FinCEN’s deepfake alert was a job-design problem for three groups of staff

The week

Earlier in 2024, an employee of the engineering firm Arup in Hong Kong joined a video call with people who looked and sounded like senior colleagues. By the end of it, the employee had transferred about $25 million. The colleagues were deepfakes. Arup confirmed the loss, and the case became a shorthand for a new kind of fraud: one where seeing and hearing someone is no longer proof that they are there.

Hong Kong police described the case publicly in February 2024 without naming the company. In May, Arup confirmed it was the victim. The employee had reportedly been suspicious of an initial message, and the video call was what dispelled the doubt. The technique worked because it targeted the check people had been taught to trust most: seeing a colleague’s face.

A deepfake is an image, video or audio recording created or altered with generative AI, the same family of technology that writes text or draws pictures from a prompt, so that it convincingly shows a real or invented person saying or doing something they never did. A few years ago, producing one took skill and time. Now it can be done with widely available tools.

On November 13, 2024, the Financial Crimes Enforcement Network, the Treasury bureau that collects and analyzes reports on financial crime, issued an alert to help financial institutions identify fraud schemes that use deepfake media. FinCEN said it had seen an increase in suspicious activity reports describing suspected deepfakes. A suspicious activity report, or SAR, is the confidential filing a bank must make to FinCEN when it suspects a transaction may involve crime.

FinCEN said the increase had begun in 2023 and continued into 2024. It drew the alert from its analysis of Bank Secrecy Act data, open-source reporting and information from law enforcement and other agencies. It framed the alert as part of the Treasury Department’s broader work on artificial intelligence, which had included a March 2024 report on AI-specific cybersecurity and fraud risks in financial services. It also tied the alert to its national anti-money laundering priorities, where fraud and cybercrime had been listed since 2021.

The reports particularly described altered or synthetic identity documents and images used to open accounts and evade identity checks. A synthetic identity is a fabricated person, sometimes stitched together from real and invented details, who exists only on paper and on screen.

The alert described what happened next. Criminals had successfully opened accounts with identities suspected to have been produced with generative AI. They then used those accounts to receive and launder the proceeds of other schemes, including check fraud, credit card fraud, authorized push payment fraud, loan fraud and unemployment fraud. Some of the accounts served as funnel accounts, collecting deposits made in many places for use by a criminal network elsewhere.

FinCEN also described how institutions were catching these accounts. Often it was by re-reviewing account opening documents after something else about the account looked wrong. A reverse image search sometimes showed that an identity photo matched a picture in an online gallery of AI-generated faces. Other institutions examined image metadata or used software built to detect manipulated media.

The alert named two practices that reduce exposure: multifactor authentication, including phishing-resistant methods, and live verification checks in which a customer confirms their identity by audio or video. It warned that criminals know this and try to avoid such checks, for example by claiming repeated technical glitches or asking to switch to another channel mid-check.

A separate section addressed social engineering. Criminals were using generative AI in business email compromise, spear phishing, elder financial exploitation, romance scams and investment scams. In family emergency schemes, a cloned voice or video of a relative pressed the victim for money. And criminals were impersonating executives to instruct employees to send large payments.

The alert listed red flags, including inconsistencies between identity documents and other customer information, customers who could not authenticate convincingly during live verification, and the use of tools that inject images into a webcam feed, so that the camera appears to show a live person when it is actually playing prepared footage. FinCEN asked institutions to use the key term “FIN-2024-DEEPFAKEFRAUD” in related reports, so that cases could be grouped and analyzed together.

Other red flags reached beyond the camera. They included a customer who declined multifactor authentication, device or location data that did not match the identity documents, and signs of AI-generated text in a customer’s answers. New accounts that quickly ran up rapid transactions, payments to gambling sites or digital asset exchanges, or chargebacks were flagged too. FinCEN stressed that no single indicator was proof, and asked for the key term in both the SAR’s filing institution note and its narrative.

FinCEN alerts usually land with financial crimes compliance teams, who translate them into monitoring rules and training. That work was needed here.

This alert raised a different question. Inside every bank and credit union, some employees are allowed to act because a face, a voice or a document looks right. Generative AI makes recognition unreliable, so those jobs have to be redesigned.

For most of the history of banking, recognizing a customer, or a colleague, was the safest control available. A teller who knew a customer by sight, a treasury clerk who knew the finance director’s voice: these were strengths. The alert, read carefully, says that they can now be turned into weaknesses, because the thing being recognized can be manufactured.

Three groups of staff hold that kind of authority, defined by whom they are asked to trust. Onboarding reviewers decide whether a new applicant is real. Service agents in contact centers and branches decide whether a caller or visitor is an existing customer. Payment and treasury operators decide whether an internal request comes from a real colleague. Each group has different managers, metrics and failure modes, and each needs its own redesign. All three also feed the institution’s suspicious activity reporting, which ties the redesign together.

The alert’s own best practices point the same way. Multifactor authentication and live verification checks are strong controls, but each ends in a decision someone makes when the result is unclear. FinCEN noted that criminals try to steer around live checks with claimed glitches and channel switches. The person they are steering is usually an employee with a queue to clear.

The alert reached every kind of financial institution covered by the Bank Secrecy Act, not banks alone. Broker-dealers run their own customer identification programs, and their client service associates and wire desks face the same choices as bank staff. Credit unions, money services businesses and card issuers each have versions of the three groups, even where the job titles differ.

How remote identity checks are fooled

When someone opens an account online, the bank typically asks for a photo of a government ID and a selfie, often a short video in which the person turns their head or blinks. Software then compares the face in the selfie with the face on the ID and checks that the ID looks genuine. The video part is called a liveness check: it is meant to prove that a real, live person is in front of the camera, not a photograph or a mask.

Deepfakes attack each step. A generated or altered ID can carry a fabricated face and details. A synthetic selfie can match that face. And an injection attack bypasses the camera entirely: instead of pointing a phone at a real person, the fraudster uses software that feeds prepared video directly into the app, as if someone had swapped the feed on a security camera with a recording. The liveness software sees what looks like a person blinking on cue.

Voice works the same way. Voice cloning tools can reproduce a person’s voice from a short recording, so a caller can sound exactly like a customer, or like a chief financial officer. Knowledge questions, such as a mother’s maiden name or a previous address, offer little protection either, because those answers are widely available after years of data breaches.

Identity checks still earn their keep, and automated tools catch a great deal. But wherever the final decision rests on a human looking or listening, that human now needs different support.

The human checks matter more than they might seem. Automated tools are tuned to let most genuine customers through quickly, because a slow or rejecting sign-up process drives good customers away. That means the cases the software is unsure about, the borderline and the odd, are handed to people. Fraudsters who are good enough to look borderline rather than obviously fake are, by design, the ones who end up in front of a human reviewer. The quality of that human decision is the last line of defense against precisely the most capable attackers.

Presentation attacks and injection attacks

Two different attacks hide behind the word deepfake, and they call for different defenses. In a presentation attack, the fraudster shows something to a real camera: a printed photo, a mask, or a screen playing a video. Liveness software is designed for this case, and vendors test it against an international standard for presentation attack detection.

In an injection attack, nothing is shown to a camera at all. Virtual camera software, a modified app or a device emulator feeds prepared media straight into the verification flow. Presentation attack detection can be bypassed entirely, because the software never sees a physical scene to assess. The defenses are different: signals that the app runs on a genuine device, detection of virtual camera drivers and emulators, and checks that the media stream has not been altered in transit. That is why FinCEN singled out third-party webcam plugins as a red flag.

Institutions buying identity verification should know which attack each layer addresses. A vendor that reports strong liveness scores may be describing only presentation attack detection. The relevant question for the contract and the due diligence file is how the product detects injected media, and how quickly that detection is updated.

Detection after the fact

FinCEN’s description of how institutions found these accounts carries a further point. Many were caught on re-review, after transaction monitoring flagged something unrelated. Onboarding and monitoring are usually separate teams with separate systems. If the monitoring team finds a synthetic identity and the onboarding team never hears about it, the same weakness admits the next one.

Onboarding reviewers: exceptions are where synthetic applicants get through

The alert focused on account opening. Fraudsters used generated or altered documents and synthetic selfies to pass remote identity verification, then used the accounts to receive and move illicit funds. These accounts are valuable to criminals precisely because they look legitimate. Automated document and liveness checks catch much of this. What they do not catch goes to a human exception queue.

That queue is where job design matters. Reviewers are usually measured on throughput and backlog age. A reviewer who spends ten minutes on a suspicious application lowers their numbers, and one who approves it moves on. In effect, the system pays people to stop looking.

Institutions can change that by adding quality measures, such as post-approval fraud rates by reviewer, and by giving reviewers a fast path to escalate without penalty. Reviewers also need training on the alert’s specific indicators, such as photos with visual artifacts, identity documents that do not match the device or location data, and live checks interrupted by claimed technical glitches. A visual artifact is a small flaw left by the generation process, such as an oddly blurred edge around hair or an earring that changes shape between frames.

The vendor relationship belongs here too. Most institutions buy identity verification from specialist providers. Institutions should ask those providers how they detect injected video and synthetic faces, and how often those detections are retrained, since the tools that generate deepfakes keep improving.

Suppose an online lender has a small onboarding team whose reviewers each clear a set number of exceptions a day. After the alert, the lender adds a monthly report showing how many of each reviewer’s approvals later turned out to be fraudulent, and it creates a one-click “escalate for second look” button that does not count against the reviewer’s daily target. Within a few weeks, escalations rise, a small number of suspicious applicants are declined, and reviewers report feeling permitted, for the first time, to slow down.

What the reviewer needs on screen

A reviewer can only judge what the case file shows. A well-designed exception screen puts the vendor’s reason codes next to the images, along with device, network and location signals and any history linking the device to other applications. It offers a reverse image search in one click. It lets the reviewer request a fresh live check through a different method, and it records why the case was approved, declined or escalated.

Reviewers also need clear authority to decline. In many institutions an exception reviewer can approve alone but needs a supervisor to decline, because declines generate complaints. That asymmetry pushes borderline cases toward approval. Making a decline as easy as an approval, with a short list of documented reasons, corrects it.

Who owns the queue

The owner of the exception queue varies by institution, and the redesign has to reach whoever it is. At a large bank it may be a dedicated fraud operations team. At a credit union it may be two or three member service staff who handle exceptions between other duties, or an outsourced provider. In a partnership where a fintech runs onboarding for a sponsor bank, the fintech’s staff may make the decision while the bank holds the customer identification obligation.

That last arrangement needs particular care. Bank regulators had reminded banks in July 2024 that they remain responsible for compliance when third parties deliver deposit products. A sponsor bank should know how its fintech partner measures exception reviewers, whether those reviewers can escalate to the bank, and how quickly fraud findings flow back.

Declines carry their own costs. Every synthetic applicant rejected is a gain, but every genuine applicant wrongly rejected is a lost customer and a likely complaint. For a lender, a decline on a credit application also brings notice obligations under Regulation B. Reviewers need documented reasons they can give, and leaders need to watch both error rates, not the fraud rate alone.

Measuring reviewers on later fraud has a timing problem. Synthetic accounts may lie idle or behave normally for weeks before they are used. A useful measure therefore combines confirmed fraud over a longer look-back with early warning signs from the first month of each account, such as the rapid transactions and chargebacks the alert listed. Reviewers then see feedback quickly enough to learn from it.

Service agents: recognition must stop being a credential

Contact center agents and branch staff authenticate existing customers, often by voice and by knowledge questions. Voice cloning can reproduce a voice from a short recording, and knowledge answers are widely available after years of breaches.

The redesign removes recognition from the agent’s decision. Verification should come through a channel the attacker does not control, such as a push approval in the customer’s app or a callback to a long-standing number. A push approval is a notification sent to the customer’s registered phone asking them to confirm, with a tap, that they are the one calling. The system, not the agent, should then show a pass or fail.

Agents then need explicit permission to slow down a caller who sounds right but fails that check, and scripts that make refusal routine rather than confrontational. A line such as “For your protection, we confirm every request like this through your app” turns a moment of suspicion into standard procedure.

Handle-time targets should exclude calls escalated for verification, or agents will soon work around the control. Handle time is the average length of a call, and it is one of the most closely watched numbers in any contact center. If a careful agent is penalized for it, carefulness will not last.

Requests to change phone numbers, addresses, payees or limits deserve a second check, because those changes typically come before the loss. A fraudster who can change the phone number on an account can then intercept every future verification, so the change itself is the moment to be most careful.

Voiceprints are a signal, not a credential

Many contact centers enrolled customers in voice biometrics over the previous decade, so that a caller’s voice itself served as proof of identity. Cloned voices attack exactly that control. The FBI warned in December 2024 that criminals were using AI-generated audio of individuals to get into their bank accounts.

A voiceprint match can still contribute as one risk signal among several, and it can still flag a caller whose voice does not match. What it cannot do any longer is authorize a high-risk change on its own. Institutions that rely on it should review which actions a voiceprint alone can unlock, and move account changes and payee additions behind a check in a channel the attacker does not control.

Friction, and who bears it

Moving verification into the app creates friction for customers who do not use the app, do not own a smartphone or struggle with the technology. Many of them are older customers, who are also the main targets of family emergency and impersonation scams. An institution needs fallbacks: a callback to a number that has been on file for a set period, a verification code sent by mail, or an in-branch visit for the highest-risk changes.

A short waiting period on newly added payees or recently changed contact details is another design choice. It costs genuine customers a day, and it gives the institution a window to send a notice to the old contact details before money moves. Each institution has to set those periods against its own complaint data and loss history.

When the customer is the one being deceived

Service staff also meet the other half of the alert: customers who are themselves being manipulated by a cloned voice of a relative. A teller or agent who suspects this needs permission to pause and a script for doing so. The Senior Safe Act of 2018 protects trained employees of covered financial institutions who report suspected exploitation of seniors in good faith. Broker-dealers can place temporary holds on disbursements under FINRA Rule 2165 when they reasonably believe financial exploitation of a specified adult is occurring.

Who bears the loss

Loss allocation shapes incentives here. Under Regulation E, a consumer is largely protected against unauthorized electronic fund transfers, so an account takeover achieved with a cloned voice usually lands on the institution. When the customer is deceived into sending the money personally, the transfer is generally treated as authorized, and the customer often bears the loss. Consumer wire transfers fall outside Regulation E altogether.

That split means the institution’s direct losses come mostly from takeovers, while scams against customers show up as complaints, reputational harm and pressure from regulators and legislators. A service redesign that counts only the institution’s own losses will underinvest in protecting customers from being manipulated.

Payment and treasury operators: the fake executive problem

The Arup case showed that the target need not be the customer. An employee can be persuaded to move money by an apparent senior colleague on a video call. Treasury, wire operations and accounts payable staff in financial institutions execute large transfers every day.

Here the redesign is about authority. Payment authorization should rest on a process, never on a person’s recognition of a colleague. Requests should arrive through a defined system, with dual approval by people using phishing-resistant authentication. Dual approval means that two separate people must sign off before money moves. Phishing-resistant authentication means a sign-in method, such as a physical security key, that cannot be tricked into working on a fake website or handed over in a convincing phone call.

Any change to payment instructions should be verified through an independent channel, using contact details already on file. If an email or a call asks to send a payment to a new account, the operator calls back on a number from the institution’s own records, never one supplied in the request.

The decisive element is cultural: a written statement from senior leadership that no executive will ever request an urgent payment outside the process, and that staff who refuse such a request will be supported. Without that statement, a convincing deepfake of the CFO tests an operator’s career risk as much as their judgment. A junior employee who says no to an apparent senior executive needs to know, in advance and in writing, that saying no is exactly what leadership wants.

Practice makes the commitment real. Some institutions already run simulated phishing; the same idea extends to a scheduled test call or message, apparently from a senior leader, asking an operator to bypass the process. The exercise should end by rewarding the refusal publicly. A test that ends in a reprimand teaches staff to hide near misses, which is the opposite of what the reporting loop needs.

Take a community bank. Late on a Friday afternoon, a wire operator receives a video call invitation that appears to come from the chief executive, who is said to be traveling. On the call, a face and voice that look and sound right explain that a confidential acquisition requires an immediate transfer, and that the usual approvers should not be told yet. In a bank without a redesigned process, the operator is alone with a choice between obeying an apparent superior and risking their job. In a bank with one, the answer is already written down: no payment moves outside the system, two approvers are required, and the operator calls the chief executive back on the number in the bank’s own directory. The call ends, the attempt is reported and tagged, and on Monday the operator is thanked in front of the team.

The difference between those two outcomes has nothing to do with spotting the fake. In the second bank, the operator never needs to decide whether the face is real. The process makes the question irrelevant.

Where the payment process is weakest

Attackers choose moments when the process is easiest to bend: late on a Friday, around holidays, during an announced reorganization, or when an executive is publicly known to be traveling. They often invoke confidentiality, such as a pending acquisition, to explain why the usual approvers must not be told. The controls should treat those pretexts as triggers for more verification, never less.

The callback directory is itself a target. If an attacker can change a phone number in the internal directory or vendor master file, the independent callback reaches the attacker. Changes to those records need their own approval and a notice to the previous contact details. The same applies to the executive assistants who manage calendars and travel, and who are often the people attackers impersonate or deceive first.

Commercial customers face the same attack

The institution’s treasury management customers face fake-executive attacks against their own finance teams. Under Article 4A of the Uniform Commercial Code, which governs most wholesale wire transfers, a bank and a commercial customer can agree a security procedure. If that procedure is commercially reasonable and the bank followed it in good faith, a fraudulent order the bank accepted can fall to the customer as a loss.

Deepfakes change what counts as commercially reasonable over time. A procedure that relies on a phone confirmation with a known voice was reasonable when voices could not be cloned cheaply. Banks should review whether the procedures they offer commercial customers still hold up, and should offer customers dual control and out-of-band confirmation as standard options. Counsel should advise on how specific agreements allocate loss.

Differences across institutions

At a large bank, wire operations, treasury and accounts payable are separate teams with separate managers, and each needs the same written commitment. At a small credit union, one or two people may handle all outgoing wires, which makes dual approval harder to staff and more important. At a broker-dealer or wealth manager, the pressure point is often a client’s emailed or phoned instruction to send funds, handled by an adviser’s assistant who knows the client’s voice.

Test calls need care to be fair and useful. Staff should know that the program exists and that leadership endorses refusals, even if they do not know when a test will come. Tests should target the process, such as a request to skip the second approver, rather than an individual’s ability to spot a fake. Results should be reported by team and by control, so that a gap leads to a process fix and not to blame.

Reporting: the loop that ties the three together

All three groups connect through reporting. FinCEN’s key term lets the government aggregate cases. Inside the institution, consistent tagging shows which group is being targeted and whether its controls are working.

That only works if front-line staff can record a suspected deepfake easily, and if investigators send findings back to the teams that saw the attempt. A monthly summary to each group’s manager, with examples, keeps training current as generation tools change. An onboarding reviewer who sees a real example of a synthetic selfie caught last month learns more than from any slide deck.

The loop also gives leaders something they rarely have: evidence about where the institution is actually being attacked. If most deepfake attempts arrive at account opening, investment goes there. If the contact center sees a rise in cloned voices, the push approval program moves up the list.

Good reporting also protects the institution with its regulators. When examiners ask how the institution responded to the alert, a record of tagged cases, monthly summaries and changes made in response is far more persuasive than a training attendance sheet.

What makes a deepfake report useful

A SAR narrative that says only “suspected deepfake” helps no one. A useful one records the channel, the stage of the relationship, what the media looked or sounded like, which control caught it and what device or network data was observed. FinCEN also asked filers to name the underlying fraud type alongside its key term, so that analysts can see which schemes the deepfakes support.

Internally, the institution needs a consistent taxonomy that matches the three groups: onboarding, existing-customer service and internal payments. Without it, the monthly summary cannot show where attempts are concentrated or whether a control change reduced them.

Sharing within the limits

SARs are confidential, and that limits how findings can travel. An institution may not disclose a SAR, or the fact that one was filed, outside the narrow channels the rules allow. It can still share the underlying facts and patterns internally for training, stripped of anything that reveals a filing.

Across institutions, Section 314(b) of the USA PATRIOT Act gives registered financial institutions a safe harbor to share information about suspected money laundering and terrorist financing, which can include the proceeds of fraud. A bank that finds a synthetic identity moving funds to another institution can use that channel to warn it. Registration is voluntary, and an institution that has not registered cannot use the safe harbor; the deepfake alert was a good reason to reconsider.

What a convincing fake costs

The financial stakes are plain from the Arup case: a single convincing call can move a sum that would wipe out a year’s profit for a small institution. But the costs reach further. Accounts opened with synthetic identities become channels for moving illicit funds, which creates regulatory exposure under anti-money-laundering rules. Customers whose accounts are taken over through a cloned voice blame the institution as much as the fraudster. Regulators increasingly expect institutions to show that their controls account for AI-driven impersonation. And a public case of an executive being impersonated can damage reputation well beyond the money lost.

There is also a workforce cost. Staff who are measured only on speed, and then blamed when fraud slips through, become disengaged and fearful. Redesigning jobs so that care is measured and refusals are supported is good for morale as well as for loss rates.

The oversight question for a board is simple to ask and revealing to answer: where in this institution can a single person, acting on what they see or hear, open an account or move money? Each answer is a place where a deepfake could succeed. A board that receives a short, regular report on those points, with the controls now in place and the cases caught, has a clear view of a risk that otherwise stays invisible until it is expensive.

The strongest objections

The first objection is that detection technology will solve the problem, making job redesign unnecessary. Detection is necessary, and it improves. But the tools that generate fakes improve too, and each detector update is followed by attempts to beat it. A process that never asks an employee to judge authenticity keeps working whichever side is ahead.

The second objection is that friction drives away customers. That is true when friction is applied everywhere. The answer is to concentrate it on the few actions that precede most losses: new accounts with risk signals, contact detail changes, new payees and large or unusual payments. Ordinary logins and routine payments can stay smooth.

The third objection is that smaller institutions cannot afford this. Most of the changes described here are policy and measurement changes: how reviewers and agents are scored, who may decline, what leadership has put in writing. Those cost management attention more than money. The technology elements, such as app-based verification and injection detection, usually come through core processors and identity vendors, and small institutions can ask those providers what they offer.

A fourth objection is that a strict refusal rule could block a legitimate urgent payment. It could, if the process had no fast path. A well-designed process includes an expedited route with two approvers and an independent callback, so that urgency changes the speed of the process, not whether it applies.

No decision on recognition alone

In a well-run institution, no one moves money or opens an account on recognition alone. Each of the three groups has metrics that reward catching fraud as well as speed. Verification happens through channels attackers do not control, and the system shows the result. Leadership has put its commitment to supporting refusals in writing and tests it. Suspected deepfakes are tagged consistently, and findings flow back to the front line every month.

The failures are just as recognizable: treating the alert as a compliance exercise that ends with new monitoring rules; adding training but leaving speed targets untouched; relying on agents’ ears to spot cloned voices; allowing verification callbacks to numbers supplied by the caller; running test calls that end in a reprimand; and assuming the identity verification vendor has the problem handled without asking how.

How an examiner would test it

An examiner reviewing the response to the alert would look for evidence, not intentions. Useful records include the updated policies for each of the three groups, the revised performance measures for reviewers and agents, and the written leadership statement on payments. Others are the log of test calls and their outcomes, counts of tagged cases by group, and due diligence files showing what the institution asked its identity verification vendor.

That last item connects to the 2023 interagency guidance on third-party relationships, which FinCEN cited in the alert. An institution that relies on a vendor for liveness and document checks is expected to understand how the vendor’s controls work and how their performance is monitored. A file showing the questions asked about injection attacks, and the answers received, is the kind of evidence that guidance contemplates.

Examiners may also ask how the institution decided which of the alert’s red flags to build into automated monitoring and which to leave to human review. A short mapping from each red flag to the control and the team that address it answers that question on a single page, and shows where a red flag has no owner.

Where recognition still decides

• Where in our institution can someone open an account, change a customer’s details or move money because a face, voice or document looked right?
• How are our onboarding reviewers measured, and do those measures reward catching fraud or only speed?
• When a caller asks to change a phone number, address, payee or limit, what check happens beyond the agent’s judgment?
• Has leadership said in writing that no executive will request an urgent payment outside the process, and that refusals will be supported?
• Are suspected deepfake cases tagged consistently, including FinCEN’s key term, and do findings go back to the teams that saw them?

With hindsight

The alert’s categories held up through 2025 and 2026. The three pressure points it implied, account opening, customer service and internal payments, remained the places where deepfakes caused trouble.

Public warnings followed quickly. Three weeks after the alert, the FBI issued a public service announcement on criminals’ use of generative AI in financial fraud. It described cloned voices used to get into bank accounts and fake video calls with apparent executives or officials. Its advice mixed two approaches: look for imperfections in images and video, and hang up and call back on a number you find yourself. Only the second kept working as the fakes improved.

Synthetic and altered identities kept targeting account opening. Identity verification vendors invested heavily in injection and liveness detection, with generation tools improving at the same time. That arms race is a reminder that technology alone does not settle the question; the human exception queue remained a point where judgment and incentives mattered.

Standards caught up with the injection problem. In July 2025 NIST published the final version of its Digital Identity Guidelines, SP 800-63-4, which replaced the 2020 version. Its identity proofing volume describes how attackers pair injection attacks with generative AI to defeat automated checks and the visual comparisons made by human proofing agents. It notes that comparing a face to a captured sample does not by itself stop such attacks, and it requires providers to implement controls against injected and modified media. The guidelines govern federal systems, but private-sector identity programs have long used earlier versions as a benchmark.

Impersonation of senior figures spread beyond companies. In May 2025 the FBI warned that malicious actors were sending AI-generated voice messages impersonating senior U.S. officials to build trust before seeking access or information. The fake executive problem had become a fake official problem, using the same technique.

Voice-based authentication lost ground as a primary control in contact centers, and phishing-resistant methods gained it. Recognizing a voice, whether by an agent’s ear or by software, became less trusted as a way to confirm identity.

Supervisors said the same. In an April 2025 speech, Federal Reserve Governor Michael Barr warned that bank identity verification relying on voice could become vulnerable to generative AI. He urged customers to verify unusual requests through a separate channel, even when the person asking seems genuine. He also suggested that bank verification evolve to include tools such as voice analysis and behavioral biometrics. In June 2025 the OCC, the Federal Reserve and the FDIC asked for public input on how to reduce check, ACH, wire and instant payments fraud.

Legislation moved more slowly and more narrowly. The first federal law aimed squarely at deepfakes, the TAKE IT DOWN Act of May 2025, addressed nonconsensual intimate images, not financial fraud. For banks, credit unions and broker-dealers, the response to deepfake fraud continued to run through existing anti-money laundering and fraud law, supervision and their own control design.

Across these cases, the controls that held were procedural: verification through channels the attacker did not control, dual authorization with independent callback for payments, and staff who had explicit permission to say no. Where an institution treated the alert only as a monitoring exercise, the front-line roles remained the weakest point.

None of those controls required spotting a fake. They worked because they did not depend on anyone’s eyes or ears in the first place, which is why they kept working as the fakes improved.

A fraud alert can be a workforce question in disguise. When the thing employees were trained to trust can be faked, the answer lies in changing what they are measured on, what they are allowed to do and what leadership has promised them, as well as what the monitoring systems look for.