Singapore's MAS Deepfake Report: Three Threats Financial Institutions Can't Ignore

Published Nov 5, 2025 Updated Nov 9, 2026 

In September 2025, the Monetary Authority of Singapore (MAS) released a comprehensive analysis of how deepfakes are being used against financial institutions. The information paper, Cyber Risks Associated with Deepfakes, groups the risk into three areas: deepfakes that defeat biometric authentication, social engineering and impersonation scams, and misinformation that damages market and brand confidence. For each one, MAS sets out the controls it expects institutions to consider.

Here’s what each threat looks like and the controls MAS recommends for each.

Threat 1: Deepfakes that defeat biometric authentication

Facial recognition and selfie checks were built on the assumption that a face on camera belongs to a real person. Deepfakes break that assumption, and MAS documents several cases where biometric authentication systems were beaten.

Attackers are no longer only holding a fake face up to a camera. Injection attacks feed synthetic video straight into the verification flow and bypass the camera entirely, which is why liveness detection techniques alone are no longer enough.

MAS recommends that institutions:

• Check identity documents for signs of tampering
• Add liveness detection to facial authentication
• Run regular security testing against deepfake attacks
• Protect endpoints against injection attacks

Threat 2: Social engineering with realistic impersonation

Deepfake technology amplifies traditional social engineering. A request that would once have come by email now arrives as a video call with a familiar face and voice.

In January 2024, every colleague on one Hong Kong video call was a deepfake. Engineering firm Arup lost $25M when an employee joined a video call with deepfaked versions of the CFO and colleagues and made 15 transfers.

In March 2025, a finance director at a company in Singapore was contacted on WhatsApp and invited to a Zoom call with someone impersonating the company’s CEO. The director was told to transfer more than US$499,000, and did. The director became suspicious only when a further US$1.4 million transfer was requested and alerted the bank. Singapore and Hong Kong authorities recovered the funds.

The same techniques reach beyond payments. In July 2024, a US security company discovered it had hired a North Korean operative who used a stolen identity and an AI-altered photo to pass four video interviews. Evidence shows deepfakes are infiltrating recruitment processes, giving attackers insider access from day one.

MAS recommends that institutions:

• Train staff and customers to recognize impersonation attempts
• Verify the sender through a separate channel before acting on a request
• Use audio and endpoint deepfake-detection tools
• Add controls for high-risk transactions and privileged roles, including multi-factor authentication and
  separation of duties

Threat 3: Misinformation that targets market confidence

Deepfakes don’t need to touch an institution’s systems to hurt it. A convincing fake can move markets or damage trust in minutes.

Deepfakes don’t need to touch an institution’s systems to hurt it. A convincing deepfake of an executive, a spokesperson or a public official can move markets or damage trust in minutes.

MAS recommends that institutions:

• Use monitoring tools to detect deepfake-based brand abuse and executive impersonation
• Add deepfake scenarios to incident response protocols
• Share information on attacks across the sector

The three MAS deepfake threats at a glance