What deepfake fraud actually costs businesses in 2025–2026

Nine months. Over $1.5 billion. That’s the running total of financial losses tied to AI-generated deepfakes worldwide between January and September 2025, according to data compiled by Surfshark from the AI Incident Database and Resemble. It’s the clearest sign yet that deepfake fraud has moved from a novelty to a line item, one that shows up in board reports, insurance claims, and post-incident investigations.

Where the losses are concentrated

The single largest category by a wide margin is investment fraud: fraudsters using AI-generated video and audio of celebrities, executives, or politicians to promote fake investment schemes. This category alone accounts for $900 million, or 57% of all analyzed deepfake-related losses in the Surfshark dataset. These scams typically originate on social platforms: Facebook, WhatsApp, Telegram, YouTube, where a deepfaked public figure appears to endorse a trading platform or financial product.

Two other patterns matter more directly for business fraud teams:

Deepfake job applicants infiltrating organizations. The FBI is investigating a scheme in which more than 100 companies unknowingly hired remote IT workers who used AI-generated synthetic identities, such as fabricated resumes and cloned faces and voices in video interviews, to pass as legitimate candidates. Once hired, these workers funneled money to foreign governments, rather than performing the job.

Executive impersonation fraud. A cloned voice or face on a video call, directing a finance team to move money urgently. The best-documented case remains the Arup engineering firm’s loss of roughly $25 million (£20 million) in Hong Kong, where an employee joined a video call featuring deepfaked versions of the CFO and several colleagues and authorized multiple transfers before the fraud was caught.

Think you can tell what's real?

AI-generated content is more convincing than ever. Test yourself with our free Deepfakes Quiz.

Try it now

Why the average incident is so expensive

Deepfake fraud against businesses doesn’t behave like generic phishing — high volume, low value per hit. It’s closer to the opposite: low volume, high value. That’s consistent with independent survey data, which found that 575 business decision-makers across five countries, fielded by Sapio Research, had incurred an average loss of nearly $450,000 due to deepfakes, with the financial-services sector facing a steeper $603,000 average. Ten percent of surveyed organizations reported losses exceeding $1 million.

The FBI’s Internet Crime Complaint Center tracked “AI-related” fraud as its own category for the first time in its 2025 Internet Crime Report, logging 22,364 complaints and $893 million in losses — a figure the report itself flags as an undercount, since most AI involvement in fraud isn’t yet identified as such at the point of reporting. Within that total, AI-linked investment fraud alone accounted for $632 million.

The real problem: humans can’t tell the difference

Every layer of business risk above assumes fraud gets caught somewhere along the way — by a hiring manager noticing something off in an interview, a finance employee pausing before a wire transfer, a customer support agent questioning a suspicious call. Veriff’s Deepfakes Report 2026, based on a February 2026 survey of 3,000 people across the US, UK, and Brazil conducted with Kantar, tested that assumption directly: how good are people actually at spotting a deepfake when shown one?

The answer is barely better than guessing. On a scale from -1 (always wrong) to 1 (perfect accuracy), where 0 represents a coin flip, US respondents scored just 0.07: statistically close to the UK’s 0.07 and Brazil’s 0.08. Put plainly, most people are only a tiny fraction better than random chance at telling a real video or image from a fabricated one.

Video was the hardest format to judge. When shown a real and fake video side by side featuring a woman, 70% of US respondents misidentified the fake as real. One of the toughest visuals in the entire study. Fully AI-generated images of women and complex “faceswap” content followed the same pattern.

What makes this worse for businesses is a confidence gap sitting on top of the accuracy gap. Roughly half of US respondents said they’re confident they could spot a deepfake, and confidence didn’t reliably track with actual skill. Veriff’s research identified a “high-risk” segment: about 7% of users across all three markets who combine poor detection accuracy, high self-confidence, and a tendency to rarely or never verify suspicious content. That’s the exact profile fraudsters are counting on when they run a deepfake investment scam or a synthetic job candidate through a hiring pipeline.

The visual cues people rely on most- unnatural skin texture (53%), odd hair or teeth (52%), unnatural movement in video (51%) – are also the cues modern generative AI has gotten best at faking. Checking more carefully didn’t meaningfully improve accuracy in the study, suggesting people don’t have a structured method for verification; they’re relying on the same intuition-based checks that AI has already learned to defeat.

What this looks like inside a verification flow

Business risk teams face the same structural problem the Kantar survey exposed at the consumer level. Veriff’s separate Identity Fraud Report 2026 found that digitally presented media was 300% more likely to be either entirely AI-generated or otherwise altered in 2025 compared to 2024, and that impersonation fraud, much of it now AI-accelerated, accounted for more than 85% of all fraudulent verification attempts observed.

That trend maps onto what’s often called an injection attack: a fraudster uses a deepfake video, synthetic identity, or virtual camera to insert a fabricated face into a verification flow, hoping to convince the system it’s looking at a real, live person. It’s the same underlying technique whether the target is a new-account signup, a job applicant’s identity check, or a high-value transaction requiring re-authentication.

Given that human detection sits close to a coin flip even under controlled test conditions, no verification process should rely on a person visually inspecting a face or a document as its main line of defense. A layered approach matters instead:

• Facial biometric verification with liveness checks — confirming true, live human presence rather than a static image or injected video, using signals like natural facial movement, lighting consistency, and depth.
• Document verification against a specimen database — catching fabricated or AI-generated documents that often accompany a deepfake identity.
• Cross-links and risk labels — recognizing when the same fraud pattern, document, or device has already surfaced elsewhere across a wider customer network, so one caught attempt helps protect others.
• Human review for edge cases — not as a first line of defense, but as a targeted layer for the cases where automated systems flag genuine ambiguity and trained judgment adds value the eye alone can’t provide.

The takeaway for businesses

Two datasets, read together, tell a single story. Financial data shows where deepfake fraud concentrates: investment scams, fraudulent hires, and executive impersonation, each producing outsized losses from relatively few incidents. Behavioral data explains why it keeps working: the people standing between a fraudster and a payout are barely better than a coin flip at spotting a fake, and those who feel most confident are often the least accurate.

If your business relies on video calls, remote interviews, or selfie-based verification as a trust signal, it’s worth asking a direct question: would your current process catch a well-made deepfake today? For a growing number of companies, the honest answer has been no — and the six- and seven-figure losses that follow are why deepfake defense has become a boardroom topic rather than a technical afterthought.