The most famous case, accurately
In January 2024 a finance employee working in a Hong Kong office paid out 200 million Hong Kong dollars — around 25.6 million US dollars to fraudsters across 15 transfers. The deception used a video conference in which the company's British finance director appeared. It was at the police briefing that the sentence which made the case famous was said: a multi-participant video conference turned out to be one where everyone you could see was fake.
The engineering firm involved acknowledged in May 2024 that it was the victim: it confirmed that fake voice and image had been used, that its financial stability was not affected, and that none of its internal systems had been broken into.
The three things most accounts get wrong:
- The video call did not start it. The fraud began with a phishing message. The deepfake was needed to remove the doubt — which is precisely what you would be using your instincts for.
- It ran for a week, across 15 transfers. This was not a momentary slip.
- There was no IT break-in. This is a process problem, not a security-software problem.
And now the number that puts everything in a different light
According to the 2025 annual report of the US internet crime complaint centre:
| Item | 2025 |
|---|---|
| total complaints | 1,008,597 (past a million for the first time) |
| total reported losses | 20.88 billion dollars |
| business email compromise (BEC) | 24,768 complaints, 3.05 billion dollars in losses |
| of which, where AI also played a part | "more than 30 million dollars" |
AI featured in roughly one per cent of reported BEC losses. For the other 99%, a well-written email was enough.
That is a lower bound — the report itself notes that many victims do not even know AI was involved in the background. But the ratio is telling even so, and another source confirms it: in the 2026 annual cybercrime assessment of European law enforcement, the word "deepfake" does not appear even once. What the assessment does say about AI: generative AI makes the text and the call script cheap and personalised, chatbots pre-screen victims at industrial scale, and fraudsters still build on social manipulation and human error.
The case descriptions of the reporting centre point the same way. The classic version of the scheme is still an urgent email from someone posing as the boss, asking for gift cards to be bought and the activation codes sent back — a variant that keeps showing up year after year. There is no deepfake and no voice cloning anywhere in it.
The real, mass-scale threat is not the fake face. It is the well-written email in your own language.
The other side — because this is not a one-sided question
At the same time, a 2026 survey of 602 breached organisations found that in more than a quarter of the companies that suffered a malicious attack the attack was AI-driven (56% more than a year earlier), and that within that, deepfake impersonation was the largest item at 45%.
The two figures do not contradict each other, because they measure different things. One measures reported losses (mostly private individuals and smaller companies), the other the attack types at large enterprises that suffered a data breach. Deepfakes are the most common AI-driven form in the large-enterprise sample; they are one per cent of reported money lost.
The best news: prevention measurably works
The annual fraud report of the UK banking trade body, published in June 2026, covering 2025:
| Fraud type | 2025 | Change |
|---|---|---|
| total payment fraud losses | 1,279.8 million pounds | +4% |
| authorised push payment fraud | 576.4 million pounds | +19% |
| CEO fraud | 5.6 million pounds, 197 cases | −53% / −29%, a record low |
| invoice and mandate fraud | 41.3 million pounds | −4%, a record low |
| impersonation fraud | 55.5 million pounds | −18%, a record low |
The report attributes this to sustained investment in prevention and to customer education.
This is the single most important figure in the whole article. While voice cloning got cheaper and better, losses to CEO fraud halved, and the case count fell to 197. If deepfakes were unstoppable, this is not what it would look like.
One caveat before you generalise it: these are one country's numbers, and national figures differ — it is worth pulling your own banking association's annual fraud report before assuming the same trend at home. What does travel is the direction and the reason given for it.
The nuance that belongs with it: the same UK report notes that deepfakes are showing up at account opening and identity verification, with synthetic identities. The attack moved house, it did not disappear.
Why not to build on detection
Because measured, it does not work. Two independent studies:
A benchmark built in 2024 from deepfakes actually circulating in the wild (45 hours of video, 56.5 hours of audio, 1,975 images, from 88 websites, in 52 languages) found that the performance of open-source detection models drops steeply compared with earlier lab-collected benchmarks: by 50% on video, 48% on audio, 45% on images. Commercial and purpose-fine-tuned models did better, but did not reach the accuracy of human forensic experts.
Another study, on more than half a million high-quality deepfake images: fewer than half the detectors tested reached accuracy above 60%, and the weakest came in at 50% — exactly the same as a coin toss. The authors also point out that simple image manipulations, JPEG compression among them, degrade performance significantly.
A compressed screen recording of a video call is exactly that kind of material. Which is why procedural defence is not a secondary extra — it is the primary one.
How much voice sample is needed? The most often misquoted figure
Three numbers circulate, and each means something different:
| The claim | What it actually refers to |
|---|---|
| "3 seconds is enough" | A 2023 research model that its developer never released — neither the code nor the model. Anyone applying this to an everyday tool today is wrong. |
| "1–2 minutes" | This is today's commercial reality for a quick clone, according to the vendor's own documentation. |
| "30 minutes to 3 hours" | This is the price of a convincing clone. The provider also asks for voice-based verification for it. |
For defence purposes, though, it makes no difference. For a company director with a podcast interview, a conference recording or a corporate video, that half hour already exists. The amount of voice sample is not a constraint for the handful of people anyone would want to impersonate — which is exactly why building on detection is not worth it.
The rule
The guidance from national cybersecurity authorities comes down to three points: a spoken pass phrase for high-value financial operations, a call back on a phone number recorded in advance before any transfer, and stricter checks on every urgent financial request. The federal reporting centre's advice in one sentence: do not act on an urgent, unusual instruction without verifying it.
That is what the rule you can put on the wall is made of:
THE CALL-BACK RULE
If a request arrives on any channel — email, chat, phone, video call —
and that request
(a) moves money,
(b) changes a bank account number or a payee, or
(c) asks for access credentials,
then BEFORE it is carried out it must be confirmed on ANOTHER channel,
using a contact detail WE ALREADY HOLD.
- "A contact detail we already hold" = what is in our contact list.
Never the one that appears in the request.
- A video call is NOT confirmation. The video call can itself be the request.
- Skipping the call-back is not speed, it is a breach. There is no exception
on "because the boss asked" — that is exactly what the rule is for.
Why another channel, and why the number you hold? Because in the Hong Kong case the impersonation happened inside the channel: the victim saw and heard the finance director. A call back to the mobile number in the company's own records could not have been reproduced.
And here is the most important detail: tie it to an event, not to an amount
This is the point where most companies get it wrong.
If the rule only applies above a value threshold, the attacker aims below the line. With a dual-approval limit at 2,500 euros, a request for 2,400 euros sails through on one deceived person.
That is why the call-back has to be done for every new payee and every change of bank account number, regardless of the amount — because it is the account switch that sends the money somewhere else, not the size of the sum.
[My own calculation] And it is less work, not more:
| Tied to an event | Tied to a 2,500-euro threshold | |
|---|---|---|
| outgoing transfers per month | 40 | 40 |
| of which need a call-back | 4 (3 new payees + 1 account number change) | 12 (that many land above the line) |
| extra work per month at 3 minutes a call | 12 minutes | 36 minutes |
More frequent checking is not only more expensive, it is also weaker — because whatever people are asked every day, they end up nodding through mechanically. It is the same phenomenon you see with approval buttons on agents: where to put the approval covers exactly this from the process side.
Does it work? Honestly
I found no controlled measurement of what percentage of cases the call-back rule catches. Three things argue for it, though:
- Indirect but strong evidence: UK losses to CEO fraud fell 53% in 2025, to a record low — and the report attributes that to the work invested in prevention and education. Not a randomised trial, but a multi-year time series across an entire country.
- Regulatory consensus: national cybersecurity authorities, police fraud units and the US federal reporting centre all recommend this same single step.
- The logical argument: this is the only control that does not depend on whether you can spot the fake. Detection, when measured, is unreliable; the call-back works even if the deepfake is perfect.
What to take away
The fake face is spectacular, but most of the money still leaves by email — and the best defence is the same against both.
Do not build on detection: even the professional tools do not work reliably, and the half hour of voice sample for your publicly visible colleagues already exists somewhere. Build a procedure: another channel, a contact detail you already hold, and a rule tied to an event, not to a threshold.
And if someone says "I would spot it": in the Hong Kong case the employee saw and heard his bosses, for a week, across fifteen transfers.
If you publish AI-generated content, that has come with a labelling obligation since 2 August 2026 — labelling AI content goes through what that means. And for writing the rules down inside the company there is a ready-made skeleton: the one-page AI policy has all twelve lines with their legal basis.