Deepfakes in banking get past the checks built to stop fraud

Published June 5, 2025 Updated October 28, 2026 

FinCEN warned financial institutions in November 2024 about fraud using deepfake media and AI-altered identity documents. Banks put that warning to work by checking voice, video, and images where identity or money changes hands, in contact center calls, account opening, and payment approvals.

A cloned voice can pass a contact center check. A synthetic face can clear onboarding. A deepfaked CFO can get a wire approved. Each attack works by passing a control the bank already trusts, which is why the fix sits inside those controls rather than next to them.

Deloitte estimates generative AI-enabled fraud losses in the U.S. could reach $40B by 2027, up from $12.3B in 2023.

Scams aimed at customers’ own accounts, like a cloned grandchild asking for bail money, are covered in deepfake scams that reach bank customers. This page covers what reaches the bank itself.

Account takeover through the contact center

Voice authentication was built to confirm a caller is who they say they are. It wasn’t built to ask whether the voice is real.

A 2025 study found that face-to-voice attacks can generate synthetic voices from a single facial image and bypass industry-standard voice-authentication systems.

Once a cloned voice clears the interactive voice response (IVR) system or the agent, the attacker asks to reset a password, add a payee, or change the contact details on the account. Each request looks like a customer asking for help.

Synthetic identities at account opening

At account opening, an attacker submits an AI-generated selfie or injects synthetic video into the verification step, so a person who doesn’t exist passes as one who does. A 2025 academic paper states that deepfake-enabled video injection attacks challenge remote biometric authentication systems.

Synthetic identities are already a lender problem. U.S. lender exposure to synthetic identities hit an all-time high of $3.3 billion at year-end 2024. For the full onboarding playbook, see how deepfakes exploit KYC verification systems.

Executive impersonation on payment approvals

Executive impersonation targets the approval, not the account. An attacker joins a call as the CFO or a senior leader and asks for an urgent transfer that the employee has the authority to make.

Engineering firm Arup lost $25M when an employee joined a video call with deepfaked versions of the CFO and colleagues and made 15 transfers. Nothing in a standard payment approval asks whether the people on the call are real.

What a bank’s deepfake checks need to cover

Each entry point needs its own check, placed where the decision gets made. Voice biometrics still confirm who’s calling. Deepfake detection answers a different question, whether the voice is real.

• Score the caller’s voice inside the contact center flow, before an agent resets credentials or adds a payee.
• Check selfies and video submitted at account opening, alongside the identity checks you already run.
• Require a callback on a known number for any urgent transfer requested on a call or video meeting.
• Train approvers and agents to pause on urgency, and give them a fast way to escalate a suspicious call.

Where Reality Defender fits

Check the voice before the agent acts on the request. RealCall analyzes the caller’s voice in the contact center and flags voices that show signs of AI generation, so the agent can escalate. Fraud teams can run onboarding images and recorded video through RealScan to see whether they show signs of AI generation or manipulation. Reality Defender detects AI-generated voice, video, and image for financial services teams. It doesn’t verify identity, so it sits alongside the authentication and KYC checks a bank already runs.