What deepfake fraud actually costs businesses

AI-generated deepfake fraud caused more than $1.5 billion in reported losses worldwide in the first nine months of 2025, with investment scams, fraudulent hires, and executive impersonation driving the bulk of that total. As attacks grow more sophisticated, and as new research shows just how poorly humans detect them, businesses must strengthen fraud prevention and identity verification to stay ahead.

Nine months. Over $1.5 billion. That’s the running total of financial losses tied to AI-generated deepfakes worldwide between January and September 2025, according to data compiled by Surfshark from the AI Incident Database and Resemble. It’s the clearest sign yet that deepfake fraud has moved from a novelty to a line item, one that shows up in board reports, insurance claims, and post-incident investigations.

Where the losses are concentrated

The single largest category by a wide margin is investment fraud: fraudsters using AI-generated video and audio of celebrities, executives, or politicians to promote fake investment schemes. This category alone accounts for $900 million, or 57% of all analyzed deepfake-related losses in the Surfshark dataset. These scams typically originate on social platforms: Facebook, WhatsApp, Telegram, YouTube, where a deepfaked public figure appears to endorse a trading platform or financial product.

Two other patterns matter more directly for business fraud teams:

Deepfake job applicants infiltrating organizations. The FBI is investigating a scheme in which more than 100 companies unknowingly hired remote IT workers who used AI-generated synthetic identities, such as fabricated resumes and cloned faces and voices in video interviews, to pass as legitimate candidates. Once hired, these workers funneled money to foreign governments, rather than performing the job.

Executive impersonation fraud. A cloned voice or face on a video call, directing a finance team to move money urgently. The best-documented case remains the Arup engineering firm’s loss of roughly $25 million (£20 million) in Hong Kong, where an employee joined a video call featuring deepfaked versions of the CFO and several colleagues and authorized multiple transfers before the fraud was caught.

Think you can tell what's real?

AI-generated content is more convincing than ever. Test yourself with our free Deepfakes Quiz.

Try it now

Why the average incident is so expensive

Deepfake fraud against businesses doesn’t behave like generic phishing. This is high-volume, low-value per hit. It’s closer to the opposite: low volume, high value. That’s consistent with independent survey data, which found that 575 business decision-makers across five countries, fielded by Sapio Research, had incurred an average loss of nearly $450,000 due to deepfakes, with the financial-services sector facing a steeper $603,000 average. Ten percent of surveyed organizations reported losses exceeding $1 million.

The FBI’s Internet Crime Complaint Center tracked “AI-related” fraud as its own category for the first time in its 2025 Internet Crime Report, logging 22,364 complaints and $893 million in losses – a figure the report itself flags as an undercount, since most AI involvement in fraud isn’t yet identified as such at the point of reporting. Within that total, AI-linked investment fraud alone accounted for $632 million.

The real problem: humans can’t reliably tell the difference

Veriff’s Deepfakes Report 2026, based on a February 2026 survey of 3,000 people across the US, UK, and Brazil conducted with Kantar, put that assumption to the test: how good are people really at spotting a deepfake?

For businesses, the problem is compounded by a confidence gap. Around half of US respondents said they were confident they could spot a deepfake, yet confidence did not reliably correspond to actual ability. Veriff’s research identified a “high-risk” segment: around 7% of respondents across the three markets combined poor detection accuracy with high self-confidence and a tendency to rarely or never verify suspicious content. That is precisely the kind of gap fraudsters can exploit — whether they’re using a deepfake in an investment scam or presenting a synthetic candidate during a hiring process.

The visual cues people rely on most are unnatural skin texture (53%), unusual hair or teeth (52%), and unnatural movement in video (51%). These are the same characteristics that generative AI is becoming increasingly capable of replicating. Looking more closely at content did not meaningfully improve accuracy, suggesting that people lack a reliable method for spotting fakes, but instead rely on intuition that AI can now easily mimic.

The study also found that people struggled to identify manipulated content consistently:

• Country-level scores clustered between 60% and 69%, and the same visuals consistently fooled participants regardless of location. This suggests the difficulty is not simply a regional skills gap, but a more fundamental limitation in human detection.:

• Players averaged 63% correct, only modestly above the 50% baseline expected from pure guessing.

• 31% of players performed no better than a coin flip.

• Only 2.4% achieved a perfect score.

• Faceswaps were the hardest content type to identify, with players getting 56% correct, compared with 69% for photos and 60% for videos. This echoes the Kantar finding that complex faceswap content is particularly difficult to detect.

• Country-level scores clustered between 60% and 69%, and the same visuals consistently fooled participants regardless of location. This suggests the difficulty is not simply a regional skills gap, but a more fundamental limitation in human detection.

HIT PLAY & HEAR THE FULL STORY 🎧

What this looks like inside a verification flow

Business risk teams face the same structural problem the Kantar survey exposed at the consumer level. Veriff’s separate Identity Fraud Report 2026 found that digitally presented media was 300% more likely to be either entirely AI-generated or otherwise altered in 2025 compared to 2024, and that impersonation fraud, much of it now AI-accelerated, accounted for more than 85% of all fraudulent verification attempts observed.

That trend maps onto what’s often called an injection attack: a fraudster uses a deepfake video, synthetic identity, or virtual camera to insert a fabricated face into a verification flow, hoping to convince the system it’s looking at a real, live person. It’s the same underlying technique whether the target is a new-account signup, a job applicant’s identity check, or a high-value transaction requiring re-authentication.

Given that human detection sits close to a coin flip even under controlled test conditions, no verification process should rely on a person visually inspecting a face or a document as its main line of defense. A layered approach matters instead:

• Facial biometric verification with liveness checks — confirming true, live human presence rather than a static image or injected video, using signals like natural facial movement, lighting consistency, and depth.
• Document verification against a specimen database — catching fabricated or AI-generated documents that often accompany a deepfake identity.
• Cross-links and risk labels — recognizing when the same fraud pattern, document, or device has already surfaced elsewhere across a wider customer network, so one caught attempt helps protect others.
• Human review for edge cases — not as a first line of defense, but as a targeted layer for the cases where automated systems flag genuine ambiguity and trained judgment adds value the eye alone can’t provide.

What should businesses take away from this data?

Three datasets, read together, tell a single story. Financial data shows where deepfake fraud concentrates: investment scams, fraudulent hires, and executive impersonation, each producing outsized losses from relatively few incidents. Behavioral data, from a representative population survey and a global engagement quiz alike, explains why it keeps working: the people standing between a fraudster and a payout average somewhere between 61% and 66% accuracy at best, and those who feel most confident are often among the least accurate.

If your business relies on video calls, remote interviews, or selfie-based verification as a trust signal, it’s worth asking a direct question: would your current process catch a well-made deepfake today? For a growing number of companies, the honest answer has been no — and the six- and seven-figure losses that follow are why deepfake defense has become a boardroom topic rather than a technical afterthought.