Deepfake scams: 10 real attacks on businesses and what stopped them

Deepfake scams use AI-made voices, faces and messages to impersonate someone you trust, usually a boss, a supplier, a lawyer or an official, so that you move money or hand over a password. We looked at ten public attacks on organisations since 2023. Five were stopped before any loss, three were paid and then clawed back, and two were lost, including Arup's $25 million video call. Software that spots fakes stopped none of them. A question only the real boss could answer stopped one. A rule about which channels the company uses stopped another, and a fast call to the bank saved the money in the rest. Below are the ten cases, what the FBI's count of AI fraud shows, the AI scams that need no deepfake at all, and a one-page money rule you can copy.

What is a deepfake scam?

It is an old fraud wearing a new mask. "CEO fraud" and fake supplier invoices have cost businesses billions for years. What AI adds is the voice and face. In McAfee's tests, three seconds of audio was enough to clone a voice with an 85% match, and anyone who speaks on video, on a podcast or in a voicemail greeting has given away far more than that.

The FBI's warning from December 2024 lists the ways criminals now use generative AI: cloned voices of public figures and relatives, live video chats with fake "company executives", messages translated by AI so the old spelling and grammar mistakes disappear, and fake ID documents and profile photos. The goal hasn't changed. Someone who can move money is made to feel they must, quickly and quietly.

10 real deepfake attacks on businesses

These are cases the organisations described themselves or a named news outlet reported, from a software firm in 2023 to an Italian private bank this year. Each shows how the attack arrived, what it asked for, and what decided the outcome.

Case file

Ten AI impersonation attacks on organisations, and what decided each one

5 STOPPED BEFORE ANY LOSS3 PAID, THEN CLAWED BACK2 LOST

1. 01 · Aug 2023Retool (software company)

   Text message, fake login page, then a call

   “IT” rang about an account problem in a deepfake of a real colleague’s voice and asked for one sign-in code.

   DECIDED BY: One code read out on the phone was enough, because the codes synced to a cloud account.

   Lost: Systems breached; 27 customers’ accounts taken over. Source: Retool

2. 02 · Early 2024Arup (engineering firm), Hong Kong office

   Message, then a video call

   A message from the “CFO” led to a video call where he and several “colleagues”, all deepfakes, asked for confidential transfers.

   DECIDED BY: It came to light only when the employee checked with head office, after the money had gone.

   Lost: 15 transfers, HK$200m (about US$25m). Source: Construction Management

3. 03 · Apr 2024LastPass (password manager)

   WhatsApp calls, texts and a voicemail

   A deepfake of the CEO’s voice pressed an employee to act urgently.

   DECIDED BY: The employee ignored it because WhatsApp is not a channel the company uses for business, and reported it.

   Stopped: No impact. Source: LastPass

4. 04 · May 2024WPP (advertising group)

   Fake WhatsApp account, then a Teams meeting

   A voice clone and YouTube footage of executives asked an agency leader to set up a new business, to get money and personal details.

   DECIDED BY: WPP hasn’t said exactly why. Its CEO’s warning afterwards: a familiar profile photo proves nothing.

   Stopped: Attempt failed. Source: The Guardian

5. 05 · Jul 2024Ferrari (car maker)

   WhatsApp messages, then a call

   A clone of the CEO’s voice asked an executive to help with a confidential deal.

   DECIDED BY: The executive asked which book the CEO had recommended to him days earlier. The caller hung up.

   Stopped: Caller hung up. Source: Bloomberg via Fortune

6. 06 · Jul 2024KnowBe4 (security training firm)

   Job application and four video interviews

   A North Korean operative with a stolen identity and an AI-altered stock photo got hired, then started loading malware on the work laptop.

   DECIDED BY: Security software flagged the malware and the device was contained in about 25 minutes.

   Stopped: Laptop isolated, no data lost. Source: KnowBe4

7. 07 · Oct 2024Wiz (cloud security firm)

   Voice message to dozens of staff

   A clone of the CEO’s voice, made from a conference talk, tried to get employees’ sign-in details.

   DECIDED BY: Staff noticed it didn’t sound like him: he speaks differently on stage than in the office.

   Stopped: Nobody fell for it. Source: TechCrunch

8. 08 · Feb 2025Italian business leaders

   Phone calls

   A clone of the defence minister’s voice asked for money to free kidnapped journalists, quietly, because the government could not be seen to be behind it.

   DECIDED BY: He filed a complaint once he realised, and police traced the money to an account in the Netherlands and froze it.

   Recovered: One businessman paid almost €1m; police froze it. Source: Reuters

9. 09 · Mar 2025A multinational’s finance director, Singapore

   WhatsApp, a “lawyer”, then a Zoom call

   The “CFO” and a deepfake “CEO” asked for a payment for a secret restructuring, with an NDA to sign first.

   DECIDED BY: A second request, for US$1.4m, tipped him off. He called the bank at once and police froze the money within two days.

   Recovered: US$499,000 sent, all of it recovered. Source: The Straits Times

10. 10 · Feb 2026Fideuram (Intesa Sanpaolo’s private bank)

    WhatsApp, then a phone call

    A message seemingly from the group CEO, then a cloned voice of a senior lawyer, asked for urgent help with an overseas deal.

    DECIDED BY: The bank spotted the irregular transfers and alerted banks and authorities in several countries.

    Recovered: €95m sent abroad; more than half recovered. Source: Reuters (2026)

Show the data as a table

When	Who	How it arrived	Outcome	What decided it
Aug 2023	Retool (software company)	Text message, fake login page, then a call	Lost: Systems breached; 27 customers’ accounts taken over	One code read out on the phone was enough, because the codes synced to a cloud account.
Early 2024	Arup (engineering firm), Hong Kong office	Message, then a video call	Lost: 15 transfers, HK$200m (about US$25m)	It came to light only when the employee checked with head office, after the money had gone.
Apr 2024	LastPass (password manager)	WhatsApp calls, texts and a voicemail	Stopped: No impact	The employee ignored it because WhatsApp is not a channel the company uses for business, and reported it.
May 2024	WPP (advertising group)	Fake WhatsApp account, then a Teams meeting	Stopped: Attempt failed	WPP hasn’t said exactly why. Its CEO’s warning afterwards: a familiar profile photo proves nothing.
Jul 2024	Ferrari (car maker)	WhatsApp messages, then a call	Stopped: Caller hung up	The executive asked which book the CEO had recommended to him days earlier. The caller hung up.
Jul 2024	KnowBe4 (security training firm)	Job application and four video interviews	Stopped: Laptop isolated, no data lost	Security software flagged the malware and the device was contained in about 25 minutes.
Oct 2024	Wiz (cloud security firm)	Voice message to dozens of staff	Stopped: Nobody fell for it	Staff noticed it didn’t sound like him: he speaks differently on stage than in the office.
Feb 2025	Italian business leaders	Phone calls	Recovered: One businessman paid almost €1m; police froze it	He filed a complaint once he realised, and police traced the money to an account in the Netherlands and froze it.
Mar 2025	A multinational’s finance director, Singapore	WhatsApp, a “lawyer”, then a Zoom call	Recovered: US$499,000 sent, all of it recovered	A second request, for US$1.4m, tipped him off. He called the bank at once and police froze the money within two days.
Feb 2026	Fideuram (Intesa Sanpaolo’s private bank)	WhatsApp, then a phone call	Recovered: €95m sent abroad; more than half recovered	The bank spotted the irregular transfers and alerted banks and authorities in several countries.

What the ten cases have in common

Read them side by side and four patterns stand out.

They arrived outside the normal channel. Five of the ten began on WhatsApp: LastPass, WPP, Ferrari, the Singapore finance director and Fideuram. Others came as a voice message, a text message or a phone call. LastPass is the clearest lesson: the employee ignored a clone of the CEO's voice simply because the company doesn't do business on WhatsApp.

Most asked for speed and secrecy. Arup's employee was invited to a call about confidential transactions. Ferrari's executive was asked to help with a confidential deal, and the Singapore director had to sign a non-disclosure agreement before the call. The Italian businessmen were told the government could not be seen to be behind the payments. Secrecy is how the scam stops you checking.

They borrowed authority. Every impersonation was of someone senior: a chief executive, a chief financial officer, a minister, a partner at a law firm. The target is meant to feel that questioning the request would be rude, or risky for their career.

Detection software stopped none of them. The stops came from a question (Ferrari), a channel rule (LastPass), knowing how the boss really sounds (Wiz) and the security software on a work laptop, which caught KnowBe4's fake employee loading malware rather than spotting a fake face. Where money had already gone, what saved it was speed: the Singapore director rang his bank as soon as a second request arrived, and police in two countries froze the full amount within two days.

The lesson is to make the fake harmless rather than trying to spot it. If no payment can be approved on the strength of a call, it doesn't matter how good the clone is.

How much do AI scams cost businesses?

The FBI's 2025 Internet Crime Report breaks out the complaints that involved artificial intelligence: 22,364 complaints with $893 million in reported losses. Business email compromise, where criminals pose as a boss or supplier to redirect a payment, cost the victims who reported it $3.05 billion across 24,768 complaints, whether or not AI was involved.

The AI cases are fewer but heavier. Look at the average reported loss per complaint:

Chart

Average reported loss when AI was involved, by type of scam (US, 2025)

• Business email compromise$224,100

  135 complaints. The average for all business email compromise complaints, AI or not, was $123,000.

• Investment fraud$145,100

  4,356 complaints

• Tech and customer support scams$33,900

  574 complaints

• Government impersonation$27,200

  260 complaints

• Real estate fraud$23,500

  115 complaints

• Employment scams$18,200

  691 complaints

• Phishing and spoofing$12,800

  803 complaints

• Extortion$1,700

  1,764 complaints

Show the data as a table

Type	AI complaints	Reported losses	Average
Business email compromise	135	$30,256,592	$224,100
Investment fraud	4,356	$632,041,188	$145,100
Tech and customer support scams	574	$19,457,078	$33,900
Government impersonation	260	$7,061,628	$27,200
Real estate fraud	115	$2,699,085	$23,500
Employment scams	691	$12,550,185	$18,200
Phishing and spoofing	803	$10,283,732	$12,800
Extortion	1,764	$2,940,642	$1,700

When AI was involved in business email compromise, the average reported loss was about $224,000, nearly twice the $123,000 average for all such complaints. The sample is small (135 complaints), and only crimes that were reported, and where AI was spotted, are counted. But the direction is clear: a convincing voice or video gets bigger payments approved.

The UK picture matches. In the government's 2025/2026 Cyber Security Breaches Survey, phishing was the most common attack, experienced by 38% of businesses.

The AI scams that don't need a deepfake

Faked faces get the headlines, but most AI fraud is quieter. These four reach small businesses every week.

Phishing emails with nothing wrong with them

The old advice was to look for spelling mistakes. In a 2024 study by Fred Heiding, Bruce Schneier and colleagues, 54% of people clicked links in fully AI-generated, personalised phishing emails, exactly the same rate as emails written by human experts, and four and a half times the 12% for generic phishing. The AI researched each target itself and got the details right in 88% of cases. Train with today's examples, make reporting a suspicious email one click, and turn on multi-factor authentication so a stolen password isn't enough.

The supplier's "new bank details"

The classic business email compromise: an email, apparently from a supplier you pay every month, says their bank has changed. AI now writes it in the supplier's own style, sometimes from inside their real, hacked mailbox. The fix is the same as for a cloned voice: confirm any change of bank details by phone, on the number already on file, and have a second person approve it.

The candidate who isn't real

The FBI has warned since 2022 that criminals apply for remote IT jobs with stolen identities and deepfakes, and that in video interviews the lips don't always match the audio. KnowBe4, a security training firm, hired one anyway after four video interviews and a clear background check. Gartner predicts that one in four candidate profiles worldwide will be fake by 2028. If you hire remotely, check identity documents live, ship equipment only to a verified address, and give new starters the least access their job needs.

Reviews used as a weapon

AI makes plausible reviews quick to write in bulk. Some owners now get a sudden wave of 1-star reviews followed by a demand for money to make them stop. Don't pay and don't engage: Google has a dedicated merchant extortion report form for exactly this, and wants screenshots of the reviews and the demands.

Can you spot a deepfake?

Sometimes. The FBI suggests looking for distorted hands, odd teeth or eyes, wrong shadows and lag; in video interviews, coughs, sneezes and lip movements may not line up with the sound. Wiz's staff noticed their CEO's clone sounded like his conference voice, not his office one. But the cases above show how thin that protection is: Arup's employee sat through a whole call of faked colleagues.

So use checks that work whether or not anyone notices anything odd:

• Call back on a number you already hold, as the FTC and FBI both advise. The fake can't answer the real phone.
• Ask something only the real person knows, as Ferrari's executive did. A shared code phrase, agreed in person, does the same job without the improvisation.
• Move it to the normal channel. "Send it through the usual approval in our banking app" ends most scams on the spot.

Deepfake-detection software exists, but for most small businesses it shouldn't be the first purchase. A tool can miss a fake, while a call-back rule stops the scam regardless.

The money rule: one page that stops most of these

Every case above would have been stopped, or cost far less, by a few plain rules written down before anyone needed them. Here is the version we start from with clients. Copy it, fill in the brackets and put it where payments are made.

HOUSE RULE · PIN BY THE DESKFILL IN THE BRACKETS

THE MONEY RULE

Copy it, put your own amount and name in the brackets, and have the owner sign it so nobody feels rude for checking.

1. 01No payment, new payee or change of bank details is approved on a call, video call, voice note, text or email alone. However real it looks or sounds.
2. 02We confirm by calling back on a number we already hold, from our own records. Never one given in the message.
3. 03Urgent plus secret means slow down. Nobody here gets in trouble for checking, including with the owner.
4. 04Two people approve every new payee, every bank-detail change and every payment over [AMOUNT].
5. 05Nobody asks for a sign-in code. Not IT, not the bank, not the boss. If they do, it’s a scam.
6. 06Requests that arrive on WhatsApp, a personal number or a new account go back through our normal channel first.
7. 07Our challenge phrase is agreed face to face and never written in email or chat.
8. 08If money has moved: ring the bank’s fraud line first, then tell [NAME]. Minutes matter.

SIGNED: ____________ (OWNER)CHECKING IS NEVER RUDE

Each line maps to a case. Rule 2 would have saved Arup, rule 5 would have stopped Retool's breach, rule 6 is what saved LastPass, rule 7 is the formal version of Ferrari's question, and rule 8 is how the Singapore company got every dollar back. The owner's signature matters most: staff need to know that checking is expected, especially when the request seems to come from the owner.

If you run an accounting or bookkeeping practice, client money makes you a bigger target than most; our guide to AI for accountants covers the client-data side.

What to do in the first hour if money has moved

Speed decides whether money comes back. In 2025 the FBI's Recovery Asset Team froze $679 million of the $1.16 billion it tried to stop, a 58% success rate, and that only works while the money is still moving.

1. Ring your bank's fraud line now, before anything else, and ask them to recall or freeze the payment. Have the amount, time and receiving account ready.
2. Report it. In the US, at ic3.gov (type it yourself). In England, Wales and Northern Ireland, to Report Fraud on 0300 123 2040, which replaced Action Fraud. In Scotland, to Police Scotland on 101. Elsewhere, to your local police and your national fraud reporting service.
3. Keep everything: messages, phone numbers, meeting invites, email headers and any recording.
4. Lock the doors. Reset passwords, sign out all sessions, and check email forwarding rules, because a criminal inside your mailbox can watch the recovery.
5. Tell your insurer, and warn suppliers or customers if your name was used.
6. Ignore anyone offering to recover the money for a fee. That is the second scam.

UK small businesses may be reimbursed. Since 7 October 2024, payments by Faster Payments or CHAPS that were lost to this kind of fraud can be reimbursed up to £85,000 for individuals, microenterprises (fewer than ten staff and turnover or balance sheet up to €2 million) and charities with income under £1 million. Report it to your bank within 13 months.

If you run AI yourself, it is a target too

The same criminals who clone voices also try to trick businesses' own AI. A website chatbot can be talked into leaking information, promising refunds or ignoring its instructions, a technique called prompt injection. If your business uses a chatbot, an AI agent or an assistant connected to your data, AI security covers testing it against those attacks before customers find the gaps. And not every AI voice is a criminal: Google's AI now rings businesses on its users' behalf, and says so.

What we would do

For most businesses we start in this order, and the first step can be in place within days:

1. Map how money moves: every way a payment, a new payee or a bank-detail change can happen, and who can approve it.
2. Write the money rule with you, with real amounts, names and a code phrase, signed by the owner.
3. Close the easy gaps: multi-factor authentication or passkeys on email, banking and finance tools, and SPF, DKIM and DMARC on your domain so criminals can't send email as you.
4. Train and drill: a short session with this year's real examples, then a practice call so the call-back becomes habit.
5. Refresh every six or twelve months, because the tricks change.

We don't sell detection software, and we'll tell you plainly if your risk is low. Our deepfake and AI scam protection page sets out what's included, and if you are not sure where to begin, AI consulting starts with that question.