Deepfake scams: the documented cases and the official figures

This page is part of the deepfake detection hub. The documented deepfake incidents page lists the records case by case; this page is about how the frauds worked, what official bodies say and measure, and what no official figure covers. The deepfake statistics page of this section holds the measured numbers.

01Which official bodies have published on deepfake scams?

Five kinds of record exist, and each measures something different. The Hong Kong Police keep a separate statistic for deepfake fraud, reported to the Legislative Council in a written reply of 26 June 2024 (LCQ9). The United States Federal Bureau of Investigation's Internet Crime Complaint Center issued a public service announcement on 3 December 2024 on criminals using generative AI for financial fraud (I-120324-PSA). The Federal Trade Commission published a consumer alert on voice-cloned family emergency scams on 20 March 2023. The Financial Crimes Enforcement Network issued alert FIN-2024-Alert004 to banks on 13 November 2024. The Federal Communications Commission ruled in February 2024 that cloned voices fall under the existing robocall prohibition.

Only the first of these publishes a count. The IC3 and FinCEN documents describe typologies and ask for reports; the FTC alert gives advice; the FCC ruling is law, not measurement.

02How did the recorded scams work?

The Hong Kong reply describes three mechanics. In the August 2023 case a syndicate used an AI face-swapping programme to pass the identity checks of finance companies, the kind of check that AI face recognition systems perform, and apply for loans online between September 2022 and July 2023, for HK$200,000; nine people were arrested. In the January 2024 case a staff member received a phishing email purporting to come from the chief financial officer at the group's United Kingdom head office, joined a group video conference, and then authorised transfers to five local bank accounts totalling about HK$200 million. The record states that "the pre-recorded video conference was generated using downloaded online public video clips and voices of the impersonated officer" and that "there was actually no interaction between the informant and the fraudster"; the payment instructions continued over instant messaging.

In the May 2024 case the approach came by WhatsApp message, again impersonating the head office chief financial officer. The staff member took part in a video conference of nearly 30 minutes at which altered public videos were played, and was instructed to transfer nearly HK$4 million to a local account. The two video cases share a pattern: the fake is not interactive, and the instruction is a transfer to accounts the fraudster controls.

The United States records add two more mechanics. The FTC alert describes a cloned voice on a phone call pretending to be a relative in trouble, made from "a short audio clip of your family member's voice" taken from content posted online, with payment demanded by wire, cryptocurrency or gift card. The deepfake audio detection methods page gives the published error rates for the countermeasures that would have to catch such a call. FinCEN's alert describes altered or generated photographs on identity documents used to open bank accounts, which are then used to receive and launder the proceeds of other frauds.

03What does the Hong Kong record actually count?

Up to 31 May 2024 the Hong Kong Police had received three cases relating to deepfake technology, in August 2023, January 2024 and May 2024. The same reply records that between 1 November 2023 and 31 May 2024, 21 online deepfake video clips impersonating government officials or celebrities were identified by or reported to the Police, 20 of them between November 2023 and January 2024, all removed at the Police's request, and that the Police "have not received any reports involving members of the public being defrauded as a direct result of these deepfake video clips".

Read together, the two figures separate a deepfake fraud from a deepfake clip: three frauds against a person making a payment or an identity check, 21 clips with no recorded victim. A count of deepfakes online is not a count of deepfake scams.

04What do the United States agencies measure?

The IC3's 2024 Internet Crime Report records 859,532 complaints and reported losses of 16.6 billion dollars, a 33 percent increase from 2023 (2024 report). The report does not contain the word deepfake and does not break out losses attributed to synthetic media; generative AI appears only in the titles of two public service announcements listed in its appendix. The December 2024 PSA gives no counts: it lists the uses, including "videos for real time video chats with alleged company executives, law enforcement, or other authority figures", and states that "the creation or distribution of synthetic content is not inherently illegal".

FinCEN's alert states that "beginning in 2023 and continuing in 2024, FinCEN has observed an increase in suspicious activity reporting by financial institutions describing the suspected use of deepfake media", and gives no number for that increase (FIN-2024-Alert004). It asks banks to tag future reports with the key term FIN-2024-DEEPFAKEFRAUD, the mechanism by which a count could exist later.

05What checks do the agencies recommend?

The recommendations converge on one idea: move the decision off the channel the fraudster controls. The FBI PSA advises creating "a secret word or phrase with your family to verify their identity" and verifying a caller "by hanging up the phone" and calling back on a number found elsewhere; the FTC alert gives the same instruction for a relative's voice. The Hong Kong reply recommends asking a video caller to make movements in front of the camera, "such as turning their head up, down, left or right", which a pre-recorded clip cannot do.

FinCEN's red flags are written for banks but describe the same failure points: a customer who uses a third-party webcam plugin during a live verification check, who asks to change communication method because of technical glitches, whose identity photo matches a gallery of generated faces on a reverse image search, or whose "photo or video is flagged by commercial or open-source deepfake detection software". The alert adds that "no single red flag is necessarily indicative of illicit or suspicious activity". The checking a face video page orders the same checks by the strength of evidence each gives, and the liveness detection page covers the tested version of the head-movement prompt.

06What no official figure covers

No police force, court or regulator on this page publishes a total for money lost to deepfake scams, a growth rate for deepfake fraud, or a share of fraud that involves synthetic media. The figures that circulate for those quantities come from vendor surveys and press estimates. The IC3 total of 16.6 billion dollars covers all internet crime, and the report does not support attributing any share of it to deepfakes.

Nor do the records say how the fakes were made or how good they were. The Hong Kong reply states that the January 2024 conference was pre-recorded from public clips and that the May 2024 conference played altered public videos, and stops there. Whether a detector would have flagged either video is unknown; the generator and the compression, which the published in-the-wild results say decide the answer, are not named. A signed record of the clips' origin would have settled the question before any detector ran, which is the case for provenance against detection. A deepfake scam case with a known generator, a preserved file and a published detector score does not yet exist in any official record this page could find.