This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Scammers attempted to defraud a Veriff employee by using a real-time deepfake video call to impersonate the company's CEO, Kaarel Kotkas. The employee identified the fraud due to inconsistencies in the CEO's accent and verified the attempt via an internal messaging platform. No financial loss occurred, but the incident highlights the increasing sophistication of real-time synthetic media in social engineering attacks.
Scammers reportedly targeted Veriff colleague Andrea Rozenberg through WhatsApp with an urgent request and a video call that appeared to show Veriff CEO Kaarel Kotkas. Kotkas and Veriff later described the call as a real-time deepfake or live video clone. Rozenberg reportedly noticed the missing Estonian accent and verified through Slack that the request was fraudulent. No financial loss was reported.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
The incident involved scammers using real-time deepfake video and voice cloning technology to impersonate a CEO in a targeted attempt to defraud an employee.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human scammers intentionally using deployed AI deepfake tools to execute a social engineering attack.
An attempted corporate fraud utilizing a real-time deepfake video and voice clone of a CEO was successfully thwarted by a vigilant employee. The incident demonstrates the growing sophistication of consumer-accessible AI tools for social engineering, but poses negligible direct threat to national security.
The report describes the AI systems as 'free tools' used by scammers to clone voices and fake videos in real time, performing specific functions based on direct inputs.
Risk Level 3: Limited Risk. The report describes the use of 'AI-generated content such as deepfakes' to impersonate the CEO.
The scammers used AI tools to generate a real-time deepfake video and attempted to clone the CEO's voice to impersonate him.
The report is a first-hand account from the impersonated CEO, clearly describing the event, how it was detected, and the outcome. There is no conflicting information.
None
Technology
Real-time Deepfake Technology
Free tools enable scammers to fake video streams in real time.
Imperfect Acoustic Cloning
The AI tool failed to replicate the target's Estonian accent.
Data Inputs
Inadequate Accent Training Data
The voice clone lacked specific training data on Estonian accents.
Human Factors
Targeted Social Engineering
Attackers targeted a specific executive on a highly relevant topic.
Reliance on Human Detection
Security relied on individuals detecting subtle anomalies in video calls.
Process and Methods
Out-of-band Verification Gap
No automated system to verify identity before accepting executive calls.
Management
Outdated Security Frameworks
Relying on checkbox compliance instead of proving true human presence.
Regulatory Environment
Unregulated AI Cloning Tools
Easy access to free voice and video cloning tools online.
AI system involved
An AI system was involved, but the reports do not identify it.
Identified by automated extraction; can differ from the alleged developers above.
