Deepfake fraud: your questions answered

It is fraud that uses a fake voice, image or video to impersonate someone you trust and get money or access. The UK government says criminals use deepfakes to trick people into paying money[2]. In the Arup case, the people on a video call were fakes[1].

A worker at Arup transferred about HK$200m (about £20m) during a video conference with people posing as senior officers[1]. The firm stated that no internal system of its own was compromised, and that synthetic voices and pictures were involved[1].

Report Fraud says fraudsters generate fake audio imitating someone you know or trust and claim an urgent situation to get a payment[9]. Gartner's survey found 44% of security leaders had seen at least one deepfake audio call against staff[7].

No UK source gives a reliable count. UK Finance reported £1.28 billion stolen through payment fraud in 2025 but did not separate deepfakes[4]. The government estimates about 8 million deepfakes were shared in 2025[2].

End the call and ring back on contact details you already know are correct, not caller ID[9]. The NCSC advises verifying important requests by a second type of communication, such as a call, text or logging into an account[8].

Report Fraud advises a verification process involving more than one person before any funds transfer[10]. This stops one convincing caller from deciding the outcome alone.

Tools exist and the government is testing them against impersonation and fraud[2]. Gartner's survey saw harm from deepfake audio calls fall from 6% to 2% where an audio screening service was used, though no sample size was given[7].

The NCSC cautions against relying mainly on user training for phishing, and advises layered defences because some attacks will get through[8]. Combine training with call-back rules and second approvers.

Contact your bank immediately and report the fraud to the police through Report Fraud[4]. Keep call logs, recordings and the payment record, and tell your security lead.

In the 2025/2026 government survey, 12% of businesses reported impersonation breaches or attacks, down from 17% in 2023[6]. The survey does not say how many involved deepfakes[6].