The deepfake fraud numbers at a glance
| Figure | Stat | Source (year) |
|---|---|---|
| 11% | Share of global fraudulent activity that is deepfakes | Sumsub (2025) |
| $893M | Losses in 2025 complaints to the FBI that reported AI-related information | FBI IC3 (2026) |
| 2nd | Voice phishing’s rank among initial infection vectors in 2025, at 11% of intrusions | Mandiant M-Trends (2026) |
| 6.5% | Share of all fraud attempts that are now deepfakes, up from 0.1% three years earlier | Signicat (2024) |
| 2,137% | Rise in deepfake fraud attempts over three years | Signicat (2024) |
| 0.1% | People who identified every real and fake sample correctly after being told to look for fakes | iProov (2025) |
| 1,300%+ | Rise in deepfake fraud attempts in 2024, from about one a month to seven a day | Pindrop (2025) |
| 3 seconds | Audio that produced a clone with an 85% voice match in one McAfee test | McAfee (2023) |
| $25.6M | Loss in the Arup deepfake CFO video-call scam | Hong Kong police via CNN (2024) |
| $40B | Projected US GenAI fraud losses by 2027, up from $12.3B in 2023 | Deloitte (2024) |
| 30% | Enterprises that will distrust standalone identity verification by 2026 | Gartner (2024) |
How common are deepfake attacks now?
Deepfakes account for about 6.5% of all fraud attempts, or 1 in 15, up from 0.1% three years earlier. That is a 2,137% increase, according to Signicat’s fraud research with Consult Hyperion. A category that was a rounding error in 2021 is now a measurable share of the fraud your team sees, and it keeps climbing. Sumsub’s 2025-2026 report puts deepfakes at about 11% of global fraudulent activity.
The regional data tells the same story. In North America, deepfake fraud rose about 1,100% year over year in early 2025, and synthetic identity document fraud rose about 311%, according to Sumsub’s identity fraud research. Synthetic documents and synthetic faces are climbing together.
Can anyone actually spot a deepfake? Barely
When iProov tested 2,000 US and UK consumers in 2025, only 0.1% correctly identified every real and fake sample, and that was after being told to look for fakes. Participants were 36% less likely to spot a synthetic video than a synthetic image. McAfee found 70% of people were not confident they could tell a cloned voice from a real one.
This is why “the caller sounded right” is no longer evidence of anything. Human instinct was the last line of defense at the help desk, and it does not hold. For what that looks like on a live call, see Your help desk agent can’t tell it’s not you anymore.
Where do deepfakes turn up? The contact center
The call center is the front line. Deepfake fraud attempts jumped more than 1,300% in 2024, from roughly one a month to about seven a day, according to Pindrop’s 2025 Voice Intelligence and Security Report. Pindrop also measured a 475% rise in synthetic voice attacks at insurers and a 149% rise at banks.
The shift shows up at the top of the threat reports too. In Mandiant’s M-Trends 2026, voice phishing was the second most common way attackers broke in during 2025, at 11% of intrusions, while email phishing fell to 6%.
It lands there because that is where a synthetic voice meets a human who is measured on speed and trained to help. Password resets, MFA resets, and account recovery are the exact moments attackers target.
How fast and cheap is voice cloning?
Fast enough that it is not a barrier. In one McAfee Labs test, three seconds of audio produced a clone with an 85% voice match, and a small number of extra files pushed that to 95% (McAfee Labs, 2023). Anyone with a voicemail, a webinar clip, or a few seconds of social video has the raw material.
The exposure is already broad. In McAfee’s survey of 7,000 people, 1 in 4 said they had experienced an AI voice cloning scam or knew someone who had, and 1 in 10 said they had received a message from an AI voice clone. Of those, 77% said they lost money as a result.
What is deepfake fraud costing?
Enough to change budgets. The clearest single case is Arup, the engineering firm whose finance worker was tricked into sending $25.6 million after a video call where every other participant, including the CFO, was a deepfake. Hong Kong police reported the loss across 15 transfers.
The FBI’s Internet Crime Complaint Center received more than 22,000 complaints in 2025 that reported AI-related information, with adjusted losses above $893 million. The projection runs higher still. Deloitte’s Center for Financial Services estimates GenAI could push US fraud losses to $40 billion by 2027, up from $12.3 billion in 2023, a 32% compound annual growth rate. Arup is what one incident looks like, the FBI figure is the current national floor, and Deloitte’s is the trend line.
Are enterprises ready? Mostly not
No, and the vendors’ own customers know it. Gartner predicts that by 2026, 30% of enterprises will no longer consider identity verification and authentication reliable on its own, because deepfakes on face biometrics make it hard to tell a live person from a synthetic one. Gartner also noted injection attacks, which bypass the camera entirely, rose 200% in 2023.
The readiness gap is the other half of the story. Signicat found only 22% of financial institutions had implemented AI-based fraud prevention tools. Most have not yet closed the gap.
What the numbers point to
Every figure above traces back to the same weakness. Legacy defenses test what a person knows or what a camera sees, and GenAI can now beat both. Knowledge-based questions fail because the answers are online. Biometric and liveness checks fail because synthetic faces and injected video streams can now defeat them. That is the shift toward Identity Impersonation Detection: verifying the real person against authoritative sources instead of trusting a secret or a face.
Trusona built ATO Protect for that job. When a caller asks for a password reset, an MFA reset, or account recovery, the agent triggers a verification that confirms the person’s real, government-issued identity in real time. It is designed to resist GenAI deepfakes and to flag the technical tells of an attack, including SIM swap and man-in-the-middle activity, with no pre-registration, no app download, and no stored PII. The reasoning behind the approach is in the Identity Impersonation Detection white paper.
Frequently asked questions
What percentage of fraud is now deepfake-related? About 6.5% of all fraud attempts, or 1 in 15, up from 0.1% three years earlier, according to Signicat. That is a 2,137% increase over three years.
How much audio does it take to clone a voice? In one McAfee Labs test, three seconds of audio produced a clone with an 85% voice match, and a small number of extra files pushed that to 95% (McAfee Labs, 2023).
Can people tell the difference between real and deepfake content? Rarely. In a 2025 iProov study, only 0.1% of 2,000 people told to look for fakes correctly identified every real and fake sample.
Where do deepfake attacks turn up in enterprises? Contact centers and help desks are one clear target. Across the 1.2 billion calls Pindrop analyzed in 2024, deepfake fraud attempts rose more than 1,300%, from about one a month to seven a day (Pindrop, 2025).
Is voice phishing really a top way attackers get in? Yes. Mandiant’s M-Trends 2026 found voice phishing was the second most common initial infection vector in 2025, at 11% of intrusions, ahead of email phishing at 6%.
How much is deepfake and GenAI fraud expected to cost? Complaints to the FBI in 2025 that reported AI-related information added up to more than $893 million in adjusted losses. Deloitte projects US GenAI fraud losses could reach $40 billion by 2027, up from $12.3 billion in 2023. Individual incidents already run high: the Arup deepfake scam cost $25.6 million.
How do you stop deepfake fraud at the help desk? Verify the real person, not their trivia or their voice. ATO Protect confirms a caller’s government-issued identity in real time before any high-risk action, and flags SIM swap and man-in-the-middle signals.
Sources
- Signicat, The Battle Against AI-Driven Identity Fraud (2024)
- iProov deepfake detection study (2025)
- Pindrop, 2025 Voice Intelligence and Security Report
- McAfee, Beware the Artificial Impostor (2023)
- Deloitte Center for Financial Services, deepfake banking fraud analysis (2024)
- Gartner press release on identity verification and deepfakes (2024)
- Sumsub, Identity Fraud Report 2025-2026
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report (2026)
- Mandiant (Google Cloud), M-Trends 2026
- Hong Kong police via CNN, Arup deepfake scam (2024)
The faster your team can answer “is this really who they say they are,” the less any of these numbers can hurt you. See how ATO Protect works.