Deepfake fraud hits $40 billion: what banks should take from the new report

Deepfake-enabled fraud is now estimated at $40 billion a year, according to the first global synthetic fraud benchmark from identifAI, published this week. Synthetic media already causes roughly 1 in every 100 failed identity verification checks worldwide. For fraud and security leaders, the question is no longer whether deepfakes will reach your workflows, but whether your controls can tell the difference when they do.

What the numbers say

The report, which covers data through August 2026, shows how quickly attackers have moved from text-based phishing to impersonation with cloned voices, manipulated video and fabricated identities. Note that identifAI is itself a deepfake detection vendor and the figures are its own estimates, but the direction of travel matches what we see across the industry. As Security Boulevard reports, the headline findings include:

• Video synthesis is the largest attack type at 42.7% of observed cases, followed by voice cloning at 21.9%. Together they account for 64.6% of incidents.
• Identity fraud makes up 17.6% of incidents.
• The United States is the largest single market at 34.1%, ahead of India (7.7%) and the United Kingdom (6.6%).
• Attackers harvest executive audio and video mostly from X (42.1%) and LinkedIn (14.5%).

Taken together, these figures describe an economy of fraud. Attackers no longer need advanced skills; they need a few minutes of public footage, an off-the-shelf toolkit and a target whose approval process still trusts what it sees and hears. That is why the share of identity fraud and voice cloning matters so much to banks, contact centres and any team that approves payments remotely.

Why voice and video are the weak point

Public content is raw material

Every podcast, conference talk and earnings call is training data. A few seconds of clean audio is often enough to build a convincing clone, and the report shows attackers actively mining social platforms for exactly that material.

Legacy checks can be bypassed

The report highlights ready-made fraud toolkits and virtual camera injection, which feeds synthetic video straight into a verification flow and skips the physical camera altogether. Basic liveness checks and knowledge-based questions were not designed for this.

The losses are real

The case list is sobering: a $25.6 million transfer at Arup after a video call in which every participant was a deepfake, 46 fraudulent accounts opened at ABN AMRO through identity morphing, and an attempted currency hedge at Ferrari using a cloned CEO voice.

What financial institutions should do now

Human review alone will not hold. The report's contributors argue for making detection an active layer in critical workflows rather than a forensic tool used after the money has gone. In practice that means:

1. Verify the media, not just the person. Run real-time deepfake detection on calls, video onboarding and voice channels.
2. Break single-channel trust. Confirm high-value payments and sensitive account changes through a separate, trusted channel.
3. Layer biometrics. Combine voice, face and behavioural signals so that fooling one modality is not enough.
4. Watch for synthetic identities. Monitor onboarding and account activity for patterns that real customers do not produce.
5. Prepare for regulation. Track the EU AI Act, the FTC Impersonation Rule and the TAKE IT DOWN Act.

Looking ahead: authenticity as infrastructure

The report also warns that manipulated media could eventually mislead autonomous AI agents that handle financial workflows. That raises the stakes: authenticity checks will need to run at machine speed, inside the workflow, with no human in the loop to catch what looks slightly off.

At Corsound AI, that is exactly what we build. See how Deepfake Detect flags synthetic audio and video in real time, or explore our solutions for banking and finance to protect your customers and your payment flows.