Deepfake Fraud Is Becoming a Board-Level Risk for Asia-Pacific Banks

Deepfake-enabled fraud has moved well beyond novelty and into the core risk register for banks, payment firms, insurers, brokers, and large corporates across Asia-Pacific. Financial institutions are now facing AI-generated voice cloning, real-time video impersonation, forged identity artefacts, and synthetic customer profiles used to defeat onboarding, manipulate payment approvals, or compromise service desks.

The reason this matters at board level is straightforward. Deepfakes attack trust at the precise points where many institutions still rely on trust-based controls. Senior staff authorise payments after a phone call. Call centres escalate cases based on voice familiarity. Remote onboarding journeys are designed to balance convenience with friction. Deepfake tools directly target each of those assumptions — and they are now available to mid-tier criminal actors at near-zero marginal cost.

The widely reported Arup case in Hong Kong, where an employee transferred approximately US$25 million after a video call populated by entirely AI-generated colleagues, demonstrated that synthetic media has crossed from theoretical risk into operational financial loss.

REGULATORY, ENFORCEMENT, AND MARKET CONTEXT

FATF's recent work on cyber-enabled fraud has underlined that sophisticated fraud typologies do not end with the initial deception — they generate proceeds layered through mule accounts, cross-border transfers, digital assets, and nested payment structures. Deepfake fraud is not merely a front-end authentication problem. It is an entry point into a broader laundering chain.

The Monetary Authority of Singapore, HKMA, and Australian APRA have each published guidance reinforcing the importance of resilient authentication, fraud governance, and operational controls that account for AI-driven threats. There is no jurisdiction in the region where boards can credibly treat deepfake fraud as someone else's problem.

WHAT THE DATA IS SHOWING

Sumsub's Identity Fraud Report 2025 identified a four-fold increase in deepfake fraud incidents compared to 2023. The collapse in cost and expertise required to produce convincing fraudulent content is the critical trend — what once demanded specialist skills now requires a modest budget and consumer-grade AI tools. Deepfakes also rarely appear in isolation: they are components of broader attack chains involving phishing, account compromise, fake websites, and mule-account cash-out.

IMPLICATIONS FOR FINANCIAL INSTITUTIONS

Institutions should assume that voice, video, and familiarity are no longer reliable single authentication factors. The greatest exposure sits in four areas:

Corporate payment approvals — urgent, out-of-band requests from apparently familiar individuals remain the highest-value target.

Remote service interactions — account resets, device changes, and beneficiary additions via phone or video are high-trust decision points exploitable by synthetic personas.

Digital onboarding — document and liveness checks not layered with behavioural and device intelligence are increasingly vulnerable.

Wealth and private banking — relationship-led service models create pressure to reduce friction, making them attractive for impersonation attacks.

CONCLUSION

Deepfake fraud should be treated as a strategic control challenge. The core risk is that AI can now create plausible authority, urgency, and identity at scale — and the cost of doing so continues to fall. Boards without visibility over this risk are operating with an incomplete picture of institutional exposure.

SUGGESTED NEXT STEPS

• Re-test payment approval and service-desk controls against the assumption that voice and video can be spoofed with consumer-grade tools

• - Add layered authentication using device, behavioural, contextual, and transaction-risk signals

• - Run scenario exercises on executive impersonation and synthetic onboarding attacks

• - Ensure fraud, cyber, AML, and investigations teams share post-incident intelligence immediately

  
  

Sources: FATF Cyber-Enabled Fraud Report 2023; Sumsub Identity Fraud Report 2025; MAS, HKMA, and APRA guidance on operational resilience.

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai