Deepfakes and payment fraud: what regulators have told finance teams

US regulators have described deepfake fraud as a payments problem as much as a technology problem: generative AI is used to imitate a trusted person's voice, face or documents so that someone moves money. FinCEN has published red flags for it, and a Federal Reserve governor has set out the controls banks and their customers use against it.¹² This page sets out what those documents say. It does not tell any company what controls to adopt.

What FinCEN said

On 2024-11-13 the Financial Crimes Enforcement Network, the Treasury bureau that administers the Bank Secrecy Act, issued an alert on fraud schemes that use deepfake media created with generative AI tools.¹ FinCEN said the alert explains the typologies of these schemes, gives red flag indicators to help institutions identify and report the activity, and reminds financial institutions of their reporting requirements under the Bank Secrecy Act.¹

FinCEN also said it had observed an increase in suspicious activity reports describing the suspected use of deepfake media, "particularly the use of fraudulent identity documents to circumvent identity verification and authentication methods."¹ It placed the abuse of generative AI tools under cybercrime and fraud, which it named as two of its anti-money laundering and countering the financing of terrorism national priorities.¹ The alert is addressed to financial institutions, the firms that file those reports, but the schemes it describes reach the businesses that bank with them.

What the Federal Reserve heard and said

On 2025-04-17 Governor Michael S. Barr gave a speech on deepfakes and bank cybersecurity.² He described a deepfake attack as one in which an attacker uses generative AI to create a doppelganger with a person's voice or image and uses it to interact with individuals or institutions to commit fraud. He said deepfake attacks had seen a twentyfold increase over the previous three years, and that deepfakes "are also being used to commit payment fraud."²

The example he gave is a finance function case. He said that in 2024 a deepfake of the chief financial officer of the British engineering firm Arup "was reportedly deployed in a video meeting and convinced an Arup financial employee to transfer $25 million to thieves."² The speech used the word "reportedly"; the figure is the governor's account of a reported case, not a finding by the Board.

The controls the speech describes

Governor Barr's speech described controls at three points.²

• At the bank. Banks verify payors through identity verification processes, including multi-factor authentication. He said banks have two points of control over a transaction: confirming the sender's identity and the legitimacy of the recipient. Banks can scrutinize the recipients of large or unusual transactions, use analytics to flag suspicious patterns, and perform additional reviews before authorizing a payment to a recipient that raises flags.
• At the customer. He said customers should enable multi-factor authentication and verify unusual requests "through a separate channel, even if the person making the request seems genuine."
• At the regulator. He said regulators can reinforce cyber defenses through updates to guidance and regulation, with attention to the burden on smaller institutions, and should consider using AI to detect patterns of fraud at regulated institutions.

He also noted that identity verification at banks often relies on voice detection, which he said may become vulnerable to generative AI tools.²

Treasury's view of the fraud data gap

Treasury's March 2024 report on AI-specific cybersecurity risks in financial services listed fraud among the immediate operational risks it addressed.³ Among its next steps, Treasury described a "fraud data divide": as more firms deploy AI, there is a gap in the data available for training fraud models, and large institutions hold an advantage because they have more internal data.³ Treasury's December 2024 report on AI in financial services, which followed its 2024 request for information, recommended further sharing of AI information specific to financial services, alongside the AI cybersecurity forum proposed in the March report.⁵

Payments made by AI agents

In a speech dated 2026-09-29, Governor Christopher J. Waller said the payments industry "was also an early adopter of large language models (LLMs) for payment reconciliation and similar tasks," and that machine learning has long been used against payments fraud.⁴ For payments made by AI agents on a buyer's behalf, he named three challenges: authentication, liability and fraud. He said the question shifts from proving that a buyer is an authorized payer to proving that an agent has the authority to pay on the buyer's behalf.⁴

What the documents do not do

None of these documents is a rule for companies outside the financial sector. The FinCEN alert is addressed to financial institutions with reporting duties; the speeches are the views of individual governors, not of the Board; the Treasury reports recommend next steps for agencies and the industry. For a company's own disclosures about these risks, see the filings stream, where several companies' risk factors name AI-enabled impersonation and payment fraud, and the explainer on how to read an AI risk factor.