Deepfakes and the New Face of Financial Fraud: What APAC Banks Must Know

The rise of AI and generative technologies has reshaped everything from mobile banking to customer service. But while innovation charges forward, so do those looking to exploit it. One of the most alarming developments in this space is the deepfake—a powerful, synthetic form of deception that’s rapidly becoming a favorite tool of fraudsters.

In Asia Pacific, where digital transformation in banking is among the most advanced in the world, deepfake-driven scams are no longer a hypothetical threat. They’re already here—and they’re proving extremely difficult to detect, let alone prevent.

So what exactly are deepfakes? And what can financial institutions across APAC do to protect themselves, their employees, and their customers?

Understanding Deepfakes in the Financial Context

A “deepfake” is a synthetic media creation generated using deep learning—usually combining AI models with video, audio, or images to convincingly impersonate real people. Think of a CEO speaking on video or a loved one calling on the phone—except it’s not them. It’s an AI-generated impersonation built from real-world data, and it can be indistinguishable from reality.

Globally, deepfake fraud attempts have surged more than 2,100% over the past three years, with Europe and North America sounding the alarm. But Asia is not far behind. Hong Kong, Singapore, Australia, and India have already reported successful fraud incidents involving voice and video cloning.

And unfortunately, many victims—including bank employees and customers—don’t yet realize how convincing these scams can be.

How Deepfakes Are Being Used to Defraud Financial Institutions

Here are four key use cases where deepfake technology is already being used to breach banking systems and exploit human trust.

1. New Account Fraud

Deepfakes can be used to impersonate a legitimate individual to open a new bank account—either using stolen personal information or entirely fabricated synthetic identities. These accounts are often used for money mule operations, allowing fraudsters to move illicit funds with minimal traceability.

Asia Pacific insight: In countries like the Philippines, where remittance and gig-economy payments fuel high account opening volumes, these attacks are especially dangerous. High digital onboarding rates increase the surface area for exploitation.

2. Account Takeovers

AI-generated voice and video can trick call center employees into verifying or resetting credentials for an imposter. In a now-infamous experiment, a journalist from the Wall Street Journal created a synthetic clone of her voice—and successfully accessed her own bank account using it.

Emerging threat in APAC: As banks in Indonesia and Malaysia adopt voice biometrics for convenience, they must now also question: can a cloned voice trick the system? Early testing shows it can.

3. Social Engineering and Phishing Scams

In romance scams, “kidnapping” schemes, or friend-in-need requests, AI-generated videos and cloned voices are being used to manipulate victims emotionally. A woman in Scotland was recently tricked into transferring £17,000 to a scammer using deepfake video calls posing as a romantic partner.

Regional context: In Asia Pacific, WhatsApp and LINE are major communication channels. Fraudsters are increasingly using these platforms to send deepfake voice messages posing as family members, business partners, or government officials.

4. CEO and C-Suite Impersonation

Perhaps the most chilling example comes from Hong Kong in 2024, where a finance executive joined a video call with his “leadership team”—only to later learn that every participant, including the CFO, was a deepfake. He transferred HK$200 million (US$25.6 million) before the scam was uncovered.

These impersonation scams—known as business email compromise (BEC) 2.0—are escalating. And they don’t require hacking systems. They exploit human trust, visually and audibly.

The Role of Financial Institutions in a Deepfake Era

The challenge of deepfakes is that they don't just target systems—they target people. And unlike malware, there’s no single firewall that can block a convincing voice or video from being trusted.

So, what can banks and fintechs across Asia Pacific do?

1. Invest in Real-Time, Multi-Layered Verification

Authentication needs to evolve beyond voice recognition and static biometric checks. Tools that analyze micro-expressions, vocal cadence, behavioral patterns, and device fingerprinting can help spot subtle anomalies in otherwise “perfect” deepfakes.

Example: Banks in Singapore are exploring liveness detection paired with passive behavioral biometrics to detect synthetic fraud during onboarding and authentication.

2. Embrace Data Sharing and Collective Intelligence

No single organization can fight deepfakes alone. Criminals operate across borders and industries. Sharing fraud signals, suspicious transaction data, and impersonation attempts with peers and regulators can help build a shared early-warning system.

Regulatory bodies like MAS, BNM, and AUSTRAC are increasingly encouraging information exchange under safe harbor provisions. APAC institutions must lean into these frameworks.

3. Strengthen Employee Training and Internal Controls

A well-trained employee is often the last line of defense. Banks need to update internal fraud training programs to include deepfake awareness, including simulated phishing and impersonation drills.

Finance teams, executive assistants, and customer service staff should be taught to:

• Verify unfamiliar calls or video meetings through a second channel

• Apply call-back protocols for high-risk financial transactions

• Flag unusual language, tone, or behavior—even if the face looks familiar

  
  

4. Educate and Empower Customers

Customer awareness is currently the weakest link. Many people still don’t know that AI voice cloning exists, let alone how convincingly it can impersonate loved ones or bank staff.

Banks should go beyond passive warnings. Consider:

• Short educational videos on social media

• Real-world scam scenarios in mobile banking apps

• Interactive “fraud training” pop-ups during fund transfers

Example: A digital bank in Australia recently launched a “Can You Spot the Fake?” interactive quiz in its app, teaching users how to recognize common scam red flags.

There Is No Silver Bullet—But There Is a Strategy

Deepfake fraud is evolving faster than most defense strategies. There is no single tool or rule that will stop it. But with the right approach, banks can still stay ahead:

• Use AI to fight AI: Defensive machine learning models must evolve as fast as offensive ones.

• Design with skepticism: Build products assuming deception is possible.

• Prepare for resilience: Even the best systems will be tested—how fast can you detect and respond?

The financial institutions that lead in the next five years won’t be the ones that simply digitize fastest—they’ll be the ones that earn trust and defend it relentlessly.

Conclusion: Trust Is Now the Hardest Currency

In an era where seeing is no longer believing, trust is not just a value—it’s a survival imperative. Financial institutions across Asia Pacific must treat deepfake risk with the same urgency as cyberattacks or money laundering.

Because when fraud looks and sounds like someone you know, only proactive strategy, shared intelligence, and continuous education can close the gap.