Latest
UK Finance reports 2025 fraud figures[4]
Criminals stole £1.28 billion through payment fraud in 2025. UK Finance's release does not break out losses from deepfakes.
Timeline
Deepfake fraud: how the evidence has built up
One widely reported case, a survey of security leaders and UK publications make up the record. Few of them measure deepfake fraud directly.
Last reviewed against Building, Government Office for Science (UK Government) and The Register. Sources
Reading the record
Cases, surveys and policy
Hong Kong police described the video conference scam in February 2024 without naming the company, and Building identified Arup three months later, on 17 May 2024 [1]. After that the record shifts from a single case to measurements of the wider problem: how many deepfakes are in circulation [2], what security leaders report [7] and national fraud totals [4].
Each date is the one printed on the source page. Where a page shows only a month, the month is given rather than an invented day.
Go back to the overview for where things stand, or on to how to stop deepfake fraud.
Timeline
How it unfolded
Newest first. Each entry links to its source.
-
-
Cyber Security Breaches Survey 2025/2026 published[6]
It found 12% of businesses reported impersonation breaches or attacks, and that phishing was the most common type of attack.
-
Government publishes its account of the framework[2]
The Government Office for Science described tests of detection tools against impersonation, fraud and non-consensual images, with results intended to set industry standards.
-
Home Office plans a deepfake detection framework[3]
The Register reported a framework to evaluate detection technology, developed with Microsoft, other companies and academics, and quoted the Home Office estimate of about eight million deepfakes shared in 2025.
-
Gartner survey reports deepfake calls against staff[7]
The Register reported that 44% of the security leaders surveyed had seen at least one deepfake audio call against staff, and 36% a deepfake video attack.
-
Arup confirms it was the victim[1]
Building reported that Arup confirmed it was the victim of a deepfake fraud involving synthetic voices and pictures. Arup said no internal system of its own was compromised.
-
Hong Kong police describe a video conference fraud[1]
Police said a worker at an unnamed company sent money during a video conference with people posing as senior officers. About HK$200m was moved, and nobody had yet been arrested.
Key dates
The dates that matter
17 May 2024
Arup named as the victim of a deepfake video call fraud[1]
23 September 2025
Gartner survey on deepfake attacks against staff reported[7]
5 February 2026
Home Office framework for testing deepfake detection reported[3]
19 February 2026
Government publishes its account of the deepfake detection evaluation framework[2]
30 April 2026
Cyber Security Breaches Survey 2025/2026 published[6]
15 June 2026
UK Finance publishes its Annual Fraud Report 2026 figures for 2025[4]
Keep reading
Read next
Video call fraud
How a video meeting full of fake colleagues led to HK$200m being sent to criminals, what Arup and police said, and which checks would have intervened.
Read the guide
Voice cloning
How criminals clone a voice to ask for urgent payments, what Report Fraud and Gartner say, and the call-back rules that defeat a convincing voice.
Read the guide
Payment checks
How to design payment and bank detail checks so a cloned voice or fake video call cannot release money: who approves, what is confirmed and how.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Deepfake fraud is stopped by decisions about who may release money or access and how a request is confirmed. A virtual CISO helps leaders set those rules and have them tested, without a full-time hire.