AI Messaging Fraud: Lessons From a $108M Bank Scam

identifAI, a Milan-founded deepfake detection company, has just published its first global report. It warns of a deepfake fraud problem worth about $40 billion. Its data, tracked through August 2026, shows that video synthesis makes up 42.7% of deepfake fraud incidents and voice cloning 21.9%, with the United States accounting for 34.1% of cases. The company also says criminals now sell ready-made impersonation toolkits, a model it calls “Fraud-as-a-Service,” and it argues that relying on human review alone for high-value transfers is no longer enough. 

This is not only a banking problem. In 2024, the British engineering firm Arup lost about $25.6 million after a Hong Kong employee joined a video call where every other person was a deepfake, CNN reported. A 2026 survey of 713 fraud professionals by ACFE and SAS found that 77% had seen deepfake social engineering increase, and the same study reports that only 7% of organizations are firmly ready. Because this risk follows payments, it reaches every market, including the UAE, the USA, the UK, Europe, Asia and Australia. Rules differ by region, and identifAI points to the EU AI Act and the US FTC Impersonation Rule as examples, but the protective habits are the same everywhere. 

The first habit is to verify every unusual request on a second channel, by calling back on a number you already trust rather than the one in the message. The second is to require two approvals for any urgent or unusual transfer, no matter who is asking. The third is to treat a familiar voice or face as a claim and never as proof. It also helps to review what your leaders share online, because identifAI says attackers collect audio and video from platforms such as LinkedIn. Finally, build a “pause and check” culture through regular training and realistic simulations, where nobody is blamed for asking one more question.