Deepfake fraud statistics: what official reports measure and what they do not

This page sits in the deepfake detection hub between two neighbours: the documented deepfake scams page records individual cases from official statements, and the deepfake statistics with a primary source page lists research figures. This page is about measurement itself: who counts deepfake fraud, on what base, and why the counts cannot be added up.

01Which official reports count deepfake fraud?

Four kinds of body publish figures that touch deepfake fraud: crime-reporting centres, which count complaints and reported losses by crime type; financial intelligence units, which count suspicious activity reports filed by banks; consumer protection agencies, which publish warnings; and police forces answering legislators, which count cases opened. None of them has a category whose definition is "a fraud in which a deepfake was used", so a deepfake figure exists only where an agency chose to create one.

The table below records what each source fetched for this page contains, and what it does not.

02What does the FBI IC3 report say about deepfakes?

Nothing by name. The 2024 Internet Crime Report, 47 pages, records that "complaints totaled 859,532, with losses of $16.6 billion, representing a 33 percent increase from 2023", that 256,256 complaints reported an actual loss and that the average reported loss was 19,372 dollars (IC3 2024 report). The report's crime-type tables run on categories such as business email compromise, investment fraud and tech support fraud; a deepfake used inside any of them is counted under that category and never separately. "Generative AI" appears only in the titles of two public service announcements listed in Appendix E, dated 29 March 2024 and 3 December 2024.

The December 2024 announcement describes the methods, including "short audio clips containing a loved one's voice" and "videos for real time video chats with alleged company executives", and notes that "the creation or distribution of synthetic content is not inherently illegal" (IC3 PSA I-120324). It gives no count. Any figure that attributes a share of the 16.6 billion dollars to deepfakes therefore comes from somewhere other than the report.

03What does FinCEN report, and what is its denominator?

FinCEN's alert of 13 November 2024 states that "beginning in 2023 and continuing in 2024, FinCEN has observed an increase in suspicious activity reporting by financial institutions describing the suspected use of deepfake media" (FIN-2024-Alert004). It names the typologies: falsified identity documents at account opening, accounts opened with generated identities and used to launder proceeds, and generated media in business email compromise, family emergency, romance and investment scams. It gives neither the number of reports nor a loss figure.

The denominator matters even where a number exists. A suspicious activity report is a bank's suspicion, filed before any investigation, and a single incident can produce several reports from several institutions. A count of reports describing deepfakes would measure how often banks suspect and mention deepfakes, which moves with awareness and guidance as much as with fraud. The FTC's consumer alert of 20 March 2023 on voice-clone family emergency schemes is the same kind of document: advice ("Don't trust the voice. Call the person who supposedly contacted you") with no count attached (FTC alert).

04Where does a deepfake fraud figure have a stated base?

Hong Kong is the clearest example in the sources read for this page. In a written reply to the Legislative Council on 26 June 2024, the Secretary for Security stated that the Police had kept separate statistics on deepfake fraud since 2023 and that "up to May 31, 2024, the Police have received three cases relating to deepfake technology, which occurred in August 2023, January 2024 and May 2024 respectively" (LCQ9, 26 June 2024). The reply gives each case: a syndicate that used face swapping to apply for loans worth 200,000 Hong Kong dollars between September 2022 and July 2023, with nine arrests; a January 2024 video conference built from downloaded public clips that led to transfers of about 200 million Hong Kong dollars; and a May 2024 video conference of nearly 30 minutes in which a staff member was instructed to transfer nearly 4 million Hong Kong dollars.

The same reply counts a second thing with a second base: from 1 November 2023 to 31 May 2024, 21 online deepfake clips impersonating officials or celebrities were identified by or reported to the Police, two by investigation and 19 by the public, all removed at the Police's request, and "the Police have not received any reports involving members of the public being defrauded as a direct result of these deepfake video clips". Three cases and 21 clips are the only numbers on this page whose period, counting rule and source are all stated by the body that produced them.

05Why is there no total for deepfake fraud?

Because the counts that exist measure different objects over different periods under different definitions. A police case, a bank's suspicious activity report, a consumer complaint and a removed video clip cannot be summed. Hong Kong's own working definition, "the use of deep learning ... to synthesise images for the purpose of creating falsified images", would exclude a cloned voice that the FTC alert and the IC3 announcement treat as the central example. And the largest reporting system, IC3, has no deepfake field at all, so the bulk of any fraud involving a deepfake is recorded without the word.

The widely quoted figures come from elsewhere. The Europol Innovation Lab report of 2022 is often cited as an official source for deepfake volume, but the counts inside it are attributed: "85 047 deepfake videos on popular streaming websites, with the number doubling every 6 months" comes from a commercial detection company's December 2020 study, the figure that "96 % of the fake videos involved non-consensual pornography" from the same company's 2019 study, and the fraud example of a voice deepfake used to "transfer USD 35 million" from a press report (Europol, 2022). The report contains no measurement of its own, and the claim that 90 percent of online content will be synthetic by 2026, often attributed to it, does not appear in the January 2024 version. A figure's authority comes from its base, not from the letterhead it is reprinted on.

06What is measured instead: detection, not fraud

Where numbers with a base do exist, they measure detectors, not crimes. Research benchmarks report how often a system catches a fake under stated conditions: the ASVspoof 2021 results give a best equal error rate of 15.64 percent on compressed synthetic speech, the Deepfake Detection Challenge ranked video detectors by log loss on 10,000 clips, and DF40 reports what happens to detectors on unseen generators. Those figures say how well a tool might work; they say nothing about how many frauds occurred, and no official statistic yet bridges the two.