Deepfake Fraud Is Becoming a Board-Level Risk for Asia-Pacific Banks

Deepfake fraud has moved well beyond novelty and into the core risk agenda for banks, payment firms, insurers, and digital platforms across Asia-Pacific. The shift matters because deepfakes attack trust itself. They undermine the controls institutions have historically relied on to verify identity, approve payments, authenticate customers, and validate instructions from executives, clients, or counterparties. In a market environment already shaped by faster payments, remote onboarding, and digital customer journeys, that creates a material exposure across fraud, cyber, AML, operational resilience, and reputational risk.

The strategic concern is not simply that deepfakes are becoming more realistic. It is that they are becoming cheap, scalable, and increasingly embedded into broader fraud campaigns. A criminal group no longer needs to defeat every control in a process. It only needs to manipulate one high-trust moment, such as a video call, a voice callback, a selfie verification step, or a digital onboarding review. Once that happens, downstream controls can fail quickly.

Regulatory, Enforcement, and Market Context

Recent cases have made the threat concrete. The Hong Kong case involving Arup, in which an employee was deceived into transferring approximately US$25 million after joining a video conference featuring AI-generated versions of colleagues, was a watershed moment for the market. It demonstrated that deepfake-enabled fraud is not confined to consumer scams. It can target treasury processes, internal approvals, and corporate payment workflows. For regulators and boards, that shifts the issue from interesting technology risk to a live control failure scenario.

At the policy level, the February 2026 FATF paper on cyber-enabled fraud reinforces the broader framing. FATF makes clear that fraud is increasingly a major money laundering risk and that digitalisation is accelerating the scale, speed, and complexity of attacks. That matters because deepfake activity rarely sits alone. It often appears inside investment scams, account takeover attempts, mule account recruitment, executive impersonation fraud, and synthetic identity abuse. Institutions therefore need to treat deepfake risk as part of an interconnected financial crime ecosystem rather than a specialist biometrics problem.

What The Data Is Showing

The data direction is equally important. Entrust’s 2025 Identity Fraud Report reported that deepfake attempts were occurring at roughly one every five minutes in 2024, that digital document forgery rose 244 percent year on year, and that deepfakes accounted for a substantial share of biometric fraud attempts. Even if individual firms challenge the exact percentages, the trend is clear. Fraudsters are industrialising synthetic media and combining it with other attack methods, including social engineering, document fraud, malware, and credential theft.

INTERPOL’s 2025 to 2026 cyber threat assessment for Asia and the South Pacific also points to the growing role of AI-enabled scams in the region. That regional framing matters because Asia-Pacific combines several conditions that increase the threat: very high digital adoption, heavy use of remote onboarding, rapid instant-payment rails, dense mobile ecosystems, and cross-border customer and workforce movement. In short, the region offers scale, speed, and numerous trust-dependent channels.

Implications For Financial Institutions

For banks and regulated firms, the practical implication is that static identity controls are becoming less reliable when used in isolation. Voice verification alone is weakening. Visual verification alone is weakening. A single selfie or liveness step, if poorly designed, may no longer be sufficient. Manual review also does not guarantee safety if staff remain overconfident in what they see and hear on screen.

This has direct consequences for several high-risk processes. The first is corporate payment approval, where urgent instructions, callback verification, and video-based confirmation can all be manipulated. The second is retail and SME onboarding, where synthetic media can support false identities, mule account creation, or account recovery fraud. The third is contact centre authentication, where cloned voices can pressure staff into bypassing process. The fourth is privileged access and internal workflow approvals, especially in distributed and hybrid teams.

The broader analytical point is that deepfakes raise the premium on layered controls. Firms need stronger device intelligence, behavioural analytics, document verification, network linkage analysis, and process design that assumes identity signals may be manipulated. They also need scenario testing that reflects how criminals actually operate, not only how internal teams imagine attacks should happen.

Conclusion

Deepfake fraud is becoming a board-level issue because it strikes at the integrity of digital trust. As synthetic media becomes more accessible and more convincing, institutions that continue relying on point-in-time human validation or single-factor digital checks will become increasingly exposed. The risk is not theoretical. It is operational, financial, and already visible in enforcement and loss events.

Suggested Next Steps

• Review all high-trust decision points, including payment approvals, contact centre verification, remote onboarding, and account recovery, to identify where visual or voice-based trust is over-relied upon.

  
  

• Add layered controls such as out-of-band verification, device intelligence, behavioural analytics, and multi-person approval for high-value or unusual instructions.

  
  

• Run executive and frontline simulation exercises focused on deepfake-enabled impersonation, rather than generic phishing alone.

  
  

• Reassess governance so that deepfake risk is owned jointly across fraud, cyber, AML, operations, and business control functions.