Malicious Deepfakes: How AI-Generated Media Is Used for Disinformation, Fraud and Espionage

A deepfake is an image, video or audio recording created or altered with artificial intelligence to show someone saying or doing something they never said or did. It isn't malware. No code infects a machine, and antivirus software can't "detect" a fake phone call. It is synthetic media used to deceive, and the cases below fall into three harms: disinformation, financial fraud and espionage.

1. What a malicious deepfake actually is

Law enforcement's own definition separates deepfakes from traditional malware, because the harm runs through human trust rather than a compromised system.

2. How deepfakes are made

Most modern deepfakes trace back to one adversarial training technique, and voice cloning has become cheap enough to use with almost no setup cost.

Diffusion models and voice-cloning systems built on the same approach have made convincing fakes cheaper and faster to produce. That is what turned deepfakes from a novelty into a tool that three kinds of bad actor now use routinely.

3. Disinformation and election manipulation

Fabricated audio and images spread fastest, and are hardest to correct, when they're timed to a moment such as an election or a breaking-news cycle, when there's no time to verify before the damage is done.

A third case shows the same dynamic with no election involved. In May 2023, a fabricated image purporting to show an explosion near the Pentagon spread on Twitter, amplified in part by verified accounts and Russian state media. It was linked to a brief dip in the stock market before Arlington County Police confirmed on the record that no explosion had occurred.^[12][13][14]

4. Financial fraud through executive impersonation

The costliest documented deepfake cases share a shape: a real employee, a request that looks and sounds like it comes from someone they already trust, and urgency that discourages checking through a second channel.

Arup confirmed the loss directly to CNN Business and said the fraud used fake voices and images without compromising any of the firm's internal systems.^[16] The 2019 UK case became public only through the insurer that covered the loss, Euler Hermes, which kept the companies anonymous. The funds were routed through a Hungarian account before being dispersed further.^[15]

5. Espionage and unauthorized access

Deepfakes are also used to get past identity checks, either to land a job with legitimate system access or to pose as an official trusted enough that the target lowers their guard.

6. The scale of the problem: fraud losses and a growing detection market

Isolated case studies understate how fast this is growing. Fraud-prevention vendors tracking attempted deepfake fraud, not just successful cases, report sharp year-over-year increases, and the detection-tooling market is expanding with them.

7. How to protect against deepfake attacks

Deepfakes attack human trust rather than a computer system, so the most effective defenses are procedural rather than technical:

• Verify requests through a separate channel. Contact the person using a phone number or address you already had on file, not one given in the suspicious message. The Arup case shows a video call alone is no longer proof of identity.
• Add friction to payments. Require multiple approvals and a waiting period for large or unusual transfers, especially ones framed as urgent or confidential. Urgency and secrecy appear in nearly every documented case above.
• Harden remote hiring. Verify identity documents, watch for audio and video that don't line up, and consider a live identity check before giving a new remote hire access to sensitive systems.
• Train staff to recognize the pattern, not just the technology. People who know voices and faces can be convincingly faked are more likely to pause and verify before acting.
• Wait for confirmation on breaking news, especially shocking images or recordings, before sharing. Official sources and established fact-checkers catch most fabrications within hours, but rarely within minutes.

8. Regulatory outlook

Detection tools and content-provenance standards are improving, and regulators are starting to write deepfake-specific disclosure rules into law instead of relying on general fraud statutes.

Key figures at a glance

Sources