The Hong Kong arup-style finance department deepfake CFO video call fraud from 2024 was, at the time, a striking outlier — a $25 million transfer authorised on the basis of a multi-participant video conference that turned out to be entirely synthetic except for the duped finance officer. Two years later, that incident is no longer an outlier. It’s part of a recognisable pattern of deepfake-enabled fraud that has moved from proof-of-concept to operational threat across the financial sector. The interesting question for 2026 is how badly it’s actually hitting banks, and whether the detection and process controls are catching up.

The honest answer is: the threat is real, the volumes are growing, and the defenders are roughly halfway through building adequate countermeasures. We’re at the awkward middle of an arms race.

Where deepfakes are actually being used in fraud

The use cases breaking out of theoretical discussion into real losses fall into a few clear categories.

Voice cloning for authorisation fraud is the most established. Customer service teams handling account verification and high-value transactions are encountering callers using cloned voices of legitimate account holders or, more dangerously, cloned voices of internal authority figures (executives, branch managers, fraud-team members). The voice quality required to fool human verification has dropped dramatically — three to five seconds of source audio is enough to produce convincing real-time voice cloning with current consumer-accessible tools. The Bank of England’s Financial Policy Committee report from March specifically called this out as a growing operational risk.

Synthetic identity onboarding is a structural problem affecting account opening flows. AI-generated identity documents, AI-generated selfie video for liveness checks, and AI-generated supporting documentation are creating a new class of synthetic identity that bypasses traditional KYC controls. The fraud isn’t always immediate — these accounts often sit dormant for weeks or months before being weaponised, which means detection at onboarding remains the highest-impact point.

Video conferencing fraud, in the Arup pattern, has remained relatively rare but high-impact. The targeted attacks where finance staff are pulled into video calls with synthetic representations of executives are typically conducted against organisations with weaker process controls around large fund movements. The defensive lesson is process, not technology — out-of-band verification of any non-routine transfer, regardless of how convincing the video conference appears, is the only reliable control.

The detection capability picture

Liveness detection has had to evolve quickly. The 2023-era passive liveness checks (looking at one frame for screen artifacts, lighting consistency, etc.) are now bypassable by current generation deepfake tooling. The active liveness approaches — asking subjects to perform unpredictable movements, randomised challenges — hold up better but introduce friction that affects legitimate customer onboarding rates.

The biometric vendors have responded. iProov, Onfido, and Jumio have all released updated detection capabilities through 2025–26 that incorporate behavioural-biometric and challenge-response approaches. The reported detection rates against current deepfake generation tools sit at 95–98% for well-implemented systems, but the failure mode is consistent: the leading-edge generation tools always get past the leading-edge detection tools, and the question is how long the catch-up cycle takes.

Voice authentication is in worse shape. Voiceprint biometrics that depend on stable spectral features are bypassable by quality voice cloning, and the industry has been transitioning toward conversational authentication patterns (asking knowledge-based questions during the call, behavioural voice analysis over time) rather than pure voiceprint matching.

The most interesting detection work is happening at the network and behavioural layer. Bank fraud teams are detecting anomalies in transaction patterns, device fingerprinting deltas, and session-behavioural signals that indicate compromised authentication regardless of whether the immediate authentication moment was passed. This is the same general approach that’s worked for years in card fraud — detection moves up the chain rather than depending on a single perfect gate.

The Australian financial sector view

The major Australian banks have invested significantly in this space. ANZ’s fraud team published a useful overview in February describing their layered approach, including upstream identity verification, transaction-level behavioural analysis, and customer education programs. CommBank’s NameCheck functionality, launched in 2023 and expanded since, is one of the more visible customer-facing controls — checking the BSB and account number against a registered name to flag mismatches that often indicate fraud.

The AUSTRAC and AFP joint operations on synthetic identity money laundering have produced some good visibility on the criminal use of these techniques. The April release of the joint Financial Crime Threat Assessment included specific commentary on AI-enabled fraud techniques being observed in Australian markets. The ABC ran coverage of several specific cases through Q1 that gave the public threat picture more concreteness than it had a year ago.

The smaller financial institutions — credit unions, neobanks, fintech-enabled lenders — face a harder version of this threat because they often don’t have the in-house fraud analytics capability of the major banks. Several have been working with external AI vendors to build the necessary detection infrastructure, including some of the Sydney-based AI consultancies doing Azure AI consulting work on fraud detection pipelines.

The customer education problem

Customer-facing communication about deepfake fraud has been awkward. The standard advice — “be cautious about unexpected calls or video conferences requesting fund transfers” — is reasonable but doesn’t really capture the threat surface. Customers don’t generally know what they’re looking at when they’re talking to a synthetic representation of their bank manager.

The more practical guidance, which a few institutions have started promoting, is process-based: agreed-upon out-of-band verification channels for high-value transactions, family code words for unexpected emergency requests, treating any urgency-pressure as a fraud signal. The Australian Banking Association ran a public education campaign in late 2025 along these lines that was reasonably effective in messaging.

Older customers are disproportionately at risk and disproportionately resistant to the process changes that would help. The “your grandson is in trouble and needs money urgently” call has been a fraud staple for years, and the deepfake voice version of it is more convincing than the previous generations. Bank fraud teams report that this category of fraud, while smaller in dollar value than the corporate-targeted incidents, accounts for a disproportionate share of customer complaints and reputational issues.

The regulator picture

ASIC’s regulatory guidance on AI use in financial services, finalised in late 2025, included specific commentary on deepfake fraud risks and expected institutional response. The Privacy and Other Legislation Amendment Act amendments around digital identity have created additional disclosure obligations for synthetic identity incidents. APRA’s CPS 234 information security framework has been informally updated through guidance to address deepfake fraud as part of operational risk management.

Internationally, the EU AI Act provisions affecting financial services include deepfake-related obligations that take effect through 2026. The UK’s FCA has been incrementally tightening fraud control requirements with deepfake risks specifically referenced. The US OCC and other federal regulators have been more reactive than proactive.

What I’d watch through 2026

The model capability curve is the single most important variable. Open-source video generation models are approaching the quality of commercial offerings, which means the cost of producing convincing fraud content is falling. The defensive cycle has to keep up with that capability curve, not just with current attack quality.

The customer process change timeline is the second variable. Banks that successfully shift their customer base to verified-channel workflows for high-value transactions will reduce their attack surface materially. Banks that depend on legacy phone-based authentication will see their fraud loss rates climb.

This is one of those threat categories where the defensive answer is mostly process and only partly technology, and the institutions that recognise that tend to do better than the ones looking for a silver-bullet detection product. The cybersecurity team can build the best deepfake detection in the world; if the wire transfer process accepts a single video-call authorisation, the detection investment is wasted. The discipline to fix the process side is the harder, more valuable work.