The Deepfake Deception

When AI is a criminal’s best friend

How tech-savvy crooks are outfitting themselves with artificial intelligence (AI) to commit fraud.

The call seemed routine enough. A clear, recognisable voice presented as coming from the bank’s fraud department. “We’ve seen suspicious activity on your account,” the caller defined with professional alarm. “We must authenticate your identity using our facial recognition system.”

What the victim did not know was that they were not talking to their bank. The voice belonged to a high-level AI system, and the “facial recognition verification” was a deepfake generator that used a scan of their face now to create fake identification documents.

This is not science fiction; it’s the new reality of 2025’s criminal business.

When Banking Security Is the Target

The Vietnamese news headlines earlier this week sent shockwaves through the world of cybersecurity: ***“criminals had successfully used AI to bypass facial recognition software at a major bank, facilitating a $39 million money laundering operation.”*** The intricate scheme employed deepfake technology so advanced it fooled biometric security devices meant to be highly secure.

This is a watershed moment. For years, security experts have warned that, at some point, criminals would exploit deepfake technology. That “someday” arrived today with deadly precision.

The Vietnamese campaign was not the result of inexperienced hackers. These were adept criminals who understood both the technical capabilities of AI and the psychological vulnerabilities of their victims. They combined advanced deepfake technology with traditional social engineering, and the outcome was a perfect storm for fraudsters that was nearly impossible to detect until it was too late.

The Investigator’s Dilemma

For cybersecurity investigators, deepfake fraud poses unprecedented challenges. Conventional forensic methods, such as examining metadata, analysing compression artefacts, and identifying discrepancies in lighting or shadows, are becoming less effective as AI generation improves.

“We’re seeing a seismic shift in how fraud operates,” explains an advanced analyst at **The Coalition of Cyber Investigators, a pioneer in AI-powered fraud detection. **“The criminals aren’t just using enhanced tools; these are tools that learn and evolve with each attempt.”

The Coalition’s new ***“Beginner’s Guide to Deepfake Scams”*** outlines the scale of the problem. Transformed from novelty entertainment technology, it has become an advanced criminal toolset capable of:

· Unprecedented identity theft: Creating realistic video identification to open accounts

· Social engineering attacks: Impersonating executives or family members in video calls

· Evidence manipulation: Fabricating fake evidence of transactions or agreements

· Biometric system bypass: Misleading facial recognition and voice authentication

The Deception’s Hidden Infrastructure

However, the danger of deepfakes extends beyond the realm of technology. A recent study investigating facial recognition technology uncovered a nefarious web of services operating with questionable levels of transparency and accountability.

**Nine leading web-based facial recognition services were examined**, revealing a disturbing trend: one of the sites is based in Iran, raising concerns about data sovereignty and potential state-level access to uploaded biometric data. Another site features fraudulent customer testimonials with fake photographs, a clear warning sign that the entire operation may be built on deception. Several of the sites reference corporate entities that seem to be mere shells or non-existent, leaving individuals unclear about who truly owns their biometric data.

Most ominously, many platforms are not forthcoming about ownership information, often operating in a regulatory grey area that provides nefarious players with a cloak of complete protection.

This obscurity is no coincidence. It allows criminals to use sophisticated facial recognition and generation software with nary an overseer’s eye on them, while legitimate users innocently provide their biometric data to possibly compromised systems.

The Perfect Crime Ecosystem

The confluence of these factors, advanced deepfake development, susceptible recognition platforms, and regulatory gaps, yields what security experts refer to as “the perfect crime environment.”

Consider how a modern AI-driven fraud operation might work:

1. Intelligence Gathering: Criminals utilise questionable facial recognition platforms to identify and profile potential targets, harvesting biometric data under the guise of legitimate services.

2. Creating Deepfakes: They create realistic video imitations based on this information, which can mislead both human observers and machine-based systems.

3. Social Engineering: Deepfakes are being used in targeted attacks, commonly combined with other AI-generated content such as voice cloning or fake documents.

4. System Exploitation: The fake content is used to compromise security controls, open accounts, approve transactions, or directly control the victims.

5. Evidence Destruction: The crime is technological and thus generates little standard forensic evidence. Additionally, AI-generated content can create deceptive digital footprints that mislead investigations.

The Boiler Room Evolution

This weaponisation of AI is most evident in investment fraud schemes. Traditional “boiler room” operations, pressure-cooker sales rooms that utilise investors with bogus opportunities, are now being supplemented with AI capabilities.

Modern-day boiler room operators now utilise:

· AI-generated executive personas with real-world photographs, videos, and social media profiles

· AI-generated fake video testimonials from so-called satisfied investors

· Fake company records, such as bogus regulatory filings and financial reports

· Voice cloning to mimic regulatory authorities or industry icons

The Coalition of Cyber Investigators has recorded instances in which complete investment houses, complete with management teams, company backgrounds, and client endorsements, were fabricated entirely by AI. Such fake companies can last for months, harvesting millions of phoney investments before vanishing into thin air.

The New Frontier

To counter AI-aided fraud, a paradigm shift in investigative approach is necessary. Previous approaches were based on detecting human errors or technology defects. AI-generated content may be technology-faultless, but synthetic.

Investigators are developing novel approaches:

· Open-Source Intelligence (OSINT) Integration: Modern investigators leverage publicly available data from social media, domain registrations, web archives, and corporate databases to build comprehensive profiles of suspicious entities. OSINT techniques can reveal inconsistencies in AI-generated personas by cross-referencing claimed histories with verifiable public records, identifying synthetic social media activity patterns, and mapping network connections between fraudulent operations.

· Behavioural Analysis: Although deepfakes can replicate faces and voices, they struggle with subtle behavioural cues such as micro-expressions, speech rhythms, and contextual responses, which reveal their true nature.

· Cross-Platform Correlation: Synthetic personas often lack the complex digital footprints that real people possess. Researchers now cross-correlate digital presence on multiple platforms to identify synthetic identities.

· Technical Fingerprinting: Each AI generation tool leaves subtle technical fingerprints. By compiling databases of these fingerprints, researchers can determine which tools were involved in attempted fraud.

· Timeline Analysis: AI-generated content often lacks the temporal coherence of real digital histories. A timeline analysis of digital life can reveal artificial production.

The Regulatory Response Gap

Despite the growing risk, regulatory responses are disjointed and ineffectual. Current fraud legislation was written for an earlier era, before the advent of AI, and struggles to address the unique challenges posed by artificial content.

Regulatory gaps are:

· Liability regimes for AI-generated fraud that do not allocate blame

· Cross-border collaboration against crimes that span across jurisdictions using cloud-based AI services

· Evidence standards for the prosecution of cases with AI-generated content

· Responsibility by platforms for services enabling criminal exploitation of AI technologies

Self-Protection During the Deepfake Era

Protection of individuals and organisations both necessitates technological and behavioural changes:

· Verification Protocols: Implement multi-channel verification for all high-stakes requests. Hang up if a caller identifies themselves as calling from your bank; instead, redial them from an official number.

· Biometric Hygiene: Avoid uploading photos or videos on online services, especially those with questionable ownership or privacy policies.

· Digital Literacy: Familiarise yourself with the strengths and weaknesses of AI-based content. Be aware of possible deepfake signs and trust your gut when something doesn’t feel “right.”

· Organisational Policies: Companies need to adopt clear policies for authenticating identities in online communication, particularly for financial transactions or requests requiring sensitive data.

The Path Forward

The deepfake revolution is both a crisis and an opportunity. While the criminal has exploited AI to become more effective, the same technology also provides effective detection and prevention mechanisms.

They will succeed only if technologists, investigators, regulators, and the public work together.

We need:

· Better detection tools that can keep pace with generation capabilities

· Regulatory frameworks that address AI-specific threats from crime

· Industry standards for platforms that process biometric data

· Public education about AI-enabled fraud techniques

The crooks who hacked Vietnamese banks for $39 million are just the tip of the iceberg. As AI tech advances and becomes more widely available, the danger is only going to increase. But history shows that security and criminal capability are always in a delicate balance, with each breakthrough in one area prompting innovation in the other. The age of deepfakes will be no exception.

The question isn’t whether it’s possible to eliminate AI-enabled fraud; it isn’t. The question is whether we can produce systems, capacities, and cultures robust enough to mitigate their damage while enhancing the benefits of these new technologies.

That challenge begins with understanding the threat, continues with enhanced defence, and will ultimately depend on creating an online environment in which facts can be verified and trust established.

The deepfake fraud is real, but so is our capacity to neutralise it.

Follow The Coalition of Cyber Investigators on LinkedIn for state-of-the-art insights on AI-facilitated fraud prevention and detection. Their forthcoming OSINT Beginner’s Guide to Boiler Room Investment Fraud will provide actionable tools for investigating complex financial crime in the era of AI.