is less a hobby disclosure than an admission of where a good share of his engineering instinct came from. Real-time systems with a frame budget. State that has to stay coherent while a player does something no designer anticipated. The permanent question of what happens when the frame cannot finish in time. Those habits carry over more directly than they have any right to. He has written several books on programming, all built on the same conviction: most technical writing is unclear because the author never decided what to leave out. More from Vishal → · Editorial policy
