Deepfake Attacks Fraud Exposed — Real 2025-2026 Cases | Deepfake Detection for Beginners — Day 5 of 7

Here’s the shift I want you to understand before we go any further: deepfake attacks fraud is no longer a futuristic curiosity. In just a couple of years, AI-generated faces, cloned voices, and synthetic video have become practical tools in real-world social engineering and fraud.

And there’s an important detail beginners often miss: the deepfake itself is usually not the first step. Before an attacker creates anything, they need information about the person they’re targeting. That information often comes from OSINT — publicly available information such as photos, videos, social profiles, job details, family connections, and other digital traces.

So let’s turn the lesson around for a moment. Instead of asking, “How do attackers find victims?”, ask yourself: “What could an attacker learn about me without ever contacting me?”

That’s where today’s practical exercise begins. You can use the Google Dork Generator to understand how publicly exposed information can be discovered through search. The goal is defensive: you’re auditing your own digital footprint so you can see what information may already be available to a stranger.

This lesson sits inside the AI Deepfake Hub and connects with the Social Engineering category as part of our broader AI-powered attacks series. It also feeds into the LLM Hacking Hub, where we’re building the larger picture of AI security.

Remember the sequence: information comes first, then preparation, then the synthetic content, then delivery, and finally the attempt to exploit the victim. Once you can recognise that sequence, a deepfake stops looking like a mysterious piece of AI technology and starts looking like what it really is — one component of a larger social-engineering attack.

The Five Attack Categories

When I teach deepfake attacks, I find it much easier to understand them by grouping them into five major categories. Once you can identify the category, you can start asking the right questions: What is the attacker trying to achieve? Who is being targeted? What warning signs should I look for? And what should I do next?

Category 1: BEC and CEO Fraud. This is where attackers use cloned executive voices or deepfake video to make an employee believe a senior colleague is giving them instructions. A documented Hong Kong case involved a fraudulent $25 million transfer after an employee participated in a video call with deepfaked colleagues. The lesson I want you to remember here is simple: never let a video call replace independent verification. Use the out-of-band verification protocol from Day 4.

Category 2: Romance Scams. Here, the attacker builds an entire fictional relationship around a synthetic identity. The scam can continue for months, making it particularly difficult for victims to recognise what is happening. When I teach this category, I focus less on spotting one “bad” image and more on the pattern: inconsistent identity details, excuses for avoiding real-world verification, increasing emotional pressure, and eventually requests for money or sensitive information.

Category 3: Political Manipulation. Synthetic video and audio can also be used to make public figures appear to say or do things they never actually said or did. The important skill here isn’t simply asking, “Does this video look real?” I want you to ask, “Where did this video come from, and can I verify it independently?” That’s where the video-verification workflow from Day 3 becomes useful.

Category 4: Revenge Deepfakes and NCII. Non-consensual intimate imagery creates a different kind of harm because the victim may face harassment, humiliation, threats, or attempts at extortion. If you encounter this type of content, the priority is victim safety and removal — not investigating the material yourself. Preservation of relevant evidence, reporting to the appropriate platform or service, and understanding available legal remedies are the important steps.

Category 5: Identity Fraud. In this category, synthetic faces or other fabricated identity information can be used in attempts to bypass identity or KYC checks and obtain financial services. This is largely an institutional problem. Better identity verification, fraud detection, and layered KYC controls are the main defences.

Now step back and look at the pattern. The technology changes, but the underlying strategy is remarkably similar: find information, build credibility, create believable content, establish trust, and then exploit that trust. Once you understand that pattern, the individual deepfake techniques from Days 2 through 4 start making much more sense.

Reader Action Checklist

Before you move on, I want you to do one quick exercise. Don’t just remember the five categories — use them.

• Identify the category: If you encounter suspicious AI-generated content, ask whether it looks like CEO fraud, romance fraud, political manipulation, NCII, or identity fraud.
• Check the source: Don’t trust a video, voice message, profile, or screenshot simply because it looks authentic. Find an independent source.
• Verify separately: For financial or high-risk requests, contact the person through a trusted channel you already know.
• Look for pressure: Urgency, secrecy, emotional manipulation, and requests for money or sensitive information are major warning signs.
• Audit your exposure: Search your own name and publicly available photos, videos, and profiles to understand what information an attacker could collect.
• Stop before responding: If something feels wrong, pause. Don’t send money, credentials, identity documents, or additional recordings while you’re still verifying the situation.
• Document the evidence: If you’ve been targeted, preserve relevant messages, profiles, URLs, timestamps, and transaction information before reporting the incident.

My rule for you: when the identity is important and the consequences are serious, trust the verification process, not the appearance of the media.

BEC and CEO Fraud — The Business Video Fraud Evolution

Let’s start with how BEC has changed. When I teach this topic, I break its evolution into three generations. The important thing isn’t memorising the dates — it’s understanding how each new layer of technology makes impersonation more convincing.

Generation 1 (2015–2019): Email fraud. The attacker impersonates a CEO or senior executive through email and creates a sense of urgency around a wire transfer. The employee believes the message is genuine and sends the money. The main defences were email analysis, verification procedures, and employee training around suspicious requests.

Generation 2 (2019–2023): Voice fraud. Attackers added cloned voices to the equation. Instead of reading an email, an employee could receive a phone call that sounded like their CEO. This is where out-of-band verification became especially important: don’t verify a suspicious request using the same communication channel that delivered it.

Generation 3 (2023–present): Video and multi-person impersonation. This is the major shift I want you to understand. An attacker can potentially combine a synthetic face, cloned voice, and multiple fabricated identities into one convincing interaction.

One widely reported 2024 Hong Kong case illustrates the danger. An employee was drawn into a video meeting where the people appearing on screen were presented as senior colleagues. The conversation created a believable business context for an urgent transfer, and the employee ultimately authorised approximately $25 million.

Now pause here and look at the attack from the defender’s perspective. The attacker first identifies the right employee. Then comes reconnaissance: who is the CFO, who reports to whom, and who has authority to approve payments? Publicly available photographs, videos, presentations, and other information can help attackers build convincing impersonations.

During the interaction, the target doesn’t see just one familiar face. Multiple people may appear to confirm the same story. That’s what makes this type of fraud particularly dangerous: the attacker is trying to manufacture agreement and credibility, not simply imitate one person.

There is another pattern you should recognise: fake IT-support calls. An attacker may impersonate a technology-support employee, use a convincing cloned voice, and ask the target to approve an authentication request or reveal a verification code. The technology changes, but the social-engineering principle stays the same — create trust, introduce urgency, and make the unusual request feel routine.

Here’s the lesson I want you to remember: a familiar face or familiar voice is not proof of identity. When money, credentials, MFA approvals, or sensitive information are involved, stop the conversation and verify the request through a trusted channel you initiated yourself.

Reader Action Checklist

Before you move on, I want you to turn this into a simple habit. If you receive an unusual request from a CEO, manager, colleague, or IT support — especially one involving money, passwords, or MFA — run this checklist.

• Stop: Don’t act immediately, even if the request sounds urgent.
• Check the request: Is the person asking for money, credentials, an MFA approval, or confidential information?
• Verify independently: Contact the person through a trusted phone number, email address, or communication channel you already know.
• Ignore the familiar face or voice: Treat video and voice as evidence, not proof of identity.
• Check the context: Look for unusual urgency, secrecy, unexpected instructions, or changes from normal procedures.
• Report suspicious activity: Follow your organisation’s fraud or security reporting process instead of continuing the conversation.

My rule: if a request is unusual and the consequences are serious, verify it independently before you act.

Romance Scam Deepfakes — The Sustained Identity Attack

This is the deepfake fraud category I want you to take especially seriously because the attacker isn’t trying to fool you for five minutes. They’re trying to build a relationship with you. The financial loss can be devastating, but the emotional damage can continue long after the scam is discovered.

When I teach romance scams, I tell students to stop thinking about the fake photo or fake video as the whole scam. The technology is only one part. The real attack is the long-term construction of trust. A fabricated identity can have a synthetic or stolen face, a cloned voice, a believable background story, and social-media accounts that appear to support the same identity.

The pattern often develops gradually. During the first few weeks, the conversation is about getting to know each other. Later, the relationship becomes more personal, and plans to meet may start appearing. Those plans are repeatedly postponed for convincing reasons. Eventually, a financial problem or opportunity enters the conversation — perhaps a medical emergency, travel problem, investment opportunity, or payment that supposedly needs immediate help.

Notice what is happening here: the money request comes after the trust has already been established. That’s why simply learning to spot an AI-generated face isn’t enough.

If you or someone you know may be involved in a suspected romance scam, I want you to watch for patterns rather than relying on one technical clue. Does the person quickly move the conversation away from the dating platform? Do they repeatedly avoid meeting in person? Are video calls strangely inconsistent or technically unusual? Do their stories contain details that don’t quite match? Most importantly, are they consistently unable or unwilling to participate in a simple identity check involving someone who can independently verify who they are?

That last question is particularly useful. Ask for independent verification. Don’t try to prove the person is fake by analysing every frame of a video. Instead, look for a safe way to verify the identity outside the relationship’s existing communication channel.

And remember one more thing: if someone you’ve met online asks you for money, cryptocurrency, gift cards, banking information, identity documents, or help moving funds, pause the relationship conversation and seek independent advice before sending anything.

The lesson I want you to take away is simple: a convincing relationship is not proof of a genuine identity. When trust and money become connected, verification must come before payment.

Reader Action Checklist

If you think you or someone you know may be dealing with a deepfake romance scam, I want you to slow everything down and run through these checks.

• Don’t send money: Pause before sending cash, cryptocurrency, gift cards, or making a payment.
• Verify the identity: Use an independent method that does not rely on the person’s existing profile, phone number, or video call.
• Check the story: Look for repeated excuses, inconsistent personal details, or promises to meet that are continually postponed.
• Watch the pressure: Be cautious if affection is followed by urgency, secrecy, guilt, or a sudden financial emergency.
• Don’t share sensitive information: Avoid sending passwords, banking details, identity documents, or private photos.
• Talk to someone you trust: A second perspective can help you recognise patterns that are difficult to see when you’re emotionally involved.
• Preserve evidence: Keep relevant messages, usernames, profile URLs, payment records, and screenshots if you suspect fraud.
• Report the account: Use the platform’s reporting system and contact the appropriate financial or law-enforcement authority if money has been lost.

My rule: if an online relationship becomes connected to money, stop and verify the identity independently before doing anything else.

Political Deepfakes — Disinformation at Scale

Here’s an important point I want you to remember: a political deepfake doesn’t have to fool everyone. Sometimes the goal is simply to make a false clip believable long enough for people to share it.

We’ve seen synthetic political content become part of election-related information environments around the world. A fabricated video can make a candidate appear to say something they never said, while an AI-generated audio clip can circulate without any obvious visual clues. Some content is deliberately presented in a way that makes it difficult to tell whether it is satire, manipulation, or genuine material.

When I teach this category, I don’t want you to start by asking, “Does this candidate look fake?” Start with a better question: “Where did this video come from?”

Timing is another clue. If a sensational political clip suddenly appears just before an election, during a major political event, or immediately after breaking news, slow down before sharing it. A highly emotional or perfectly timed clip deserves more verification, not less.

This is where the verification workflow from Day 3 becomes useful. Check the original source, look for independent reporting, compare the claim with reliable recordings or transcripts, and use reverse-search or keyframe techniques when appropriate.

I also want you to watch your own reaction. If a video seems perfectly suited to confirm what you already believe or outrage you about a political opponent, that’s a reason to verify it before sharing. Emotional certainty is exactly what misinformation can exploit.

My classroom rule is simple: don’t share political media because it feels convincing, shocking, or satisfying. Verify the source first. Your individual decision may take only a few minutes, but it prevents you from becoming another distribution point for manipulated content.

Political Video Verification Checklist

Before you share a political video, audio clip, screenshot, or quote, I want you to spend four minutes running through this checklist.

• Stop before sharing: Don’t repost, comment, or forward the content until you’ve checked it.
• Find the original source: Ask who first uploaded the video and whether the source is identifiable and credible.
• Look for independent reporting: Search for coverage from multiple established news organisations or official sources.
• Check the date: Confirm the video is recent and not an old clip being presented as a new event.
• Check the context: Look for the full speech, interview, or event rather than a short edited clip.
• Run a reverse search: Use the Day 3 workflow to search key frames and identify where the footage appeared previously.
• Verify official channels: Compare the claim against official statements, verified accounts, transcripts, or recordings.
• Watch your emotional reaction: If the content makes you instantly angry, excited, or vindicated, treat that as a signal to verify more carefully.
• Check before forwarding: If you cannot independently verify the content, don’t help distribute it.

My rule: if a political clip appears at exactly the right moment to change your opinion or reinforce your existing beliefs, verify it before you share it.

Revenge Deepfakes and NCII — The Most Personal Attack

This is the section I teach with the most care because the technology may be artificial, but the harm to the person is very real. My goal here isn’t to sensationalise it. I want you to understand what NCII is, how to recognise it, and what to do if you or someone you know becomes a victim.

First, understand the problem. Non-consensual intimate imagery can now be created or manipulated using widely available AI tools. A person’s publicly available photographs can potentially be misused to create convincing synthetic content without their permission. Victims can be public figures or private individuals, and children can also be targeted.

Now think about the harm. The damage isn’t limited to the image itself. Victims may face harassment, threats, blackmail, damage to relationships, reputational consequences, and significant emotional distress. That’s why I don’t want you treating this as simply another deepfake-detection exercise.

Here’s the detection lesson. If intimate content appears to show someone you know, don’t automatically assume it’s authentic. Context matters. An unusual appearance, impossible circumstances, or a sudden appearance of intimate material involving someone who would not reasonably have created it can justify further verification. But don’t download, repost, or circulate the material while trying to investigate it.

Now let’s talk about response. If you or someone you know is affected, focus on safety and removal rather than trying to become a forensic investigator. Preserve useful evidence such as URLs, usernames, timestamps, and messages, then report the content through the relevant platform and victim-support mechanisms.

One service worth knowing is StopNCII.org, which is designed to help adults prevent participating platforms from redistributing known intimate images or videos. The service uses hashing so that participating platforms can identify matching content without requiring the original image to be uploaded to the service.

The lesson I want you to remember is simple: don’t blame the victim, don’t share the material, and don’t try to prove the deepfake by spreading it further. Help preserve evidence, report it, and get the victim connected with appropriate support.

Victim Response Checklist

If you or someone you know is targeted with a deepfake intimate image, I want you to follow this order. Safety first, evidence second, removal third.

• Don’t panic or respond to the attacker: Avoid negotiating, threatening, or sending additional material.
• Don’t share the content: Don’t forward or repost the image or video, even when trying to prove that it is fake.
• Preserve evidence: Save URLs, usernames, timestamps, messages, threats, and relevant account information.
• Report the content: Use the platform’s reporting and intimate-image-abuse mechanisms.
• Check removal options: Adults can review whether StopNCII.org supports their situation and the platforms involved.
• Secure your accounts: Change compromised passwords, enable MFA, and review privacy settings if your accounts may have been accessed.
• Get support: Tell someone you trust and consider professional, legal, or victim-support assistance.
• If there are threats or extortion: Preserve the communications and contact the appropriate law-enforcement or cybercrime reporting service in your jurisdiction.

My rule: the victim is never responsible for the creation or distribution of non-consensual content. Don’t amplify the material while trying to fight it.

The Complete Attack Chain — OSINT to Exploitation

Now I want you to connect everything we’ve learned so far. I teach the deepfake attack chain as four phases because each phase gives defenders a different opportunity to reduce the risk. If you can recognise the phase you’re looking at, you can choose the right response.

Phase 1 — OSINT. The attacker researches the target using publicly available information — photographs, videos, interviews, social-media posts, professional profiles, and other digital traces. I want you to think about this phase as exposure. You usually won’t know when someone is collecting this information, but you can control how much information you make publicly available. That’s why the digital-footprint exercise later in this lesson matters.

Phase 2 — Creation. The collected material can then be used to produce synthetic images, voices, or video. From a defender’s perspective, this phase is difficult to observe because the creation may happen entirely on infrastructure you cannot see. Your strongest opportunity is therefore to reduce exposure beforehand and prepare verification habits for the moment the synthetic content reaches you.

Phase 3 — Delivery. This is the phase I want you to watch most carefully. The attacker brings the synthetic content into a real interaction — perhaps a video call, voice message, email, social-media post, or direct message. The request may involve money, credentials, confidential information, or another action. This is your main verification window. Stop, question the request, and verify the person’s identity through a trusted channel you initiate yourself.

Phase 4 — Exploitation. This is where the attacker tries to turn trust into a result: a payment is authorised, credentials are disclosed, an account is accessed, or a victim is persuaded to continue the relationship. The key lesson is that you don’t have to wait until this stage to respond. The earlier you recognise the pattern, the more options you have.

So here’s the framework I want you to remember: Phase 1 — protect your exposure. Phase 2 — understand that synthetic content can be created from that exposure. Phase 3 — verify before you act. Phase 4 — stop the transaction or interaction if something doesn’t add up.

Attack recognition is really phase recognition. Once you can identify where you are in the chain, you can stop treating the deepfake as a mysterious piece of technology and start responding to the actual social-engineering attempt around it.

You’re In an Attack — Recognising and Responding

Recognition Signals — Know When You’re in an Attack

Every attack I’ve analysed has recognisable signals in real time. The problem is rarely that the signals are invisible. More often, the target hasn’t been trained to recognise them — or the pressure of the moment makes it difficult to act on what they see.

These are the signals I want you to recognise immediately. If you notice several of them together, switch into an “I might be in an attack” mindset.

• Urgency preventing verification: You’re told the request must be completed immediately, leaving no time for the callback or verification you would normally perform.
• Unusual communication channel: A wire-transfer request arrives through WhatsApp when the person normally uses email, or a credential-reset request comes through a video call instead of the organisation’s ticketing system.
• “Don’t tell anyone” framing: You’re instructed to keep the request confidential, preventing the normal informal verification you might otherwise perform with a colleague.
• Financial or credential request from a trusted contact: A familiar person suddenly asks for money, credentials, MFA approval, or sensitive information through an unusual channel. The combination of high stakes + unusual channel is itself a warning signal.
• Identity verification is resisted: The person pushes back when you try to verify them independently, perhaps claiming that verification is unnecessary or that you’re wasting valuable time.
• Unexplained video-call problems: Persistent lag, unusual facial movement, audio/video synchronisation problems, or other technical inconsistencies can justify additional verification. Don’t treat any single technical artifact as proof of a deepfake.
• Repeated inability to meet in person: In an online relationship, repeated promises to meet followed by convincing excuses can be an important romance-scam warning sign.
• Scripted-feeling conversation: The person gives generic answers to specific questions, struggles with shared memories, responds unnaturally, or repeatedly uses unusual pauses and phrasing.

My rule: one signal doesn’t automatically prove you’re dealing with a deepfake. Several signals appearing together — especially when money, credentials, secrecy, or urgency are involved — should trigger verification.

The Immediate Response Sequence

Now let’s turn recognition into action. Whether the attack targets you personally or reaches you through your organisation, I want you to follow the same basic sequence.

Step 1: Pause

Any of the signals above is enough to justify stopping the transaction, call, or conversation for a moment. The attacker’s advantage is momentum. Don’t give them momentum. A legitimate request can normally survive a short verification pause.

Step 2: Verify Out of Band

Contact the real person through a trusted channel that you already know. Call their known phone number, contact them through an established communication platform, or — if you’re in the same organisation — walk to their office.

Do not use contact information supplied during the suspicious interaction. The verification channel should be independent of the channel that delivered the request.

Step 3: Don’t Transfer Money or Share Credentials Under Pressure

If someone is pressuring you to transfer money, disclose credentials, approve an MFA request, or provide sensitive information before you can verify the request, stop.

Urgency is not verification. Treat an inability to verify as a reason to delay the action, not a reason to bypass the security process.

Step 4: Document What Happened

Preserve useful evidence while it is still available. Screenshot relevant messages, record the time of the interaction, save usernames or phone numbers, preserve URLs, and write down unusual phrases or instructions you remember.

Step 5: Report

If the incident occurred at work, follow your organisation’s security or fraud-reporting process immediately. If it happened personally, report the account or content to the relevant platform and contact your bank or financial institution promptly if money has moved.

For formal fraud reporting, use the appropriate authority for your jurisdiction. Examples include IC3 in the United States, Action Fraud in the United Kingdom, and Scamwatch in Australia.