Financial Deepfakes: How Scammers Clone Your Voice and Face to Drain Your Account

For years, facial recognition and voice verification were sold as the secure future of authentication — something that, unlike a password, couldn't simply be stolen or guessed. That promise isn't as solid anymore. With a handful of social media photos and a few seconds of public audio, today's deepfake technology can generate synthetic video and voice convincing enough to fool both automated identity verification systems and real people on a call.

Deepfakes use AI models trained on real samples of a person's voice or face — the more publicly available samples, the more convincing the synthetic result. An active social media account with enough photos and videos gives an attacker all the material needed to train a model capable of generating new content: videos where the person "says" something they never said, or calls where their cloned voice gives instructions they never gave.

Our guide on SIM Swapping in Colombia already documented how this technology is used specifically to bypass liveness detection systems on digital wallets like Nequi, generating synthetic videos with eye and facial movements that fool biometric verification after the attacker has already taken control of the victim's phone number.

The same principle applies, with potentially bigger consequences, in a corporate context. A cloned voice of the general manager giving "urgent" instructions over the phone is a direct evolution of CEO fraud — it's no longer just a well-written email, but a call where the voice sounds exactly like the real person, with the inflections and tone an employee would normally recognize instantly.

Documented cases internationally already show businesses that transferred significant amounts after instructions given over video call, where every visible participant except the victim was AI-generated.

High-quality deepfakes no longer show the obvious visual tells of earlier generations — unnatural blinking, blurry edges around the face, imperfect lip sync. Current models fix most of these flaws, especially in short clips or on lower-quality connections, where imperfections naturally blend into video compression artifacts.

Set up a pre-agreed verification word or phrase with key family members or colleagues, to use for any unusual request for money or sensitive information over a call or video call — something a deepfake couldn't know in advance.

Always verify through a completely different channel than the one the request arrived on. If the instruction comes via video call, confirm by text to an already-known number, or vice versa — never use the same channel the suspicious request arrived through.

Be wary of extreme urgency combined with requests for confidentiality, the same psychological pattern that dominates traditional BEC, now boosted by an additional layer of audiovisual credibility.

Don't rely solely on biometric liveness detection for high-value transactions. Combine it with additional out-of-band verification, especially at businesses handling significant transfers.

At businesses, limit the amount of public audio and video content from executives with financial authority, where reasonably possible, reducing the material available to train a cloning model.