He Wired $25M After a Video Call With His Boss. His Boss Wasn't There.

An employee at a major engineering firm sat on a video call with his CFO, several senior colleagues, and what felt like a completely normal business meeting. Everyone looked right. Everyone sounded right. He wired $25 million to the accounts they requested. Then the real CFO called. Nobody from the company had been on that call. Every single person the employee saw — the faces, the voices, the mannerisms — had been generated by artificial intelligence. The whole meeting was a fabrication.

That case involved Arup, a global engineering firm, and it happened in 2024. It wasn't a fluke. It was a preview. And if you've been operating under the assumption that seeing someone's face — on a video call, in a selfie, in a video message — counts as solid proof of their identity, that assumption just got a lot shakier.

We Were Trained to Trust Faces. That's Exactly the Problem.

Here's the uncomfortable truth. For most of human history, seeing someone's face was the gold standard of identity. It's baked into how our brains work. Contracts get signed in person. Witnesses testify face-to-face. Banks ask you to show up with a photo ID. The face is the proof.

Technology ran with that instinct. Banks now let you open accounts by taking a selfie. Courts accept video testimony. HR departments do final interviews over Zoom. The entire modern identity system doubled down on visual confirmation right at the moment when visual confirmation became the easiest thing on earth to fake.

That's not an accident on anyone's part. It's just a deeply unfortunate collision of timing. And the people who build fraud systems — the ones who prey on exactly this gap — noticed before most of us did. This article is part of a series — start with Age Verification Identity Data Security Risks.

Seven hundred percent. In a single year. And that's not some obscure corner of the internet — that's banks, investment apps, credit unions, insurance claims. The places where real money lives.

This Isn't Science Fiction. It's a Tuesday Afternoon.

Let's be specific about what "deepfake" actually means, because the word gets thrown around loosely. A deepfake (think of it as an AI-powered costume — one that fits perfectly and moves exactly like the real person) is a video, photo, or audio recording where artificial intelligence has replaced or fabricated someone's face, voice, or both. Not a blurry fake. Not an obvious Photoshop job. A version so polished that the people who knew the original couldn't tell the difference.

Piers Morgan — the British TV host — recently said at SXSW London that an AI deepfake of him was so convincing it fooled his own mother. His mother. Someone who has known his face and voice for his entire life.

The technology to create these fakes is no longer locked in research labs or used only by sophisticated state actors. It's widely available. Attackers can build a convincing fake from photos scraped off a public social media profile, audio pulled from a podcast appearance, or video from a recorded Zoom meeting. You don't need to be a tech expert. You need a laptop and some patience.

"By 2026, Gartner predicts that 30% of enterprises will no longer consider face biometric identity verification — verifying someone's identity using their face alone — to be reliable as a standalone check, specifically because of the threat from AI-generated deepfakes." — Gartner Research

That's Gartner — the research firm that big companies pay enormous fees to give them accurate predictions about where technology is heading. When they say "face verification alone is becoming unreliable," boards of directors listen. That shift is already underway.

The Government Noticed. That's How You Know It's Real.

Governments are slow. That's not a criticism — it's just the reality of how institutions move. So when the U.S. Treasury's Financial Crimes Enforcement Network (the federal agency that tracks money laundering and financial fraud) issued its first-ever alert specifically about deepfake-driven fraud in November 2024, that was significant. They even created a specific reporting term — FIN-2024-DEEPFAKEFRAUD — so banks could flag these cases separately from other fraud types. Previously in this series: Your Daughters Voice Just Called Begging For Money It Wasnt .

According to ShuftiPro, the Treasury's alert required financial institutions to start filing suspicious activity reports under that new category. The problem had graduated from "something researchers worry about" to "something regulators are building formal response systems around." That progression usually takes years. This one took months.

And the financial damage ahead is staggering. Deloitte projects that AI-enabled fraud losses in the United States could reach $40 billion by 2027, up from $12.3 billion in 2023, according to Help Net Security. That's not a rounding error. That's a national crisis in slow motion.

So What Do You Actually Do With This Information?

This is where most articles about scary technology let you down. They explain the threat in vivid detail, then end with something vague like "stay alert." That's not helpful. Let's be specific.

The instinct to slow down when a face is your only proof isn't paranoia. It's pattern recognition for a world that's changed. If someone sends you a video asking for money, access to an account, or personal information — and the only thing anchoring your trust is their face — that's exactly the moment to add a second layer. Call them back on a number you already have saved. Ask them something only they would know. Check whether the request came through a channel they'd normally use, or whether it arrived in an unusual way.

(Yes, this feels like extra friction. That friction is the point. Fraudsters count on momentum — the natural human impulse to keep a conversation moving, to be helpful, to not seem rude by asking twice.)

For anyone whose work involves verifying who people are — investigators, HR professionals, insurance adjusters, fraud analysts — the implications go deeper. As TechTarget reports, enterprises are already shifting toward layered identity security: combining face-based checks with device information, behavioral patterns (how someone normally types or moves through a system), and cryptographic credentials (digital proof tied to a specific device, like a hardware key) rather than relying on a face alone. Up next: Your Face Cant Be Reset The Hidden Cost Of Proving Youre Ove.

For investigators specifically — if you've ever wondered whether a photo or profile is really who it claims to be, that's exactly the question this kind of work exists to answer. The practical shift is this: facial matching is still a powerful tool, but it works best as one layer in a stack of evidence, not as the whole case. A face match opens the door. Transaction history, device records, behavioral inconsistencies — those are what lock it down. If you're building cases that will hold up, that multi-layer approach is where the work lives now.

The harder truth is that this isn't going to get simpler. The technology creating these fakes is improving faster than most detection systems can keep pace. That doesn't mean detection is hopeless — it means the bar for what counts as solid identity verification just got permanently higher.

The Arup employee on that video call did everything right by the old rules. He saw faces he recognized. He heard voices he knew. He followed the chain of command. Every instinct he had — every instinct we'd all have — pointed toward legitimacy. And it cost his company $25 million.

The old rules just retired. The question is whether the rest of us noticed the memo.