This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A report indicates that 53% of businesses in the U.S. and U.K. have been targeted by deepfake scams, with 43% suffering financial losses. A notable incident involved the engineering firm Arup, which lost $25 million after employees were deceived by AI-generated deepfakes of their CFO during a video conference. Experts warn that these scams are increasing in frequency and sophistication, posing a significant threat to corporate financial security.
According to Medius, Deepfake scams have targeted 53% of businesses in the U.S. and U.K., with 43% falling victim. Using AI to create realistic fake videos and audio of corporate executives, scammers have successfully stolen millions, including $25 million from British engineering group Arup.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The employee relied on the visual and auditory representation of the CFO during the video call, demonstrating trust in the technology that led to unsafe financial transactions.
The incident involved scammers using AI-generated deepfakes to impersonate company executives and fraudulently siphoning $25 million from Arup.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was initiated by human malicious actors who intentionally deployed generative AI deepfakes to execute a financial scam after the models were trained and deployed.
Added categories peak at 3: Substantial (Epistemic Harm, Inferred)
A sophisticated generative AI deepfake scam defrauded engineering firm Arup of $25 million by impersonating company executives on a video call. This incident highlights the growing systemic threat that advanced synthetic media poses to corporate financial security and economic stability in the US and UK.
The AI system was used to perform a specific, well-defined function of generating synthetic voice and video based on direct inputs, operating as a tool for human scammers without independent goal-directed planning.
Limited Risk: The report describes the use of 'AI-generated content such as deepfakes', which falls under the Limited Risk category requiring specific transparency obligations to ensure users are informed.
The scammers used generative AI to create realistic video and audio representations of the company's CFO and other employees to conduct a fake video conference.
The reports provide clear, detailed, and consistent accounts of the $25 million deepfake scam at Arup, including the specific mechanism of the fraud (video conference with deepfake CFO and employees) and the broader context of deepfake financial scams.
None
Technology
Sophisticated Deepfake Generation
AI tools can convincingly clone executive voices and faces.
Inadequate Verification Tools
Traditional security systems cannot detect AI-driven vocal anomalies.
Dark Web Software Democratization
Cheap, accessible scamming software is widely available on the dark web.
Data Inputs
Public Executive Media Availability
YouTube videos and podcasts provide source material for cloning.
Lack of Biometric Data Controls
Absence of secure digital identity wallets to verify participant liveness.
Human Factors
Inherent Trust in Familiar Voices
Employees naturally trust voices and faces they recognize.
Susceptibility to Social Engineering
Pressure from false urgency and flattery compromises decision-making.
Lack of Deepfake Awareness
Staff lack training to recognize and respond to AI-driven impersonations.
Process and Methods
Weak Payment Verification Processes
Absence of multi-level sign-offs or dual-authorization for transfers.
Inadequate Incident Response Plans
Lack of documented procedures for responding to suspected deepfake attacks.
Reliance on Verbal Communication
Critical financial transactions conducted over unverified voice/video calls.
Management
Inadequate Risk Assessment
Failure to assess and prepare for generative AI threats to financial security.
Insufficient Security Training Budget
Lack of investment in educating high-risk departments on deepfakes.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
