{"id":5605,"date":"2026-05-21T14:25:05","date_gmt":"2026-05-21T14:25:05","guid":{"rendered":"https:\/\/adex.com\/blog\/?p=5605"},"modified":"2026-05-21T14:25:06","modified_gmt":"2026-05-21T14:25:06","slug":"deepfake-scam-online-fraud","status":"publish","type":"post","link":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/","title":{"rendered":"What Is a Deepfake Scam? How AI Is Used in Online Fraud"},"content":{"rendered":"\n<p>In a single morning in early 2024, a finance employee at Arup&#8217;s Hong Kong office wired $25 million across 15 transactions, acting on instructions from a video meeting in which every other participant was synthetic. Ferrari, WPP, and LastPass each disclosed credible near-miss attempts on senior executives that same year.<\/p>\n\n\n\n<p>Identity-verification platforms now report AI-assisted fraud as a steady-state line item, not an emerging anomaly. This article explains how deepfake scams actually work, which four categories of attack matter, and why the leverage point in defense is workflow design rather than better detection, illustrated with documented cases and a layer-by-layer look at where current defenses succeed and fail.<\/p>\n\n\n<div class=\"toc\"><h4 class=\"toc__title\" id=\"contents\">Contents<\/h4><ul class=\"toc__list\"><li class=\"toc__list_item\"><a href=\"#tldr\">TL;DR<\/a><\/li><li class=\"toc__list_item\"><a href=\"#key-takeaways\">Key Takeaways<\/a><\/li><li class=\"toc__list_item\"><a href=\"#what-a-deepfake-scam-actually-is\">What a Deepfake Scam Actually Is<\/a><\/li><li class=\"toc__list_item\"><a href=\"#how-a-deepfake-scam-actually-works\">How a Deepfake Scam Actually Works<\/a><\/li><li class=\"toc__list_item\"><a href=\"#anatomy-of-a-deepfake-scam-from-source-material-to-executed-fraud\">Anatomy of a Deepfake Scam: From Source Material to Executed Fraud<\/a><\/li><li class=\"toc__list_item\"><a href=\"#the-categories-worth-distinguishing\">The Categories Worth Distinguishing<\/a><\/li><li class=\"toc__list_item\"><a href=\"#how-deepfake-fraud-enters-the-adtech-supply-chain\">How Deepfake Fraud Enters the Adtech Supply Chain<\/a><\/li><li class=\"toc__list_item\"><a href=\"#where-deepfakes-actually-enter-performance-marketing\">Where Deepfakes Actually Enter Performance Marketing<\/a><\/li><li class=\"toc__list_item\"><a href=\"#one-loss-two-saves-what-three-2024-deepfake-cases-reveal\">One Loss, Two Saves: What Three 2024 Deepfake Cases Reveal<\/a><\/li><li class=\"toc__list_item\"><a href=\"#detection-what-actually-works-and-what-it-misses\">Detection: What Actually Works, and What It Misses<\/a><\/li><li class=\"toc__list_item\"><a href=\"#what-each-defense-layer-catches-and-what-it-routinely-misses\">What Each Defense Layer Catches \u2014 and What It Routinely Misses<\/a><\/li><li class=\"toc__list_item\"><a href=\"#where-defenses-fail-honestly\">Where Defenses Fail Honestly<\/a><\/li><li class=\"toc__list_item\"><a href=\"#one-attack-different-failure-surfaces\">One Attack, Different Failure Surfaces<\/a><\/li><li class=\"toc__list_item\"><a href=\"#the-sharper-frame\">The Sharper Frame<\/a><\/li><li class=\"toc__list_item\"><a href=\"#frequently-asked-questions\">Frequently asked questions<\/a><\/li><\/ul><\/div><style>\n.toc {}\n.toc__title {\n      font-size: 32px;\n    line-height: 40px;\n    font-weight: 700;\n}\n.toc__list_item {\n    color: #FE645A !important;\n}\n.toc__list_item:not(:last-child){\n    margin-bottom: 5px;\n}\n.toc__list_item a {\n    font-size: 18px;\n    line-height: 24px;\n    color: #FE645A;\n    font-weight: 600;\n}\n.toc__list_item a:hover {\n    text-decoration: underline;\n}\n@media (max-width: 1023px) {.toc__title {font-size: 24px;line-height: 32px;}}\n<\/style>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"tldr\">TL;DR<\/h2>\n\n\n\n<p>A deepfake scam uses AI-generated voice, video, or documents to impersonate someone, but the synthetic media is only one stage of a longer social-engineering chain, and the largest losses (Arup&#8217;s $25M, the 2024 Hong Kong CFO case) happened because of weak transfer-approval workflows, not because the fakes were undetectable.&nbsp;<\/p>\n\n\n\n<p>Detection alone fails: per-asset detectors lag generative models, and <strong>camera-stream injection<\/strong> now bypasses most liveness checks. The defensible posture is layered detection plus procedural resilience \u2013 out-of-band confirmation, dual approval, cluster analysis of new accounts, so that no single signal is decisive.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"key-takeaways\">Key Takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A <strong>deepfake scam<\/strong> uses AI-generated audio, video, or imagery to impersonate a real person, document, or organization. The synthetic asset is rarely the whole attack \u2013 it is one stage inside a social-engineering chain.<\/li>\n\n\n\n<li>Four categories matter, and they fail differently: <strong>executive impersonation (BEC 2.0)<\/strong>, <strong>identity-document fraud<\/strong>, <strong>celebrity \/ brand impersonation<\/strong>, and <strong>synthetic creator \/ publisher fraud<\/strong>.<\/li>\n\n\n\n<li>The fastest-growing bypass technique in 2026 is not better generative output. It is <strong>camera-stream injection<\/strong>, which feeds a synthetic video feed into the OS camera interface, defeating liveness checks that examine only the face.<\/li>\n\n\n\n<li>The most expensive breaches succeed because of <strong>workflow design<\/strong>, not video quality. The Arup case (~$25M, Hong Kong office, 2024) turned on a procedure that allowed a large transfer to be authorized on the strength of a video call alone.<\/li>\n\n\n\n<li>A defensible posture is <strong>layered detection plus procedural resilience<\/strong>: assume any single signal can be wrong, and design approvals so that no single signal is decisive.<\/li>\n<\/ul>\n\n\n<div class=\"block__preview\">\n        <a href=\"https:\/\/adex.com\/blog\/biggest-malware-scandals-2025\/\" class=\"block__preview_img\"><img src=\"https:\/\/adex.com\/blog\/wp-content\/uploads\/2026\/02\/adex-biggest-malware-scandals-2025.jpg\" srcset=\"https:\/\/adex.com\/blog\/wp-content\/uploads\/2026\/02\/adex-biggest-malware-scandals-2025.jpg\" sizes=\"100vw\" alt=\"Adex: the biggest malware scandals in 2025\" decoding=\"async\" class=\"lazy\"><\/a>\n    <div class=\"block__preview_box\">\n        <a href=\"https:\/\/adex.com\/blog\/category\/current_risks\/\" class=\"block__preview_box-cat\">Current risks<\/a>        <h3 class=\"block__preview_box-title\" id=\"the-biggest-malware-scandals-in-2025-why-the-fraud-looks-legit\"><a href=\"https:\/\/adex.com\/blog\/biggest-malware-scandals-2025\/\">The Biggest Malware Scandals in 2025: Why The Fraud Looks Legit?\u00a0<\/a><\/h3>\n    <\/div>\n<\/div>\n<style>\n.block__preview {display: flex;align-items: center;justify-content: center; margin: 32px 0;}\n.block__preview a {text-decoration: none;}\n.block__preview_img {min-width: 360px;max-width: 360px;min-height: 188px;width: 100%;height: 100%;}\n.block__preview_img img {width: 100%;height: 100%;}\n.block__preview_box {margin-left: 40px;max-width: 360px;}\n.block__preview_box-cat {color: #00B8A7 !important;font-weight: 600;font-size: 12px;line-height: 16px;text-transform: uppercase; display: block; margin-bottom: 4px;}\n.block__preview_box-cat:hover {color: #FE645A !important; text-decoration: none !important;}\n.block__preview_box-title {font-size: 20px;font-weight: 700;line-height: 24px;color: #0B172D;}\n.block__preview_box-title a {color: #0B172D !important;}\n.block__preview_box-title a:hover {color: #FE645A !important;}\n@media screen and (max-width: 768px) {.block__preview {flex-direction: column;}.block__preview_box {max-width: 100%; margin-top: 32px;margin-left: 0px;}.block__preview_img {max-width: 100%;min-width: 100%;min-height: 100%;}}<\/style>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-a-deepfake-scam-actually-is\">What a Deepfake Scam Actually Is<\/h2>\n\n\n\n<p>A deepfake scam is fraud that uses AI-generated audio, video, or imagery to impersonate a real person, a real document, or a real organization convincingly enough to extract money, access, or trust. Impersonation is not new; it has existed for as long as commerce has, but generative models have collapsed the cost of producing a believable fake from &#8220;skilled studio work&#8221; to &#8220;a laptop and a few minutes.&#8221;<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">That cost collapse is the part most coverage understates. Attackers can fake a face or a voice; that is settled. What matters now is where the fake enters the workflow, what decision it short-circuits, and which of the defenses sold as &#8220;deepfake detection&#8221; hold up once attackers know what those defenses are looking for.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-a-deepfake-scam-actually-works\">How a Deepfake Scam Actually Works<\/h2>\n\n\n\n<p>Most deepfake fraud follows a recognizable shape, even when the surface details change. There is a target whose identity is worth stealing, a relationship the attacker wants to ride on top of, and a moment of decision that the fake is designed to push through faster than scrutiny can catch up.<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">The &#8220;deepfake&#8221; itself is rarely the whole attack. It is one component inside a social-engineering chain. The synthetic asset \u2013 a cloned voice on a phone call, a face-swapped video on a Zoom call, an AI-generated passport submitted to a verification flow \u2013 exists to make the next step feel routine. The scam succeeds when the receiving human treats a synthetic input as they would a genuine one.<\/p>\n\n\n\n<div class=\"adex-deepfake-block\">\n  <style>\n    .adex-deepfake-block {\n      font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n      background: #ffffff;\n      border: 1px solid #e3e6f0;\n      border-radius: 18px;\n      padding: 36px 32px 32px;\n      max-width: 1120px;\n      margin: 32px auto;\n      box-sizing: border-box;\n      color: #17104f;\n    }\n\n    .adex-deepfake-block *,\n    .adex-deepfake-block *::before,\n    .adex-deepfake-block *::after {\n      box-sizing: border-box;\n    }\n\n    .adex-df-eyebrow {\n      margin: 0 0 12px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 13px;\n      line-height: 1.2;\n      letter-spacing: 0.22em;\n      text-transform: uppercase;\n      font-weight: 700;\n      color: #717498;\n    }\n\n    .adex-df-title {\n      margin: 0 0 10px;\n      font-size: 28px;\n      line-height: 1.18;\n      letter-spacing: -0.03em;\n      font-weight: 800;\n      color: #17006f;\n    }\n\n    .adex-df-subtitle {\n      margin: 0;\n      max-width: 760px;\n      font-size: 18px;\n      line-height: 1.45;\n      font-style: italic;\n      color: #6c6f96;\n    }\n\n    .adex-df-timeline {\n      position: relative;\n      display: grid;\n      grid-template-columns: repeat(5, minmax(0, 1fr));\n      gap: 24px;\n      margin: 52px 0 42px;\n    }\n\n    .adex-df-timeline::before {\n      content: \"\";\n      position: absolute;\n      top: 29px;\n      left: 9%;\n      right: 9%;\n      height: 3px;\n      background: #e4e7f2;\n      z-index: 1;\n    }\n\n    .adex-df-stage {\n      position: relative;\n      z-index: 2;\n      text-align: center;\n      min-width: 0;\n    }\n\n    .adex-df-number {\n      width: 46px;\n      height: 46px;\n      margin: 0 auto 24px;\n      border-radius: 50%;\n      border: 3px solid #c7ccdf;\n      background: #ffffff;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 16px;\n      font-weight: 800;\n      color: #150066;\n    }\n\n    .adex-df-stage-label {\n      margin: 0 0 12px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 13px;\n      line-height: 1.2;\n      letter-spacing: 0.18em;\n      text-transform: uppercase;\n      font-weight: 700;\n      color: #737699;\n    }\n\n    .adex-df-stage-title {\n      margin: 0 0 12px;\n      font-size: 19px;\n      line-height: 1.25;\n      font-weight: 800;\n      color: #150066;\n    }\n\n    .adex-df-stage-text {\n      margin: 0;\n      font-size: 16px;\n      line-height: 1.42;\n      color: #282455;\n    }\n\n    .adex-df-defense {\n      border: 1px dashed #c8d0ea;\n      border-radius: 14px;\n      background: #f8f9fd;\n      padding: 26px 28px 24px;\n    }\n\n    .adex-df-defense-top {\n      display: grid;\n      grid-template-columns: 1fr 1fr;\n      gap: 24px;\n      align-items: center;\n      margin-bottom: 22px;\n    }\n\n    .adex-df-defense-heading {\n      display: flex;\n      align-items: center;\n      gap: 12px;\n      margin: 0;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 14px;\n      line-height: 1.2;\n      letter-spacing: 0.18em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #150066;\n    }\n\n    .adex-df-shield {\n      width: 32px;\n      height: 32px;\n      border-radius: 9px;\n      background: #d8f3ea;\n      display: inline-flex;\n      align-items: center;\n      justify-content: center;\n      flex: 0 0 auto;\n      color: #009b72;\n    }\n\n    .adex-df-defense-note {\n      margin: 0;\n      text-align: right;\n      font-size: 16px;\n      line-height: 1.35;\n      font-style: italic;\n      color: #6c6f96;\n    }\n\n    .adex-df-defense-grid {\n      display: grid;\n      grid-template-columns: repeat(3, minmax(0, 1fr));\n      gap: 28px;\n      max-width: 760px;\n      margin: 0 auto;\n      text-align: center;\n    }\n\n    .adex-df-pill {\n      display: inline-flex;\n      align-items: center;\n      justify-content: center;\n      gap: 8px;\n      min-width: 94px;\n      margin: 0 auto 12px;\n      padding: 7px 14px;\n      border: 1px solid #b6eadc;\n      border-radius: 999px;\n      background: #ffffff;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 14px;\n      line-height: 1;\n      font-weight: 800;\n      color: #009b72;\n    }\n\n    .adex-df-dot {\n      width: 8px;\n      height: 8px;\n      border-radius: 50%;\n      background: #00a77a;\n      display: inline-block;\n    }\n\n    .adex-df-defense-text {\n      margin: 0;\n      font-size: 15px;\n      line-height: 1.38;\n      color: #282455;\n    }\n\n    @media (max-width: 900px) {\n      .adex-deepfake-block {\n        padding: 28px 22px;\n      }\n\n      .adex-df-title {\n        font-size: 24px;\n      }\n\n      .adex-df-subtitle {\n        font-size: 16px;\n      }\n\n      .adex-df-timeline {\n        grid-template-columns: 1fr;\n        gap: 28px;\n        margin-top: 36px;\n      }\n\n      .adex-df-timeline::before {\n        display: none;\n      }\n\n      .adex-df-number {\n        margin-bottom: 14px;\n      }\n\n      .adex-df-defense-top {\n        grid-template-columns: 1fr;\n      }\n\n      .adex-df-defense-note {\n        text-align: left;\n      }\n\n      .adex-df-defense-grid {\n        grid-template-columns: 1fr;\n        gap: 22px;\n      }\n    }\n  <\/style>\n\n  <div class=\"adex-df-eyebrow\">Attack Chain \u00b7 5 Stages<\/div>\n\n  <h2 class=\"adex-df-title\" id=\"anatomy-of-a-deepfake-scam-from-source-material-to-executed-fraud\">Anatomy of a Deepfake Scam: From Source Material to Executed Fraud<\/h2>\n\n  <p class=\"adex-df-subtitle\">\n    The synthetic asset is just one link. Mapping the full chain shows where defenses can intervene long before a fake reaches its target.\n  <\/p>\n\n  <div class=\"adex-df-timeline\">\n    <div class=\"adex-df-stage\">\n      <div class=\"adex-df-number\">01<\/div>\n      <p class=\"adex-df-stage-label\">Stage 1<\/p>\n      <h3 class=\"adex-df-stage-title\" id=\"source-harvesting\">Source Harvesting<\/h3>\n      <p class=\"adex-df-stage-text\">Public videos, voice recordings, leaked KYC images, scraped social profiles.<\/p>\n    <\/div>\n\n    <div class=\"adex-df-stage\">\n      <div class=\"adex-df-number\">02<\/div>\n      <p class=\"adex-df-stage-label\">Stage 2<\/p>\n      <h3 class=\"adex-df-stage-title\" id=\"asset-generation\">Asset Generation<\/h3>\n      <p class=\"adex-df-stage-text\">Voice clone, face-swap model, synthetic ID document, AI-written backstory.<\/p>\n    <\/div>\n\n    <div class=\"adex-df-stage\">\n      <div class=\"adex-df-number\">03<\/div>\n      <p class=\"adex-df-stage-label\">Stage 3<\/p>\n      <h3 class=\"adex-df-stage-title\" id=\"channel-selection\">Channel Selection<\/h3>\n      <p class=\"adex-df-stage-text\">Pretext chosen: video call, voicemail, KYC upload, advertiser onboarding, payout request.<\/p>\n    <\/div>\n\n    <div class=\"adex-df-stage\">\n      <div class=\"adex-df-number\">04<\/div>\n      <p class=\"adex-df-stage-label\">Stage 4<\/p>\n      <h3 class=\"adex-df-stage-title\" id=\"pressure-moment\">Pressure Moment<\/h3>\n      <p class=\"adex-df-stage-text\">Urgency, authority, financial threshold, hard deadline.<\/p>\n    <\/div>\n\n    <div class=\"adex-df-stage\">\n      <div class=\"adex-df-number\">05<\/div>\n      <p class=\"adex-df-stage-label\">Stage 5<\/p>\n      <h3 class=\"adex-df-stage-title\" id=\"execution\">Execution<\/h3>\n      <p class=\"adex-df-stage-text\">Wire transfer, account approval, campaign launch, payout release.<\/p>\n    <\/div>\n  <\/div>\n\n  <div class=\"adex-df-defense\">\n    <div class=\"adex-df-defense-top\">\n      <h3 class=\"adex-df-defense-heading\">\n        <span class=\"adex-df-shield\">\n          <svg width=\"18\" height=\"18\" viewBox=\"0 0 24 24\" fill=\"none\" aria-hidden=\"true\">\n            <path d=\"M12 3L19 6V11C19 15.5 16.1 19.6 12 21C7.9 19.6 5 15.5 5 11V6L12 3Z\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linejoin=\"round\"\/>\n            <path d=\"M9 12L11 14L15.5 9.5\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/>\n          <\/svg>\n        <\/span>\n        Defense Opportunities\n      <\/h3>\n\n      <p class=\"adex-df-defense-note\">Where the chain can be broken before execution<\/p>\n    <\/div>\n\n    <div class=\"adex-df-defense-grid\">\n      <div>\n        <div class=\"adex-df-pill\"><span class=\"adex-df-dot\"><\/span>Detect<\/div>\n        <p class=\"adex-df-defense-text\">Provenance signals, watermark scans, model fingerprinting at upload.<\/p>\n      <\/div>\n\n      <div>\n        <div class=\"adex-df-pill\"><span class=\"adex-df-dot\"><\/span>Verify<\/div>\n        <p class=\"adex-df-defense-text\">Out-of-band confirmation, callback protocols, second-channel checks.<\/p>\n      <\/div>\n\n      <div>\n        <div class=\"adex-df-pill\"><span class=\"adex-df-dot\"><\/span>Slow<\/div>\n        <p class=\"adex-df-defense-text\">Mandatory cool-down, dual-approval thresholds, urgency-trigger reviews.<\/p>\n      <\/div>\n    <\/div>\n  <\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"the-categories-worth-distinguishing\">The Categories Worth Distinguishing<\/h2>\n\n\n\n<p>&#8220;Deepfake scam&#8221; is used loosely in the press, which makes it harder to think clearly about defenses. In practice, four categories matter, and they fail to overlap as cleanly as headlines suggest.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Category<\/strong><\/td><td><strong>What is faked<\/strong><\/td><td><strong>Typical channel<\/strong><\/td><td><strong>Primary target<\/strong><\/td><td><strong>Where defenses tend to break<\/strong><\/td><\/tr><tr><td><strong>Executive impersonation (BEC 2.0)<\/strong><\/td><td>Voice or video of a real executive<\/td><td>Phone call, video conference<\/td><td>Finance staff, payment approvers<\/td><td>Trust in the visual channel; urgency overrides verification protocol<\/td><\/tr><tr><td><strong>Identity-document fraud<\/strong><\/td><td>Synthetic passport, ID card, selfie, liveness video<\/td><td>KYC \/ onboarding flows<\/td><td>Banks, exchanges, ad platforms, affiliate networks<\/td><td>Per-document checks pass; cluster signals across accounts are missed<\/td><\/tr><tr><td><strong>Celebrity \/ brand impersonation<\/strong><\/td><td>Face and voice of a public figure endorsing a product<\/td><td>Video ads, social posts, landing pages<\/td><td>Consumers; the impersonated brand&#8217;s reputation<\/td><td>Pre-publication review at scale; takedown latency<\/td><\/tr><tr><td><strong>Synthetic creator \/ publisher fraud<\/strong><\/td><td>A wholly fabricated person \u2014 face, voice, history \u2014 used to operate accounts<\/td><td>Affiliate programs, creator monetization, advertiser onboarding<\/td><td>Payout systems, attribution models<\/td><td>Single-account scrutiny finds nothing; the fraud is visible only at the network level<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Treating these as a single problem produces one-size-fits-all detection logic that catches none of them well. A liveness check tuned for KYC will not help a CFO on a Zoom call. A behavioral model trained on advertiser onboarding will not catch a cloned voice authorizing a wire.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-deepfake-fraud-enters-the-adtech-supply-chain\">How Deepfake Fraud Enters the Adtech Supply Chain<\/h2>\n\n\n\n<div class=\"adex-entry-points-block\">\n  <style>\n    .adex-entry-points-block {\n      max-width: 1120px;\n      margin: 32px auto;\n      padding: 44px 40px 36px;\n      background: #ffffff;\n      border: 1px solid #e2e5f0;\n      border-radius: 18px;\n      font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n      color: #201b4f;\n      box-sizing: border-box;\n      overflow: hidden;\n    }\n\n    .adex-entry-points-block *,\n    .adex-entry-points-block *::before,\n    .adex-entry-points-block *::after {\n      box-sizing: border-box;\n    }\n\n    .adex-entry-points-block .adex-ep-head {\n      text-align: center;\n      margin-bottom: 40px;\n    }\n\n    .adex-entry-points-block .adex-ep-eyebrow {\n      margin: 0 0 12px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 13px;\n      line-height: 1.2;\n      letter-spacing: 0.22em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #727599;\n    }\n\n    .adex-entry-points-block .adex-ep-title {\n      margin: 0;\n      font-size: 29px;\n      line-height: 1.18;\n      letter-spacing: -0.03em;\n      font-weight: 800;\n      color: #16006f;\n    }\n\n    .adex-entry-points-block .adex-ep-grid {\n      display: grid;\n      grid-template-columns: repeat(2, minmax(0, 1fr));\n      gap: 22px;\n      margin-bottom: 30px;\n    }\n\n    .adex-entry-points-block .adex-ep-card {\n      background: #fbfcff;\n      border: 1px solid #e1e5ef;\n      border-radius: 14px;\n      padding: 26px 24px 24px;\n      min-height: 250px;\n      display: flex;\n      flex-direction: column;\n    }\n\n    .adex-entry-points-block .adex-ep-card-head {\n      display: grid;\n      grid-template-columns: 46px 1fr;\n      gap: 16px;\n      align-items: center;\n      margin-bottom: 22px;\n    }\n\n    .adex-entry-points-block .adex-ep-icon {\n      width: 46px;\n      height: 46px;\n      border-radius: 10px;\n      background: #e8e6f5;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      color: #16006f;\n      flex: 0 0 auto;\n    }\n\n    .adex-entry-points-block .adex-ep-tag {\n      margin: 0 0 6px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 13px;\n      line-height: 1.2;\n      letter-spacing: 0.18em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #74779a;\n    }\n\n    .adex-entry-points-block .adex-ep-card-title {\n      margin: 0;\n      font-size: 20px;\n      line-height: 1.2;\n      font-weight: 800;\n      color: #16006f;\n    }\n\n    .adex-entry-points-block .adex-ep-list {\n      list-style: none !important;\n      padding: 0 !important;\n      margin: 0 0 24px !important;\n    }\n\n    .adex-entry-points-block .adex-ep-list li {\n      list-style: none !important;\n      list-style-type: none !important;\n      position: relative;\n      margin: 0 0 13px !important;\n      padding-left: 26px !important;\n      font-size: 17px;\n      line-height: 1.35;\n      color: #282455;\n    }\n\n    .adex-entry-points-block .adex-ep-list li::marker {\n      content: \"\" !important;\n      font-size: 0 !important;\n    }\n\n    .adex-entry-points-block .adex-ep-list li::before {\n      content: \"\";\n      position: absolute;\n      left: 0;\n      top: 0.72em;\n      width: 8px;\n      height: 3px;\n      background: #16006f;\n      border-radius: 99px;\n    }\n\n    .adex-entry-points-block .adex-ep-note {\n      margin: auto 0 0;\n      padding-top: 18px;\n      border-top: 1px dashed #d9deec;\n      font-size: 16px;\n      line-height: 1.35;\n      font-style: italic;\n      color: #6d7094;\n    }\n\n    .adex-entry-points-block .adex-ep-bottom {\n      margin-top: 26px;\n      padding: 28px 32px;\n      border-radius: 14px;\n      background: linear-gradient(90deg, #19006f 0%, #342090 100%);\n      color: #ffffff;\n    }\n\n    .adex-entry-points-block .adex-ep-bottom-label {\n      margin: 0 0 20px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 14px;\n      line-height: 1.2;\n      letter-spacing: 0.22em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #d9d6ff;\n    }\n\n    .adex-entry-points-block .adex-ep-bottom-line {\n      margin: 0;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 18px;\n      line-height: 1.45;\n      font-weight: 800;\n      color: #ffffff;\n    }\n\n    .adex-entry-points-block .adex-ep-crossed {\n      color: rgba(255, 255, 255, 0.62);\n      text-decoration: line-through;\n      text-decoration-thickness: 2px;\n      text-decoration-color: rgba(255, 255, 255, 0.72);\n      margin-right: 14px;\n      white-space: nowrap;\n    }\n\n    .adex-entry-points-block .adex-ep-arrow {\n      margin: 0 14px;\n      color: #ffffff;\n      white-space: nowrap;\n    }\n\n    .adex-entry-points-block .adex-ep-strong {\n      color: #ffffff;\n    }\n\n    @media (max-width: 900px) {\n      .adex-entry-points-block {\n        padding: 32px 22px;\n      }\n\n      .adex-entry-points-block .adex-ep-title {\n        font-size: 24px;\n      }\n\n      .adex-entry-points-block .adex-ep-grid {\n        grid-template-columns: 1fr;\n      }\n\n      .adex-entry-points-block .adex-ep-card {\n        min-height: auto;\n      }\n\n      .adex-entry-points-block .adex-ep-bottom {\n        padding: 24px 22px;\n      }\n\n      .adex-entry-points-block .adex-ep-bottom-line {\n        font-size: 16px;\n      }\n\n      .adex-entry-points-block .adex-ep-crossed,\n      .adex-entry-points-block .adex-ep-arrow,\n      .adex-entry-points-block .adex-ep-strong {\n        display: inline;\n        white-space: normal;\n      }\n    }\n\n    @media (max-width: 560px) {\n      .adex-entry-points-block .adex-ep-card-head {\n        grid-template-columns: 1fr;\n        gap: 12px;\n      }\n\n      .adex-entry-points-block .adex-ep-icon {\n        width: 44px;\n        height: 44px;\n      }\n\n      .adex-entry-points-block .adex-ep-card-title {\n        font-size: 18px;\n      }\n\n      .adex-entry-points-block .adex-ep-list li {\n        font-size: 16px;\n      }\n    }\n  <\/style>\n\n  <div class=\"adex-ep-head\">\n    <p class=\"adex-ep-eyebrow\">Adtech Supply Chain \u00b7 Two Entry Points<\/p>\n    <h2 class=\"adex-ep-title\" id=\"where-deepfakes-actually-enter-performance-marketing\">Where Deepfakes Actually Enter Performance Marketing<\/h2>\n  <\/div>\n\n  <div class=\"adex-ep-grid\">\n    <div class=\"adex-ep-card\">\n      <div class=\"adex-ep-card-head\">\n        <div class=\"adex-ep-icon\" aria-hidden=\"true\">\n          <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\">\n            <rect x=\"3\" y=\"5\" width=\"18\" height=\"14\" rx=\"2\" stroke=\"currentColor\" stroke-width=\"2\"\/>\n            <circle cx=\"8\" cy=\"10\" r=\"1.5\" stroke=\"currentColor\" stroke-width=\"2\"\/>\n            <path d=\"M12 10H17\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\"\/>\n            <path d=\"M7 15H17\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\"\/>\n          <\/svg>\n        <\/div>\n\n        <div>\n          <p class=\"adex-ep-tag\">Entry 01<\/p>\n          <h3 class=\"adex-ep-card-title\" id=\"identity-verification-at-onboarding\">Identity Verification at Onboarding<\/h3>\n        <\/div>\n      <\/div>\n\n      <ul class=\"adex-ep-list\">\n        <li>AI-generated ID documents<\/li>\n        <li>Injected video streams during KYC<\/li>\n        <li>High-volume probes hunting the weakest flow<\/li>\n      <\/ul>\n\n      <p class=\"adex-ep-note\">Single fakes rarely pass \u2014 volume finds the gap.<\/p>\n    <\/div>\n\n    <div class=\"adex-ep-card\">\n      <div class=\"adex-ep-card-head\">\n        <div class=\"adex-ep-icon\" aria-hidden=\"true\">\n          <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\">\n            <rect x=\"3\" y=\"7\" width=\"12\" height=\"10\" rx=\"2\" stroke=\"currentColor\" stroke-width=\"2\"\/>\n            <path d=\"M15 10L21 7V17L15 14\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linejoin=\"round\"\/>\n          <\/svg>\n        <\/div>\n\n        <div>\n          <p class=\"adex-ep-tag\">Entry 02<\/p>\n          <h3 class=\"adex-ep-card-title\" id=\"synthetic-creative-in-scam-campaigns\">Synthetic Creative in Scam Campaigns<\/h3>\n        <\/div>\n      <\/div>\n\n      <ul class=\"adex-ep-list\">\n        <li>Deepfaked celebrity endorsements<\/li>\n        <li>Investment scams, fake giveaways, crypto rugs<\/li>\n        <li>Reaches users via long intermediary chains<\/li>\n      <\/ul>\n\n      <p class=\"adex-ep-note\">Attacker needs one variant through; defenders must catch all.<\/p>\n    <\/div>\n  <\/div>\n\n  <div class=\"adex-ep-bottom\">\n    <p class=\"adex-ep-bottom-label\">Defensive Center of Gravity<\/p>\n    <p class=\"adex-ep-bottom-line\">\n      <span class=\"adex-ep-crossed\">detect the fake clip<\/span>\n      <span class=\"adex-ep-arrow\">\u2192<\/span>\n      <span class=\"adex-ep-strong\">detect the actor and infrastructure behind a cluster of clips<\/span>\n    <\/p>\n  <\/div>\n<\/div>\n\n\n\n<p>For people working in performance marketing, the relevant entry points are narrower than the general news coverage suggests. The two that matter most: identity verification at onboarding, and synthetic creative used to drive scam campaigns.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"onboarding-and-kyc\">Onboarding and KYC<\/h3>\n\n\n\n<p>AI-generated identity documents and injected video streams are now a routine part of attempted onboarding fraud. The patterns are documented in the <a href=\"https:\/\/sumsub.com\/fraud-report-2025\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Sumsub Identity Fraud Report 2025\u20132026<\/a> and in operational accounts like <a href=\"https:\/\/adtechholding.com\/blog\/kyc-and-new-fraud-threats-2026\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">AdTech Holding&#8217;s analysis of how KYC systems are adapting to AI-generated fraud<\/a>. The structural finding from that work bears repeating: the threat is not that any single deepfake passes \u2013 most do not, but that attackers run high-volume probes, looking for the weakest onboarding flow in a market where standards are uneven.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"synthetic-creative\">Synthetic creative<\/h3>\n\n\n\n<p>Deepfaked celebrity endorsements: politicians, finance personalities, and athletes have become a standard wrapper for investment scams, fake giveaways, and crypto-rug schemes.&nbsp;<\/p>\n\n\n\n<p>These creatives reach users through a long chain of intermediaries, and responsibility for stopping them is genuinely shared: networks invest in pre-publication review, verification vendors flag known impersonations, and platforms maintain takedown pipelines.&nbsp;<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">The asymmetry favors the attacker who needs only one variant to slip through. The defensive center of gravity has shifted from &#8220;detect the fake clip&#8221; to &#8220;detect the actor and infrastructure behind a cluster of clips.&#8221;<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"one-loss-two-saves-what-three-2024-deepfake-cases-reveal\">One Loss, Two Saves: What Three 2024 Deepfake Cases Reveal<\/h2>\n\n\n\n<div class=\"adex-arup-block\">\n  <style>\n    .adex-arup-block {\n      max-width: 1120px;\n      margin: 32px auto;\n      padding: 44px 40px 40px;\n      background: #ffffff;\n      border: 1px solid #e2e5f0;\n      border-radius: 18px;\n      font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n      color: #25204f;\n      box-sizing: border-box;\n      overflow: hidden;\n    }\n\n    .adex-arup-block *,\n    .adex-arup-block *::before,\n    .adex-arup-block *::after {\n      box-sizing: border-box;\n    }\n\n    .adex-arup-block .adex-ar-head {\n      display: grid;\n      grid-template-columns: 150px 1fr;\n      gap: 28px;\n      align-items: center;\n      padding-bottom: 36px;\n      margin-bottom: 34px;\n      border-bottom: 1px dashed #d9deec;\n    }\n\n    .adex-arup-block .adex-ar-amount {\n      margin: 0 0 14px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 58px;\n      line-height: 0.95;\n      letter-spacing: -0.06em;\n      font-weight: 900;\n      color: #16006f;\n    }\n\n    .adex-arup-block .adex-ar-source {\n      margin: 0;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 14px;\n      line-height: 1.2;\n      letter-spacing: 0.22em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #74779a;\n    }\n\n    .adex-arup-block .adex-ar-eyebrow {\n      margin: 0 0 12px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 14px;\n      line-height: 1.2;\n      letter-spacing: 0.22em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #74779a;\n    }\n\n    .adex-arup-block .adex-ar-title {\n      margin: 0;\n      font-size: 28px;\n      line-height: 1.25;\n      letter-spacing: -0.03em;\n      font-weight: 850;\n      color: #16006f;\n    }\n\n    .adex-arup-block .adex-ar-section-label {\n      margin: 0 0 18px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 14px;\n      line-height: 1.2;\n      letter-spacing: 0.22em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #74779a;\n    }\n\n    .adex-arup-block .adex-ar-chain {\n      display: grid;\n      grid-template-columns: repeat(4, minmax(0, 1fr));\n      gap: 14px;\n      margin-bottom: 36px;\n    }\n\n    .adex-arup-block .adex-ar-step {\n      min-height: 108px;\n      padding: 20px 18px;\n      border: 1px solid #e1e5ef;\n      border-radius: 12px;\n      background: #fbfcff;\n      display: flex;\n      flex-direction: column;\n      justify-content: center;\n    }\n\n    .adex-arup-block .adex-ar-step-final {\n      background: #1a006f;\n      border-color: #1a006f;\n      color: #ffffff;\n    }\n\n    .adex-arup-block .adex-ar-step-num {\n      margin: 0 0 12px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 14px;\n      line-height: 1;\n      font-weight: 800;\n      color: #74779a;\n    }\n\n    .adex-arup-block .adex-ar-step-final .adex-ar-step-num {\n      color: #bdb8ee;\n    }\n\n    .adex-arup-block .adex-ar-step-text {\n      margin: 0;\n      font-size: 18px;\n      line-height: 1.32;\n      font-weight: 800;\n      color: #282455;\n    }\n\n    .adex-arup-block .adex-ar-step-final .adex-ar-step-text {\n      color: #ffffff;\n    }\n\n    .adex-arup-block .adex-ar-insight-grid {\n      display: grid;\n      grid-template-columns: 1fr 1fr;\n      gap: 18px;\n      margin-bottom: 30px;\n    }\n\n    .adex-arup-block .adex-ar-box {\n      min-height: 104px;\n      padding: 28px 24px;\n      border-radius: 12px;\n      border: 1px solid #e1e5ef;\n      background: #fbfcff;\n    }\n\n    .adex-arup-block .adex-ar-box-warm {\n      background: #fff5e8;\n      border-color: #ffb978;\n    }\n\n    .adex-arup-block .adex-ar-box-label {\n      margin: 0 0 14px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 13px;\n      line-height: 1.2;\n      letter-spacing: 0.2em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #74779a;\n    }\n\n    .adex-arup-block .adex-ar-box-label::before {\n      content: \"\";\n      display: inline-block;\n      width: 8px;\n      height: 8px;\n      margin-right: 10px;\n      border-radius: 50%;\n      background: #c4cae1;\n      vertical-align: 1px;\n    }\n\n    .adex-arup-block .adex-ar-box-warm .adex-ar-box-label {\n      color: #c65400;\n    }\n\n    .adex-arup-block .adex-ar-box-warm .adex-ar-box-label::before {\n      background: #ff7a00;\n    }\n\n    .adex-arup-block .adex-ar-crossed {\n      margin: 0;\n      font-size: 18px;\n      line-height: 1.35;\n      font-weight: 800;\n      color: #74779a;\n      text-decoration: line-through;\n      text-decoration-thickness: 2px;\n      text-decoration-color: #74779a;\n    }\n\n    .adex-arup-block .adex-ar-broke {\n      margin: 0;\n      font-size: 19px;\n      line-height: 1.35;\n      font-weight: 850;\n      color: #16006f;\n    }\n\n    .adex-arup-block .adex-ar-defense {\n      display: grid;\n      grid-template-columns: 52px 1fr;\n      gap: 18px;\n      align-items: center;\n      padding: 30px 32px;\n      border-radius: 14px;\n      background: linear-gradient(90deg, #19006f 0%, #342090 100%);\n      color: #ffffff;\n    }\n\n    .adex-arup-block .adex-ar-shield {\n      width: 46px;\n      height: 46px;\n      border-radius: 11px;\n      background: rgba(255, 255, 255, 0.12);\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      color: #ffffff;\n    }\n\n    .adex-arup-block .adex-ar-defense-label {\n      margin: 0 0 12px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 14px;\n      line-height: 1.2;\n      letter-spacing: 0.22em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #e0dcff;\n    }\n\n    .adex-arup-block .adex-ar-defense-text {\n      margin: 0;\n      font-size: 20px;\n      line-height: 1.38;\n      font-weight: 850;\n      color: #ffffff;\n    }\n\n    .adex-arup-block .adex-ar-defense-text span {\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 18px;\n      color: #e7e4ff;\n    }\n\n    @media (max-width: 900px) {\n      .adex-arup-block {\n        padding: 32px 22px;\n      }\n\n      .adex-arup-block .adex-ar-head {\n        grid-template-columns: 1fr;\n        gap: 18px;\n      }\n\n      .adex-arup-block .adex-ar-amount {\n        font-size: 50px;\n      }\n\n      .adex-arup-block .adex-ar-title {\n        font-size: 24px;\n      }\n\n      .adex-arup-block .adex-ar-chain {\n        grid-template-columns: 1fr 1fr;\n      }\n\n      .adex-arup-block .adex-ar-insight-grid {\n        grid-template-columns: 1fr;\n      }\n    }\n\n    @media (max-width: 560px) {\n      .adex-arup-block .adex-ar-chain {\n        grid-template-columns: 1fr;\n      }\n\n      .adex-arup-block .adex-ar-defense {\n        grid-template-columns: 1fr;\n        padding: 26px 22px;\n      }\n\n      .adex-arup-block .adex-ar-defense-text {\n        font-size: 18px;\n      }\n\n      .adex-arup-block .adex-ar-defense-text span {\n        font-size: 16px;\n      }\n    }\n  <\/style>\n\n  <div class=\"adex-ar-head\">\n    <div>\n      <p class=\"adex-ar-amount\">$25M<\/p>\n      <p class=\"adex-ar-source\">Arup \u00b7 2024<\/p>\n    <\/div>\n\n    <div>\n      <p class=\"adex-ar-eyebrow\">Case Study \u00b7 Deepfake-Enabled BEC<\/p>\n      <div class=\"adex-ar-title\">\n        A finance employee joined a video call with synthetic colleagues \u2014 and authorized the transfer.\n      <\/div>\n    <\/div>\n  <\/div>\n\n  <p class=\"adex-ar-section-label\">How the Attack Actually Unfolded<\/p>\n\n  <div class=\"adex-ar-chain\">\n    <div class=\"adex-ar-step\">\n      <p class=\"adex-ar-step-num\">01<\/p>\n      <p class=\"adex-ar-step-text\">Primed by an earlier email<\/p>\n    <\/div>\n\n    <div class=\"adex-ar-step\">\n      <p class=\"adex-ar-step-num\">02<\/p>\n      <p class=\"adex-ar-step-text\">Joined a call on a familiar tool<\/p>\n    <\/div>\n\n    <div class=\"adex-ar-step\">\n      <p class=\"adex-ar-step-num\">03<\/p>\n      <p class=\"adex-ar-step-text\">Recognized &#8220;CFO&#8221; and colleagues on screen<\/p>\n    <\/div>\n\n    <div class=\"adex-ar-step adex-ar-step-final\">\n      <p class=\"adex-ar-step-num\">04<\/p>\n      <p class=\"adex-ar-step-text\">Acted within normal institutional rhythm<\/p>\n    <\/div>\n  <\/div>\n\n  <div class=\"adex-ar-insight-grid\">\n    <div class=\"adex-ar-box\">\n      <p class=\"adex-ar-box-label\">The Assumption<\/p>\n      <p class=\"adex-ar-crossed\">The deepfake quality fooled the employee.<\/p>\n    <\/div>\n\n    <div class=\"adex-ar-box adex-ar-box-warm\">\n      <p class=\"adex-ar-box-label\">What Actually Broke<\/p>\n      <p class=\"adex-ar-broke\">The workflow assumed seeing + hearing = verification.<\/p>\n    <\/div>\n  <\/div>\n\n  <div class=\"adex-ar-defense\">\n    <div class=\"adex-ar-shield\" aria-hidden=\"true\">\n      <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\">\n        <path d=\"M12 3L19 6V11C19 15.5 16.1 19.6 12 21C7.9 19.6 5 15.5 5 11V6L12 3Z\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linejoin=\"round\"\/>\n        <path d=\"M9 12L11 14L15.5 9.5\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/>\n      <\/svg>\n    <\/div>\n\n    <div>\n      <p class=\"adex-ar-defense-label\">The Real Defense<\/p>\n      <p class=\"adex-ar-defense-text\">\n        Not better video forensics \u2014 <span>a payment authorization protocol that doesn&#8217;t collapse when a video call says it should.<\/span>\n      <\/p>\n    <\/div>\n  <\/div>\n<\/div>\n\n\n\n<p>A pattern is more useful than a single anecdote. These three documented cases from 2024 show how the same underlying workflow vulnerability surfaces in different operational contexts \u2013 one expensive success and two near misses.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"arup-2024-the-canonical-bec-2-0-case\">Arup, 2024 \u2013 The canonical BEC* 2.0 case<\/h3>\n\n\n\n<p>*BEC &#8211; Business Email Compromise<\/p>\n\n\n\n<p>A finance employee at the engineering firm Arup&#8217;s Hong Kong office transferred roughly $25 million across 15 transactions after attending a video call with what appeared to be the company&#8217;s CFO and several colleagues. Every other face on the call was synthetic. The incident was <a href=\"https:\/\/www.cnn.com\/2024\/02\/04\/asia\/deepfake-cfo-scam-hong-kong-intl-hnk\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">reported initially by CNN in February 2024<\/a>, and <a href=\"https:\/\/www.cnn.com\/2024\/05\/16\/tech\/arup-deepfake-scam-loss-hong-kong-intl-hnk\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Arup was named as the victim by CNN in May 2024<\/a>. It is now the canonical example of deepfake-enabled BEC.<\/p>\n\n\n\n<p>What is instructive is the part most coverage glosses over: deepfake quality was not what made the attack work. The protocol around large transfers was.&nbsp;<\/p>\n\n\n\n<p>The employee had been primed by an earlier email, attended a meeting using a familiar tool, recognized the people on screen, and acted within an institutional rhythm in which senior executives sometimes do urgent things on short notice.&nbsp;<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">The attack also showed maturity beyond one-on-one impersonation: a fully populated meeting with cross-talk and turn-taking defeats the social heuristic that says, &#8220;If several known people see the same thing, it is probably real.&#8221;<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ferrari-july-2024-voice-clone-defeated-by-a-personal-question\">Ferrari, July 2024 \u2013 Voice clone defeated by a personal question<\/h3>\n\n\n\n<p>A Ferrari executive received WhatsApp messages and then a voice call appearing to come from CEO Benedetto Vigna, asking for help with a confidential acquisition that needed an urgent currency-hedging signature.&nbsp;<\/p>\n\n\n\n<p>The voice clone reproduced Vigna&#8217;s southern-Italian accent. The exec noticed slight prosodic inconsistencies and asked a question only the real Vigna could answer: the title of a book Vigna had recently recommended to him.&nbsp;<\/p>\n\n\n\n<p>The caller could not answer and ended the call. <a href=\"https:\/\/www.bloomberg.com\/news\/articles\/2024-07-26\/ferrari-narrowly-dodges-deepfake-scam-simulating-deal-hungry-ceo\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Reuters and Bloomberg reported the incident<\/a>; <a href=\"https:\/\/sloanreview.mit.edu\/article\/how-ferrari-hit-the-brakes-on-a-deepfake-ceo\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">MIT Sloan Management Review covered the security lessons in detail<\/a>.<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">The Ferrari case is useful because the failure mode is unusual: the attack was procedurally credible (urgent, secret, plausible business context) but failed against a piece of shared-context knowledge. It is the simplest possible out-of-band check: a question whose answer is not online, and it worked.<\/p>\n\n\n<div class=\"block__preview\">\n        <a href=\"https:\/\/adex.com\/blog\/new-threat-malicious-redirects-detected-in-ad-campaigns\/\" class=\"block__preview_img\"><img src=\"https:\/\/adex.com\/blog\/wp-content\/uploads\/2023\/06\/Adex-malicious-redirects-case-study.png\" srcset=\"https:\/\/adex.com\/blog\/wp-content\/uploads\/2023\/06\/Adex-malicious-redirects-case-study.png\" sizes=\"100vw\" alt=\"Adex - malicious redirects case study\" decoding=\"async\" class=\"lazy\"><\/a>\n    <div class=\"block__preview_box\">\n        <a href=\"https:\/\/adex.com\/blog\/category\/current_risks\/\" class=\"block__preview_box-cat\">Current risks<\/a>        <h3 class=\"block__preview_box-title\" id=\"new-threat-malicious-redirects-detected-in-ad-campaigns\"><a href=\"https:\/\/adex.com\/blog\/new-threat-malicious-redirects-detected-in-ad-campaigns\/\">[New Threat] Malicious Redirects Detected in Ad Campaigns<\/a><\/h3>\n    <\/div>\n<\/div>\n<style>\n.block__preview {display: flex;align-items: center;justify-content: center; margin: 32px 0;}\n.block__preview a {text-decoration: none;}\n.block__preview_img {min-width: 360px;max-width: 360px;min-height: 188px;width: 100%;height: 100%;}\n.block__preview_img img {width: 100%;height: 100%;}\n.block__preview_box {margin-left: 40px;max-width: 360px;}\n.block__preview_box-cat {color: #00B8A7 !important;font-weight: 600;font-size: 12px;line-height: 16px;text-transform: uppercase; display: block; margin-bottom: 4px;}\n.block__preview_box-cat:hover {color: #FE645A !important; text-decoration: none !important;}\n.block__preview_box-title {font-size: 20px;font-weight: 700;line-height: 24px;color: #0B172D;}\n.block__preview_box-title a {color: #0B172D !important;}\n.block__preview_box-title a:hover {color: #FE645A !important;}\n@media screen and (max-width: 768px) {.block__preview {flex-direction: column;}.block__preview_box {max-width: 100%; margin-top: 32px;margin-left: 0px;}.block__preview_img {max-width: 100%;min-width: 100%;min-height: 100%;}}<\/style>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"lastpass-april-2024-voice-clone-of-a-ceo\">LastPass, April 2024 \u2013 Voice clone of a CEO<\/h3>\n\n\n\n<p>In April 2024, LastPass <a href=\"https:\/\/blog.lastpass.com\/posts\/attempted-audio-deepfake-call-targets-lastpass-employee\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">publicly disclosed an attempted voice-clone impers<\/a><a href=\"https:\/\/blog.lastpass.com\/posts\/attempted-audio-deepfake-call-targets-lastpass-employee\">onation<\/a> of its CEO Karim Toubba, targeting an employee through WhatsApp audio.<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">The attack failed for an unglamorous reason: the message arrived through a non-standard channel, with off-hours timing and high-pressure framing, and the employee escalated to internal security rather than acting on it.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"what-the-three-cases-tell-you-together\">What the three cases tell you together<\/h3>\n\n\n\n<p>Same technology, three different outcomes. Arup lost $25M because the procedure treated a video call as authorization.<\/p>\n\n\n\n<p>Ferrari and LastPass intercepted equally credible attempts because the procedure required something the attacker could not produce \u2013 a personal-context question, an out-of-channel escalation. The defense was never video forensics. It was a payment-and-action authorization protocol that does not collapse when a synthetic voice or face says it should.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"detection-what-actually-works-and-what-it-misses\">Detection: What Actually Works, and What It Misses<\/h2>\n\n\n\n<p>No single detector is worth trusting on its own. What works in production is a layered stack, where each layer catches a different kind of failure that the others miss. This framing aligns with industry threat reports, including the <a href=\"https:\/\/sumsub.com\/fraud-report-2025\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Sumsub Identity Fraud Report <\/a>and <a href=\"https:\/\/www.iproov.com\/press\/iproov-issues-annual-threat-intelligence-report\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">iProov&#8217;s annual threat intelligence<\/a>, that no single signal withstands sustained pressure from a determined attacker.<\/p>\n\n\n\n<div class=\"adex-detection-layers-block\">\n  <style>\n    .adex-detection-layers-block {\n      max-width: 1120px;\n      margin: 32px auto;\n      padding: 44px 40px 38px;\n      background: #ffffff;\n      border: 1px solid #e2e5f0;\n      border-radius: 18px;\n      font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n      color: #25204f;\n      box-sizing: border-box;\n      overflow: hidden;\n    }\n\n    .adex-detection-layers-block *,\n    .adex-detection-layers-block *::before,\n    .adex-detection-layers-block *::after {\n      box-sizing: border-box;\n    }\n\n    .adex-detection-layers-block .adex-dl-head {\n      margin-bottom: 32px;\n    }\n\n    .adex-detection-layers-block .adex-dl-eyebrow {\n      margin: 0 0 12px;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 14px;\n      line-height: 1.2;\n      letter-spacing: 0.22em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #74779a;\n    }\n\n    .adex-detection-layers-block .adex-dl-title {\n      margin: 0 0 12px;\n      font-size: 28px;\n      line-height: 1.2;\n      letter-spacing: -0.03em;\n      font-weight: 850;\n      color: #16006f;\n    }\n\n    .adex-detection-layers-block .adex-dl-subtitle {\n      margin: 0;\n      max-width: 900px;\n      font-size: 18px;\n      line-height: 1.45;\n      color: #62658c;\n    }\n\n    .adex-detection-layers-block .adex-dl-table {\n      width: 100%;\n    }\n\n    .adex-detection-layers-block .adex-dl-header,\n    .adex-detection-layers-block .adex-dl-row {\n      display: grid;\n      grid-template-columns: 300px 1fr 1fr;\n      column-gap: 36px;\n    }\n\n    .adex-detection-layers-block .adex-dl-header {\n      padding: 0 6px 14px;\n      border-bottom: 1px solid #3b2fb3;\n    }\n\n    .adex-detection-layers-block .adex-dl-col-label {\n      margin: 0;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 13px;\n      line-height: 1.2;\n      letter-spacing: 0.22em;\n      text-transform: uppercase;\n      font-weight: 800;\n      color: #16006f;\n    }\n\n    .adex-detection-layers-block .adex-dl-row {\n      padding: 24px 6px;\n      border-bottom: 1px dashed #dde2ef;\n      align-items: start;\n    }\n\n    .adex-detection-layers-block .adex-dl-row:last-child {\n      border-bottom: none;\n    }\n\n    .adex-detection-layers-block .adex-dl-layer {\n      display: grid;\n      grid-template-columns: 34px 1fr;\n      gap: 14px;\n      align-items: start;\n      min-width: 0;\n    }\n\n    .adex-detection-layers-block .adex-dl-num {\n      width: 28px;\n      height: 28px;\n      border-radius: 6px;\n      background: #16006f;\n      color: #ffffff;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 13px;\n      line-height: 1;\n      font-weight: 800;\n      margin-top: 2px;\n    }\n\n    .adex-detection-layers-block .adex-dl-layer-title {\n      margin: 0 0 7px;\n      font-size: 18px;\n      line-height: 1.2;\n      font-weight: 850;\n      color: #16006f;\n    }\n\n    .adex-detection-layers-block .adex-dl-layer-desc {\n      margin: 0;\n      font-size: 15px;\n      line-height: 1.35;\n      font-weight: 500;\n      color: #62658c;\n    }\n\n    .adex-detection-layers-block .adex-dl-point {\n      position: relative;\n      margin: 0;\n      padding-left: 26px;\n      font-size: 17px;\n      line-height: 1.42;\n      color: #282455;\n    }\n\n    .adex-detection-layers-block .adex-dl-point::before {\n      content: \"\";\n      position: absolute;\n      left: 0;\n      top: 0.45em;\n      width: 12px;\n      height: 12px;\n      border-radius: 50%;\n      border: 3px solid #16006f;\n      background: #ffffff;\n    }\n\n    .adex-detection-layers-block .adex-dl-point-miss::before {\n      border-color: #f26a00;\n    }\n\n    .adex-detection-layers-block .adex-dl-footer {\n      display: grid;\n      grid-template-columns: 46px 1fr;\n      gap: 18px;\n      align-items: center;\n      margin-top: 30px;\n      padding: 28px 32px;\n      border-radius: 14px;\n      background: linear-gradient(90deg, #19006f 0%, #342090 100%);\n      color: #ffffff;\n    }\n\n    .adex-detection-layers-block .adex-dl-shield {\n      width: 40px;\n      height: 40px;\n      border-radius: 10px;\n      background: rgba(255, 255, 255, 0.12);\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      color: #ffffff;\n    }\n\n    .adex-detection-layers-block .adex-dl-footer-text {\n      margin: 0;\n      font-size: 17px;\n      line-height: 1.45;\n      font-weight: 800;\n      color: #ffffff;\n    }\n\n    .adex-detection-layers-block .adex-dl-footer-text span {\n      font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n      font-size: 16px;\n      color: #e7e4ff;\n    }\n\n    @media (max-width: 980px) {\n      .adex-detection-layers-block {\n        padding: 34px 24px;\n      }\n\n      .adex-detection-layers-block .adex-dl-title {\n        font-size: 24px;\n      }\n\n      .adex-detection-layers-block .adex-dl-subtitle {\n        font-size: 16px;\n      }\n\n      .adex-detection-layers-block .adex-dl-header {\n        display: none;\n      }\n\n      .adex-detection-layers-block .adex-dl-row {\n        grid-template-columns: 1fr;\n        row-gap: 18px;\n        padding: 24px 0;\n      }\n\n      .adex-detection-layers-block .adex-dl-point {\n        font-size: 16px;\n      }\n\n      .adex-detection-layers-block .adex-dl-point::after {\n        display: block;\n        margin-bottom: 6px;\n        font-family: \"SF Mono\", \"JetBrains Mono\", Menlo, Consolas, monospace;\n        font-size: 12px;\n        letter-spacing: 0.16em;\n        text-transform: uppercase;\n        font-weight: 800;\n        color: #74779a;\n      }\n\n      .adex-detection-layers-block .adex-dl-catches .adex-dl-point::after {\n        content: \"Catches\";\n      }\n\n      .adex-detection-layers-block .adex-dl-misses .adex-dl-point::after {\n        content: \"Routinely misses\";\n      }\n\n      .adex-detection-layers-block .adex-dl-footer {\n        grid-template-columns: 1fr;\n        padding: 24px 22px;\n      }\n    }\n\n    @media (max-width: 560px) {\n      .adex-detection-layers-block {\n        padding: 28px 20px;\n      }\n\n      .adex-detection-layers-block .adex-dl-eyebrow {\n        font-size: 12px;\n      }\n\n      .adex-detection-layers-block .adex-dl-title {\n        font-size: 22px;\n      }\n\n      .adex-detection-layers-block .adex-dl-layer {\n        grid-template-columns: 32px 1fr;\n      }\n\n      .adex-detection-layers-block .adex-dl-layer-title {\n        font-size: 17px;\n      }\n\n      .adex-detection-layers-block .adex-dl-footer-text {\n        font-size: 16px;\n      }\n\n      .adex-detection-layers-block .adex-dl-footer-text span {\n        font-size: 15px;\n      }\n    }\n  <\/style>\n\n  <div class=\"adex-dl-head\">\n    <p class=\"adex-dl-eyebrow\">Detection Stack \u00b7 Layer-by-Layer<\/p>\n    <h2 class=\"adex-dl-title\" id=\"what-each-defense-layer-catches-and-what-it-routinely-misses\">What Each Defense Layer Catches \u2014 and What It Routinely Misses<\/h2>\n    <p class=\"adex-dl-subtitle\">\n      Every layer has a documented blind spot. Attackers probe each one and shift to whichever is weakest in a given environment.\n    <\/p>\n  <\/div>\n\n  <div class=\"adex-dl-table\">\n    <div class=\"adex-dl-header\">\n      <p class=\"adex-dl-col-label\">Layer<\/p>\n      <p class=\"adex-dl-col-label\">Catches<\/p>\n      <p class=\"adex-dl-col-label\">Routinely Misses<\/p>\n    <\/div>\n\n    <div class=\"adex-dl-row\">\n      <div class=\"adex-dl-layer\">\n        <div class=\"adex-dl-num\">01<\/div>\n        <div>\n          <p class=\"adex-dl-layer-title\">Media Artifact Analysis<\/p>\n          <p class=\"adex-dl-layer-desc\">Frame inconsistencies, compression, GAN fingerprints<\/p>\n        <\/div>\n      <\/div>\n      <div class=\"adex-dl-catches\">\n        <p class=\"adex-dl-point\">Low-effort generative fakes and known model signatures<\/p>\n      <\/div>\n      <div class=\"adex-dl-misses\">\n        <p class=\"adex-dl-point adex-dl-point-miss\">Models tuned to evade the detector&#8217;s own training features<\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"adex-dl-row\">\n      <div class=\"adex-dl-layer\">\n        <div class=\"adex-dl-num\">02<\/div>\n        <div>\n          <p class=\"adex-dl-layer-title\">Liveness &amp; Passive Biometrics<\/p>\n          <p class=\"adex-dl-layer-desc\">Micro-movements, blood-flow signals, texture<\/p>\n        <\/div>\n      <\/div>\n      <div class=\"adex-dl-catches\">\n        <p class=\"adex-dl-point\">Static images, replay attacks, basic 2D spoofs<\/p>\n      <\/div>\n      <div class=\"adex-dl-misses\">\n        <p class=\"adex-dl-point adex-dl-point-miss\">High-fidelity injected video streams that simulate liveness<\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"adex-dl-row\">\n      <div class=\"adex-dl-layer\">\n        <div class=\"adex-dl-num\">03<\/div>\n        <div>\n          <p class=\"adex-dl-layer-title\">Device &amp; Session Telemetry<\/p>\n          <p class=\"adex-dl-layer-desc\">Fingerprints, IP, geo, camera metadata, injection<\/p>\n        <\/div>\n      <\/div>\n      <div class=\"adex-dl-catches\">\n        <p class=\"adex-dl-point\">Reused infrastructure and emulator-based attempts<\/p>\n      <\/div>\n      <div class=\"adex-dl-misses\">\n        <p class=\"adex-dl-point adex-dl-point-miss\">Rotated residential proxies and clean device pools per session<\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"adex-dl-row\">\n      <div class=\"adex-dl-layer\">\n        <div class=\"adex-dl-num\">04<\/div>\n        <div>\n          <p class=\"adex-dl-layer-title\">Behavioral Signals<\/p>\n          <p class=\"adex-dl-layer-desc\">Interaction speed, navigation, form-fill timing<\/p>\n        <\/div>\n      <\/div>\n      <div class=\"adex-dl-catches\">\n        <p class=\"adex-dl-point\">Scripted bots and unnaturally uniform session flow<\/p>\n      <\/div>\n      <div class=\"adex-dl-misses\">\n        <p class=\"adex-dl-point adex-dl-point-miss\">Human-in-the-loop operators driving the session manually<\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"adex-dl-row\">\n      <div class=\"adex-dl-layer\">\n        <div class=\"adex-dl-num\">05<\/div>\n        <div>\n          <p class=\"adex-dl-layer-title\">Network &amp; Graph Analysis<\/p>\n          <p class=\"adex-dl-layer-desc\">Account clusters, shared docs, payout endpoints<\/p>\n        <\/div>\n      <\/div>\n      <div class=\"adex-dl-catches\">\n        <p class=\"adex-dl-point\">Coordinated rings sharing devices, templates, or cash-out paths<\/p>\n      <\/div>\n      <div class=\"adex-dl-misses\">\n        <p class=\"adex-dl-point adex-dl-point-miss\">The first attempt from a fresh, unconnected identity<\/p>\n      <\/div>\n    <\/div>\n  <\/div>\n\n  <div class=\"adex-dl-footer\">\n    <div class=\"adex-dl-shield\" aria-hidden=\"true\">\n      <svg width=\"23\" height=\"23\" viewBox=\"0 0 24 24\" fill=\"none\">\n        <path d=\"M12 3L19 6V11C19 15.5 16.1 19.6 12 21C7.9 19.6 5 15.5 5 11V6L12 3Z\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linejoin=\"round\"\/>\n        <path d=\"M8.5 12H15.5\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\"\/>\n      <\/svg>\n    <\/div>\n\n    <p class=\"adex-dl-footer-text\">\n      No single layer is sufficient. <span>Defense in depth means assuming each layer will be bypassed and ensuring the next one is watching.<\/span>\n    <\/p>\n  <\/div>\n<\/div>\n\n\n\n<p>The non-obvious point, and the one most vendor pages avoid: the fastest-growing class of deepfake bypass is not better generative output. It is <strong>camera-stream injection<\/strong> \u2013 feeding a fake video directly into the system instead of showing it to a camera.&nbsp;<\/p>\n\n\n\n<p>iProov&#8217;s threat reports have tracked this shift in detail, documenting a <a href=\"https:\/\/www.iproov.com\/reports\/threat-intelligence-report-2025-remote-identity-attack\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">sharp year-over-year rise in injection attacks against verification SDK<\/a>s and naming them the dominant attack vector against face biometrics today.<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">Here is what changed. Until recently, the standard attack was to hold a screen or printed photo up to a webcam. Liveness detection: the layer that looks for micro-movements, blood-flow signals, and skin texture, catches them reliably now. So attackers stopped showing fake videos to the camera and started <strong>bypassing the camera entirely<\/strong>.&nbsp;<\/p>\n\n\n\n<p>They feed a synthetic video stream directly into the operating system&#8217;s camera interface, where the verification SDK treats it as a real feed. From the application&#8217;s point of view, nothing looks wrong: the frames move naturally, the lighting is plausible, the face is coherent. The deception is happening one layer below, between the sensor and the software.<\/p>\n\n\n    <div class=\"block__quote\"><p class=\"block__quote_desc\"><p>This is why the defensive center of gravity has moved from analyzing the face to interrogating the device. The useful questions are no longer &#8220;does this face look real?&#8221; but &#8220;is this video actually coming from physical hardware on this device, or is a virtual camera driver sitting in the path? Does the stream carry the metadata a real sensor would produce? Are the frame timings consistent with a real capture pipeline, or with a software loop?&#8221;<\/p>\n<\/p><\/div>\n    <style>.block__quote {margin: 32px 0;padding-left: 20px;border-left: 3px solid #00B8A7;}.block__quote_desc {font-weight: 700 !important;font-size: 18px !important;line-height: 28px !important;margin-bottom: 24px !important;}.block__quote_author {display: none;}<\/style>\n\n\n\n<p>The terminology has shifted to match. The international standard for evaluating these defenses, <a href=\"https:\/\/www.iso.org\/standard\/79520.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">ISO\/IEC 30107<\/a>, historically focused on <strong>presentation attack detection (PAD)<\/strong> \u2013 physical spoofing, such as masks or printed photos held up to a camera. The newer category has its own name: <strong>injection attack detection (IAD)<\/strong>, and it is a fundamentally different evaluation problem.<\/p>\n\n\n\n<p>Pixel-only detectors cannot address it. They were trained on the assumption that the input is at least a real recording of <em>something<\/em>: a printed photo, a replayed video, a mask. Injection attacks break that assumption.<\/p>\n\n\n\n<p>The broader pattern is worth naming, because it is not unique to deepfakes. Every generation of biometric defense has been bypassed not by a better fake, but by attackers moving one layer down the stack:<\/p>\n\n\n<div class=\"block__bord\"><div class=\"block__bord_desc\"><p><!-- wp:list --><\/p>\n<ul class=\"wp-block-list\"><!-- wp:list-item --><\/p>\n<li>Pixel forensics got bypassed by liveness-aware generative models<\/li>\n<p><!-- \/wp:list-item --> <!-- wp:list-item --><\/p>\n<li>Liveness got bypassed by injection<\/li>\n<p><!-- \/wp:list-item --> <!-- wp:list-item --><\/p>\n<li>The injection will get bypassed by something that compromises <strong>device attestation<\/strong>, the layer that verifies the hardware itself is genuine<\/li>\n<p><!-- \/wp:list-item --><\/ul>\n<p><!-- \/wp:list --><\/p>\n<\/div><\/div>\n<style>\n.block__bord { margin: 32px 0; padding: 1.25em 2.375em;\tborder-radius: 24px; background: rgba(0, 220, 200, 0.20); }\n.block__bord_desc {font-size: 16px !important;font-weight: 400 !important;color: #606060 !important;}\n<\/style>\n\n\n\n<p><a href=\"https:\/\/www.gartner.com\/en\/newsroom\/press-releases\/2024-02-01-gartner-predicts-30-percent-of-enterprises-will-consider-identity-verification-and-authentication-solutions-unreliable-in-isolation-due-to-deepfakes-by-2026\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Gartner&#8217;s widely cited forecast<\/a> that by 2026, a significant share of enterprises will stop trusting face biometrics on their own for identity verification is a direct consequence of this migration, not a standalone prediction. Each layer&#8217;s vendors keep selling defenses that still work against last year&#8217;s attacker.&nbsp;<\/p>\n\n\n\n<p>That is the actual state of detection in 2026. It is not a solved problem, and it is not a single product. It is a stack with documented blind spots at every layer, where the operational question is whether all five layers are watching at once, and whether someone is paying attention when one of them goes quiet.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"where-defenses-fail-honestly\">Where Defenses Fail Honestly<\/h2>\n\n\n\n<p>A trustworthy article on this topic has to name the failure cases, because every layered defense has them.<\/p>\n\n\n\n<p>Per-asset detectors degrade quickly. Models trained to spot artifacts in last year&#8217;s generative outputs lose accuracy against this year&#8217;s outputs, and retraining cycles are slower than model release cycles on the attacker side. Operationally, this shows up as a quiet drift in detection rates that no one notices until a postmortem.<\/p>\n\n\n\n<p>False positives are not cosmetic. Aggressive liveness or behavioral models block legitimate users, particularly those with older devices, low-bandwidth connections, atypical lighting, or document formats from countries with less standardized ID design. Industry data consistently shows that strict onboarding flows produce a significant drop-off among legitimate users, and the cost of that friction lands on revenue, not on attackers, who simply move on.<\/p>\n\n\n\n<p>Cluster analysis cannot see an attack that hasn&#8217;t happened often enough yet.&nbsp;<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">New platforms, new verticals, and new geographies all suffer from a cold-start problem: the first cohort of fraudsters arrives before the network-graph signals exist to detect them. This is why operational teams pair machine-driven scoring with manual review during the early life of any new flow, and why automating that review away too quickly tends to produce the worst kind of breach: the one no one notices for months.<\/p>\n\n\n\n<p>There is a related failure case that vendor decks rarely discuss. Detection works against the attacks the system was designed for \u2013 and <strong>passes cleanly on the ones it wasn&#8217;t<\/strong>.&nbsp;<\/p>\n\n\n\n<p>From an Adex anti-fraud perspective, what we see across review queues is that novel deepfake attempts almost never look like the ones in last quarter&#8217;s training data. By the time a detection model reaches a reliable accuracy rate on a given attack category, that category has already moved on.<\/p>\n\n\n<div class=\"block__preview\">\n        <a href=\"https:\/\/adex.com\/blog\/triada-malvertising-case-study\/\" class=\"block__preview_img\"><img src=\"https:\/\/adex.com\/blog\/wp-content\/uploads\/2025\/12\/adex-investigarion-triada-infected-campaigns.png\" srcset=\"https:\/\/adex.com\/blog\/wp-content\/uploads\/2025\/12\/adex-investigarion-triada-infected-campaigns.png\" sizes=\"100vw\" alt=\"adex-investigation-triada-infected-campaigns\" decoding=\"async\" class=\"lazy\"><\/a>\n    <div class=\"block__preview_box\">\n        <a href=\"https:\/\/adex.com\/blog\/category\/current_risks\/\" class=\"block__preview_box-cat\">Current risks<\/a>        <h3 class=\"block__preview_box-title\" id=\"inside-the-triada-battle-a-five-year-investigation-and-the-security-upgrades-it-triggered\"><a href=\"https:\/\/adex.com\/blog\/triada-malvertising-case-study\/\">Inside the Triada Battle: A Five-Year Investigation and the Security Upgrades It Triggered<\/a><\/h3>\n    <\/div>\n<\/div>\n<style>\n.block__preview {display: flex;align-items: center;justify-content: center; margin: 32px 0;}\n.block__preview a {text-decoration: none;}\n.block__preview_img {min-width: 360px;max-width: 360px;min-height: 188px;width: 100%;height: 100%;}\n.block__preview_img img {width: 100%;height: 100%;}\n.block__preview_box {margin-left: 40px;max-width: 360px;}\n.block__preview_box-cat {color: #00B8A7 !important;font-weight: 600;font-size: 12px;line-height: 16px;text-transform: uppercase; display: block; margin-bottom: 4px;}\n.block__preview_box-cat:hover {color: #FE645A !important; text-decoration: none !important;}\n.block__preview_box-title {font-size: 20px;font-weight: 700;line-height: 24px;color: #0B172D;}\n.block__preview_box-title a {color: #0B172D !important;}\n.block__preview_box-title a:hover {color: #FE645A !important;}\n@media screen and (max-width: 768px) {.block__preview {flex-direction: column;}.block__preview_box {max-width: 100%; margin-top: 32px;margin-left: 0px;}.block__preview_img {max-width: 100%;min-width: 100%;min-height: 100%;}}<\/style>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"one-attack-different-failure-surfaces\">One Attack, Different Failure Surfaces<\/h2>\n\n\n\n<p>&#8220;Deepfakes will break online trust&#8221; sounds decisive until you ask: trust in <em>what<\/em>?&nbsp;<\/p>\n\n\n\n<p>Payment authorization, identity verification, advertiser-platform relationships, and creative inventory each run on different mechanisms and fail in different ways. A breakthrough that collapses one does not automatically touch the others.<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">The defenses most buying teams worry about are the visible ones: the deepfaked celebrity endorsement that ran for six hours before takedown, the cloned-voice CEO scam that made the news.&nbsp;<\/p>\n\n\n\n<p>The defenses doing the actual heavy lifting sit at layers they never see: payment-rail KYC at one end, network-graph analysis on advertiser accounts at the other. The bulk of what gets stopped is invisible by construction \u2014 synthetic-ID onboardings rejected at submission, clusters of fake creator accounts blocked before first payout.<\/p>\n\n\n\n<p>&nbsp;None of it makes headlines because nothing happened.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"the-sharper-frame\">The Sharper Frame<\/h2>\n\n\n\n<p>Deepfake scams are not a single problem. There are four distinct fraud patterns:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Executive impersonation<\/li>\n\n\n\n<li>Identity-document fraud<\/li>\n\n\n\n<li>Celebrity impersonation<\/li>\n\n\n\n<li>Synthetic creator fraud \u2014 entering through different channels and defeating different controls.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Treating them as one threat produces detection logic that misses all of them.<\/p>\n\n\n\n<p>Three points are worth carrying out of this article:<\/p>\n\n\n\n<p>1. <strong>Detection alone does not work.<\/strong> Per-asset detectors lag generative models by a release cycle, liveness checks are bypassed by camera-stream injection, and graph analysis fails on cold-start cohorts. A layered stack is the minimum viable defense.<\/p>\n\n\n\n<p>2. <strong>The procedure decides the loss.<\/strong> The Arup case lost $25M because a video call was treated as a transfer authorization. The LastPass attempt failed because the procedure required out-of-band verification. Same technology, different outcome.<\/p>\n\n\n\n<p>3. <strong>The action items are concrete.<\/strong> For internal finance: out-of-band confirmation, dual approval above thresholds, a written policy that no urgent transfer is authorized via video alone. For onboarding and supply-chain partners: device-level signal collection, cluster analysis in the first 30 days, manual review during cold-start, retraining cadence with drift monitoring.<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#d6d6d630\">The practical question for any organization is not whether it has deepfake detection. It is which decisions in the current workflow could be pushed through by a convincing fake, and what controls would prevent that. Run that audit, fix the procedures it surfaces, and detection becomes a useful narrowing layer rather than the sole line of defense.<\/p>\n\n\n<div class=\"block__preview\">\n        <a href=\"https:\/\/adex.com\/blog\/case-study-identifying-and-redirecting-bot-infected-traffic-with-adex\/\" class=\"block__preview_img\"><img src=\"https:\/\/adex.com\/blog\/wp-content\/uploads\/2022\/05\/Adex_Eliminating_Bot.png\" srcset=\"https:\/\/adex.com\/blog\/wp-content\/uploads\/2022\/05\/Adex_Eliminating_Bot.png\" sizes=\"100vw\" alt=\"\" decoding=\"async\" class=\"lazy\"><\/a>\n    <div class=\"block__preview_box\">\n        <a href=\"https:\/\/adex.com\/blog\/category\/reports\/\" class=\"block__preview_box-cat\">Reports<\/a>        <h3 class=\"block__preview_box-title\" id=\"case-study-identifying-and-redirecting-bot-infected-traffic-with-adex\"><a href=\"https:\/\/adex.com\/blog\/case-study-identifying-and-redirecting-bot-infected-traffic-with-adex\/\">Case Study: Identifying and Redirecting Bot Infected Traffic with Adex<\/a><\/h3>\n    <\/div>\n<\/div>\n<style>\n.block__preview {display: flex;align-items: center;justify-content: center; margin: 32px 0;}\n.block__preview a {text-decoration: none;}\n.block__preview_img {min-width: 360px;max-width: 360px;min-height: 188px;width: 100%;height: 100%;}\n.block__preview_img img {width: 100%;height: 100%;}\n.block__preview_box {margin-left: 40px;max-width: 360px;}\n.block__preview_box-cat {color: #00B8A7 !important;font-weight: 600;font-size: 12px;line-height: 16px;text-transform: uppercase; display: block; margin-bottom: 4px;}\n.block__preview_box-cat:hover {color: #FE645A !important; text-decoration: none !important;}\n.block__preview_box-title {font-size: 20px;font-weight: 700;line-height: 24px;color: #0B172D;}\n.block__preview_box-title a {color: #0B172D !important;}\n.block__preview_box-title a:hover {color: #FE645A !important;}\n@media screen and (max-width: 768px) {.block__preview {flex-direction: column;}.block__preview_box {max-width: 100%; margin-top: 32px;margin-left: 0px;}.block__preview_img {max-width: 100%;min-width: 100%;min-height: 100%;}}<\/style>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"are-deepfake-scams-illegal\">Are deepfake scams illegal?<\/h3>\n\n\n\n<p>The synthetic asset itself is not always illegal, but using it to defraud, impersonate, or steal is almost always illegal under existing fraud, wire fraud, identity theft, and anti-impersonation statutes.<\/p>\n\n\n\n<p>Many jurisdictions have added or are adding deepfake-specific provisions, particularly around non-consensual intimate imagery and election interference. The act of fraud is what is prosecuted; the deepfake is the tool.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"how-common-are-deepfake-scams\">How common are deepfake scams?<\/h3>\n\n\n\n<p>Reported volumes have risen sharply year over year across financial services, KYC platforms, and corporate-fraud channels. Public reports from identity-verification vendors and government cybercrime centers consistently show multi-fold increases in detected synthetic-identity attempts since 2022. Recent figures are in the <a href=\"https:\/\/sumsub.com\/fraud-report-2025\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Sumsub 2025 Identity Fraud Report<\/a> and in <a href=\"https:\/\/www.ic3.gov\/AnnualReport\/\"><\/a>the <a href=\"https:\/\/www.ic3.gov\/AnnualReport\/Reports\/2024_IC3Report.pdf\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">FBI IC3 annual reports<\/a>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"how-can-i-tell-if-a-video-or-voice-is-a-deepfake\">How can I tell if a video or voice is a deepfake?<\/h3>\n\n\n\n<p>Modern deepfakes can be hard to detect from media alone. Useful tells when they appear: lip-sync drift, unnatural blinking or eye movement, audio with consistent emotional flatness, background and lighting that do not match the speaker&#8217;s claimed location, and prosody (rhythm and stress patterns) that feels mechanical. The more reliable defense is procedural: verify identity through a separate, pre-known channel before acting on requests for money or access.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"what-should-i-do-if-i-have-been-targeted-by-a-deepfake-scam\">What should I do if I have been targeted by a deepfake scam?<\/h3>\n\n\n\n<p>Stop any in-progress transaction. Notify your bank or payment provider immediately. Preserve the original message, call recording, or video. Report to your national cybercrime agency \u2013 in the United States, the <a href=\"https:\/\/www.ic3.gov\/\"><\/a><a href=\"https:\/\/www.ic3.gov\/AnnualReport\/Reports\/2024_IC3Report.pdf\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">FBI IC3<\/a> and the <a href=\"https:\/\/reportfraud.ftc.gov\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">FTC<\/a>; in the EU, your national CERT and the platform on which the contact occurred. If the impersonation involved a real person, notify them \u2013 they may be under broader attack.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"how-do-deepfakes-get-past-liveness-checks\">How do deepfakes get past liveness checks?<\/h3>\n\n\n\n<p>The current dominant technique is camera-stream injection: software intercepts the OS-level camera interface and feeds a synthetic video to the verification SDK, so passive-liveness signals (texture, micro-motion) are read as real. Defenses have shifted to interrogating the device itself: checking whether the camera feed originates from real hardware, rather than relying solely on facial analysis.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"are-deepfake-scams-a-ymyl-your-money-or-your-life-concern-for-businesses\">Are deepfake scams a YMYL (&#8220;Your Money or Your Life&#8221;) concern for businesses?<\/h3>\n\n\n\n<p>Yes. The financial-loss exposure is direct, the identity-and-trust exposure is structural, and the consumer-harm exposure is real (investment-scam victims, especially older users, lose meaningful sums to deepfaked endorsements). For platforms, the regulatory exposure under emerging AI and consumer-protection rules is rising. Organizations should treat the topic with the same diligence they apply to any high-trust workflow.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"can-deepfake-detection-be-solved-by-ai\">Can deepfake detection be solved by AI?<\/h3>\n\n\n\n<p>Partially, but not durably on its own. Detection models lag generation models by a release cycle, and adversaries can train against publicly known detectors. The robust answer combines detection (multi-layered, regularly retrained, with drift monitoring) and procedure (out-of-band verification, dual approval, threshold controls). Either alone fails predictably.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What if the fake isn\u2019t the real problem? Learn how a deepfake scam uses AI-generated voices, videos, and documents to exploit weak workflows \u2014 and what actually helps stop the fraud.<\/p>\n","protected":false},"author":4,"featured_media":5616,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[18,16],"class_list":["post-5605","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guides","tag-fraud","tag-threat"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Deepfake Scam: How AI Is Used in Online Fraud<\/title>\n<meta name=\"description\" content=\"Deepfake scam tactics use AI voice, video, and documents to exploit weak workflows. Learn the key fraud types, detection gaps, and defenses.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Deepfake Scam: How AI Is Used in Online Fraud\" \/>\n<meta property=\"og:description\" content=\"Deepfake scam tactics use AI voice, video, and documents to exploit weak workflows. Learn the key fraud types, detection gaps, and defenses.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/\" \/>\n<meta property=\"og:site_name\" content=\"ADEX\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/adexsaas\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-21T14:25:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-21T14:25:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/adex.com\/blog\/wp-content\/uploads\/2026\/05\/Adex-Deepfake-Scam-Online-Fraud.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Kira Vessiari\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@adexsaas\" \/>\n<meta name=\"twitter:site\" content=\"@adexsaas\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kira Vessiari\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"17 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/\"},\"author\":{\"name\":\"Kira Vessiari\",\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/#\\\/schema\\\/person\\\/2bf2469195f0e5bffe2e1d5b2ef12b61\"},\"headline\":\"What Is a Deepfake Scam? How AI Is Used in Online Fraud\",\"datePublished\":\"2026-05-21T14:25:05+00:00\",\"dateModified\":\"2026-05-21T14:25:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/\"},\"wordCount\":3661,\"publisher\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/adex.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Adex-Deepfake-Scam-Online-Fraud.png\",\"keywords\":[\"Fraud\",\"Threat\"],\"articleSection\":[\"Guides\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/\",\"url\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/\",\"name\":\"Deepfake Scam: How AI Is Used in Online Fraud\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/adex.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Adex-Deepfake-Scam-Online-Fraud.png\",\"datePublished\":\"2026-05-21T14:25:05+00:00\",\"dateModified\":\"2026-05-21T14:25:06+00:00\",\"description\":\"Deepfake scam tactics use AI voice, video, and documents to exploit weak workflows. Learn the key fraud types, detection gaps, and defenses.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/#primaryimage\",\"url\":\"https:\\\/\\\/adex.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Adex-Deepfake-Scam-Online-Fraud.png\",\"contentUrl\":\"https:\\\/\\\/adex.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Adex-Deepfake-Scam-Online-Fraud.png\",\"width\":1200,\"height\":628,\"caption\":\"Adex - guide to deepfake scam tactics, AI online fraud risks, and stronger workflow defenses.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/deepfake-scam-online-fraud\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/adex.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Is a Deepfake Scam? How AI Is Used in Online Fraud\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/adex.com\\\/blog\\\/\",\"name\":\"ADEX - Ad Fraud & Invalid Traffic Prevention Platform\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/#organization\"},\"alternateName\":\"ADEX\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/adex.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/#organization\",\"name\":\"ADEX - Ad Fraud & Invalid Traffic Prevention Platform\",\"url\":\"https:\\\/\\\/adex.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/adex.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/CDD2258_copy-48-1.svg\",\"contentUrl\":\"https:\\\/\\\/adex.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/CDD2258_copy-48-1.svg\",\"width\":148,\"height\":30,\"caption\":\"ADEX - Ad Fraud & Invalid Traffic Prevention Platform\"},\"image\":{\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/adexsaas\\\/\",\"https:\\\/\\\/x.com\\\/adexsaas\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/adex.com\\\/blog\\\/#\\\/schema\\\/person\\\/2bf2469195f0e5bffe2e1d5b2ef12b61\",\"name\":\"Kira Vessiari\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cc59bc385c83827a6549fd86c717ef334484d083fba0e770f9b2365acdf272f2?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cc59bc385c83827a6549fd86c717ef334484d083fba0e770f9b2365acdf272f2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cc59bc385c83827a6549fd86c717ef334484d083fba0e770f9b2365acdf272f2?s=96&d=mm&r=g\",\"caption\":\"Kira Vessiari\"},\"sameAs\":[\"https:\\\/\\\/adex.com\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/kiravessiari\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Deepfake Scam: How AI Is Used in Online Fraud","description":"Deepfake scam tactics use AI voice, video, and documents to exploit weak workflows. Learn the key fraud types, detection gaps, and defenses.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/","og_locale":"en_US","og_type":"article","og_title":"Deepfake Scam: How AI Is Used in Online Fraud","og_description":"Deepfake scam tactics use AI voice, video, and documents to exploit weak workflows. Learn the key fraud types, detection gaps, and defenses.","og_url":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/","og_site_name":"ADEX","article_publisher":"https:\/\/www.facebook.com\/adexsaas\/","article_published_time":"2026-05-21T14:25:05+00:00","article_modified_time":"2026-05-21T14:25:06+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/adex.com\/blog\/wp-content\/uploads\/2026\/05\/Adex-Deepfake-Scam-Online-Fraud.png","type":"image\/png"}],"author":"Kira Vessiari","twitter_card":"summary_large_image","twitter_creator":"@adexsaas","twitter_site":"@adexsaas","twitter_misc":{"Written by":"Kira Vessiari","Est. reading time":"17 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/#article","isPartOf":{"@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/"},"author":{"name":"Kira Vessiari","@id":"https:\/\/adex.com\/blog\/#\/schema\/person\/2bf2469195f0e5bffe2e1d5b2ef12b61"},"headline":"What Is a Deepfake Scam? How AI Is Used in Online Fraud","datePublished":"2026-05-21T14:25:05+00:00","dateModified":"2026-05-21T14:25:06+00:00","mainEntityOfPage":{"@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/"},"wordCount":3661,"publisher":{"@id":"https:\/\/adex.com\/blog\/#organization"},"image":{"@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/#primaryimage"},"thumbnailUrl":"https:\/\/adex.com\/blog\/wp-content\/uploads\/2026\/05\/Adex-Deepfake-Scam-Online-Fraud.png","keywords":["Fraud","Threat"],"articleSection":["Guides"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/","url":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/","name":"Deepfake Scam: How AI Is Used in Online Fraud","isPartOf":{"@id":"https:\/\/adex.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/#primaryimage"},"image":{"@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/#primaryimage"},"thumbnailUrl":"https:\/\/adex.com\/blog\/wp-content\/uploads\/2026\/05\/Adex-Deepfake-Scam-Online-Fraud.png","datePublished":"2026-05-21T14:25:05+00:00","dateModified":"2026-05-21T14:25:06+00:00","description":"Deepfake scam tactics use AI voice, video, and documents to exploit weak workflows. Learn the key fraud types, detection gaps, and defenses.","breadcrumb":{"@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/#primaryimage","url":"https:\/\/adex.com\/blog\/wp-content\/uploads\/2026\/05\/Adex-Deepfake-Scam-Online-Fraud.png","contentUrl":"https:\/\/adex.com\/blog\/wp-content\/uploads\/2026\/05\/Adex-Deepfake-Scam-Online-Fraud.png","width":1200,"height":628,"caption":"Adex - guide to deepfake scam tactics, AI online fraud risks, and stronger workflow defenses."},{"@type":"BreadcrumbList","@id":"https:\/\/adex.com\/blog\/deepfake-scam-online-fraud\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/adex.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What Is a Deepfake Scam? How AI Is Used in Online Fraud"}]},{"@type":"WebSite","@id":"https:\/\/adex.com\/blog\/#website","url":"https:\/\/adex.com\/blog\/","name":"ADEX - Ad Fraud & Invalid Traffic Prevention Platform","description":"","publisher":{"@id":"https:\/\/adex.com\/blog\/#organization"},"alternateName":"ADEX","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/adex.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/adex.com\/blog\/#organization","name":"ADEX - Ad Fraud & Invalid Traffic Prevention Platform","url":"https:\/\/adex.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adex.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/adex.com\/blog\/wp-content\/uploads\/2022\/05\/CDD2258_copy-48-1.svg","contentUrl":"https:\/\/adex.com\/blog\/wp-content\/uploads\/2022\/05\/CDD2258_copy-48-1.svg","width":148,"height":30,"caption":"ADEX - Ad Fraud & Invalid Traffic Prevention Platform"},"image":{"@id":"https:\/\/adex.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/adexsaas\/","https:\/\/x.com\/adexsaas"]},{"@type":"Person","@id":"https:\/\/adex.com\/blog\/#\/schema\/person\/2bf2469195f0e5bffe2e1d5b2ef12b61","name":"Kira Vessiari","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/cc59bc385c83827a6549fd86c717ef334484d083fba0e770f9b2365acdf272f2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/cc59bc385c83827a6549fd86c717ef334484d083fba0e770f9b2365acdf272f2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cc59bc385c83827a6549fd86c717ef334484d083fba0e770f9b2365acdf272f2?s=96&d=mm&r=g","caption":"Kira Vessiari"},"sameAs":["https:\/\/adex.com","https:\/\/www.linkedin.com\/in\/kiravessiari\/"]}]}},"_links":{"self":[{"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/posts\/5605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/comments?post=5605"}],"version-history":[{"count":15,"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/posts\/5605\/revisions"}],"predecessor-version":[{"id":5651,"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/posts\/5605\/revisions\/5651"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/media\/5616"}],"wp:attachment":[{"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/media?parent=5605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/categories?post=5605"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adex.com\/blog\/wp-json\/wp\/v2\/tags?post=5605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}