For most of banking history, hearing someone’s voice was reasonable proof of who they were. That assumption held for decades and is now obsolete. A few seconds of recorded speech is enough to clone a voice convincingly — and that recording is often sitting in a public social media post.
What a Deepfake Is
A deepfake is synthetic audio, video or imagery generated by AI to imitate a real person. In a financial context the relevant forms are:
| Type | Used for |
|---|---|
| Voice cloning | Phone-based impersonation of family or bank officials |
| Video deepfake | Defeating video KYC and identity verification |
| Face swap in real time | Live video calls, onboarding checks |
| Synthetic documents | Fabricated identity and income proof |
| Synthetic identity | A wholly fabricated person built from mixed real and false data |
What changed is not that impersonation is possible — it always was. What changed is cost and skill. This once required expertise and equipment. It now requires a short audio sample and readily available tools.
The Common Scam Patterns
The distressed relative call
You receive a call from a family member’s voice. There has been an accident, or an arrest, or an emergency. Money is needed immediately, and there is a reason it cannot wait or be verified.
The voice is genuinely convincing because it is genuinely their voice, cloned from a video they posted. The urgency exists to prevent the one action that would defeat the scam — hanging up and calling back on a known number.
The executive instruction
An employee in finance receives a call or video call from a senior executive authorising an urgent transfer. Confidentiality is stressed, normal approvals are bypassed “given the circumstances”.
This targets organisations rather than individuals and has produced very large losses internationally. It works because it exploits hierarchy — junior staff are reluctant to challenge a convincing senior voice.
Video KYC defeat
Attackers use synthetic video to pass remote onboarding checks, opening accounts under stolen or fabricated identities. Those accounts then serve as mule accounts for moving fraud proceeds.
The fabricated endorsement
Deepfaked video of a recognisable public figure promoting an investment scheme. The scheme is fraudulent; the endorsement never happened. See Deepfake Fraud in Finance.
Why Old Defences Fail
| Traditional check | Why it no longer works |
|---|---|
| Recognising the voice | Cloning is convincing from seconds of audio |
| Video call to verify | Real-time face swap exists |
| Poor grammar as a phishing tell | Language models produce fluent text in any language |
| Generic message wording | Personalised messages generated at scale |
| Asking a personal question | Answers are often discoverable on social media |
The third row matters for Indian users specifically. Broken English was a reliable indicator of a scam message for years. That tell is gone — including in regional languages, where fluent generated text is now equally available.
What Still Works
The defences that survive share a common property: they do not rely on judging whether something looks or sounds authentic.
- Call back on a number you already have. Not a number the caller supplies. This single habit defeats nearly every voice cloning scam, because the attacker does not control the number stored in your phone.
- Agree a family code word. A word never shared online, used to verify identity in a genuine emergency. Low effort, and it cannot be cloned.
- Treat urgency as the warning sign itself. Legitimate financial matters survive a fifteen-minute delay. Manufactured urgency exists precisely to prevent verification.
- Verify through a different channel. If the request came by call, confirm by message or in person. An attacker rarely controls two channels.
- Never share an OTP, PIN or password. No legitimate bank employee will ask, however convincing they sound.
- Limit public voice and video. Every public clip is potential training material. This is not a reason to withdraw from social media, but it is a reason to consider what is publicly visible.
What Institutions Are Doing
| Defence | How it works |
|---|---|
| Liveness detection | Checks for signs of a real person present rather than a replay or synthesis |
| Challenge-response in video KYC | Randomised prompts a pre-recorded or synthetic feed cannot satisfy |
| Device and behavioural signals | Corroborates identity beyond appearance and voice |
| Multi-channel verification | Confirms high-value instructions through a second route |
| Synthetic media detection | Models trained to spot generation artefacts |
Detection is an arms race, and defenders are not clearly winning it. Generation improves continuously, and detection models trained on today’s artefacts degrade against tomorrow’s methods. This is why procedural controls — callbacks, second channels, code words — matter more than detection technology. They do not depend on being able to tell real from fake.
The Regulatory Backdrop
RBI’s Financial Stability Report recorded that major banks and NBFCs identified AI-enabled cyber threats as their biggest cyber risk over the following twelve months. The FREE-AI framework addresses AI risk in the financial sector broadly, and cybersecurity is among the existing master directions proposed for expansion to cover AI.
If You Have Been Targeted
- Contact your bank immediately through official channels — reporting speed affects liability for unauthorised transactions
- Report to the national cybercrime portal at cybercrime.gov.in
- Preserve evidence — call records, messages, transaction references
- Warn the person impersonated, since their voice or likeness may be reused
- Do not feel foolish. These attacks defeat careful people. That is the point of them.
Key Takeaways
- A deepfake is AI-generated audio, video or imagery imitating a real person
- What changed is cost and skill — seconds of public audio is enough to clone a voice
- Main patterns: distressed relative, executive instruction, video KYC defeat, fake endorsement
- Recognising a voice is no longer verification
- Poor grammar is no longer a reliable scam indicator, in English or regional languages
- Call back on a number you already have — the single most effective defence
- A family code word costs nothing and cannot be cloned
- Manufactured urgency is itself the warning sign
Frequently Asked Questions (FAQ)
Q: What is deepfake fraud?
Deepfake fraud uses AI-generated audio, video or imagery to impersonate a real person for financial gain — cloning a family member’s voice to request emergency money, or using synthetic video to pass identity verification checks.
Q: How much audio is needed to clone someone’s voice?
Modern tools can produce convincing results from a very short sample — seconds rather than minutes. Publicly posted videos, voice notes and recorded calls all provide adequate material, which is what makes this so widely available to attackers.
Q: How can I tell if a call is a voice clone?
Increasingly you cannot, reliably. Rather than trying to detect it, use a procedure that does not depend on detection — hang up and call back on a number you already have stored, or verify through a completely different channel.
Q: What is a family code word and does it help?
A word agreed in advance among family members, never shared online, used to confirm identity during an emergency request. It is highly effective because it cannot be discovered or cloned, and it costs nothing to set up.
Q: Can deepfakes defeat video KYC?
It is a real and recognised attack vector. Institutions counter it with liveness detection and randomised challenge-response prompts that pre-recorded or synthetic feeds struggle to satisfy, but this remains an arms race rather than a solved problem.
Q: Is bad grammar still a reliable sign of a scam message?
No. Language models produce fluent text in English and Indian regional languages, so that indicator has effectively disappeared. Judge messages on what they ask for — urgency, secrecy, credentials, immediate transfer — rather than on how well written they are.
Q: What should I do if I have been defrauded?
Contact your bank immediately through official channels, since liability for unauthorised electronic transactions depends on how quickly you report. File a complaint on the national cybercrime portal at cybercrime.gov.in and preserve call records, messages and transaction references.
Q: Are banks doing anything about deepfake fraud?
Yes — liveness detection, challenge-response in video KYC, device and behavioural signals, and multi-channel verification for high-value instructions. RBI’s Financial Stability Report recorded that banks and NBFCs regard AI-enabled cyber threats as their biggest cyber risk.
Related Reading: