Generative AI is changing the way we work, including the risks that come with it. Deepfakes—synthetic content that spans text, voice, images and video—are increasingly used to manipulate individuals and organizations into authorizing fraudulent payments and surrendering sensitive data.
52%
More than half (52%) of people have experienced a deepfake attack or scam that was aimed at stealing personal information or money.1
In this article, Vincent Meluzio from J.P. Morgan Payments and Douglas Wilbert from Accenture share practical strategies for how treasurers and technology leaders can safeguard their organizations against sophisticated digital threats.
The rise of AI deepfake fraud in payments
Deepfake fraud doesn't require a technical breach. No systems are hacked. No firewalls are compromised. Instead, fraudsters use AI-generated voices, faces and video to impersonate trusted figures.
Producing a convincing deepfake no longer requires technical expertise or significant resources. Off-the-shelf tools that are readily available and relatively cheap to use can clone a voice from seconds of audio or generate realistic video from a handful of images. The outputs are increasingly difficult to distinguish from reality.
Some types of authentication methods haven’t kept pace—not because the technology is unavailable, but because that technology is also advantageous to bad actors. Voice-based verification, once considered a reliable layer of security, is now vulnerable on its own. This isn’t an emerging threat; it’s an established gap that many organizations still haven’t closed.
The question isn’t whether you can trust the person on the other end of a call or video conference. It’s whether you have systems in place to verify that a payment instruction is legitimate before funds move to an unvalidated account. Trust, then verify—every time.
The cost of deepfakes: Real-world impact and trends
Deepfake schemes have targeted senior executives across industries through realistic audio and video:
- A multinational company lost $25 million when an employee transferred funds after receiving instructions from what appeared to be the company’s CFO on a deepfake video conference.2
- Fraudsters impersonated a European automaker’s CEO using AI-generated voice to push a fake acquisition deal, but an executive grew suspicious of subtle audio distortions and verified with a personal question—ending the call and the scheme instantly.3
The detection and prevention of deepfake fraud
Fraud risk is on the rise, yet 60% of surveyed financial institutions do not have a dedicated response plan with forensic tools to investigate agent-driven fraud4—the use of autonomous or semi-autonomous AI agents to deceive individuals, organizations or systems for financial gain. Most are still relying on basic procedures or standard workflows.
To defend against deepfake fraud, you need a layered technology approach that meets the threat at the critical window between when a payment is initiated and when it’s executed. This window is shrinking: as payment rails get faster, the opportunity to recall funds narrows or disappears entirely.
Behavioral analytics solutions monitor contextual parameters to detect patterns inconsistent with legitimate user behavior, flagging anomalies that the human eye might miss. Real-time validation systems verify payment details against authoritative sources before funds move. Phishing-resistant multifactor authentication reduces the risk of unauthorized access, even when credentials have been socially engineered. And zero-trust identity and access management assumes no implicit trust, continuously verifying identity, device and context for every request.
These technologies must evolve as fast as the threats they’re designed to counter. A static defense posture is a losing one. But technology is only part of the equation. It works best when complemented by fundamentals: knowing where to verify against an authoritative source, knowing what questions to ask and recognizing when something doesn't feel right.
A Culture of Vigilance
Even with advanced fraud-detection technology in place, your defenses are only as strong as the culture behind them:
-
Training and education: Help your people recognize the red flags that signal fraud—urgent requests, high-value transactions and directives that arrive at vulnerable moments like the end of day Friday or the day before a holiday.
-
Escalation protocols: Ground these in a simple principle: no one is above policy. Verifying a directive, even one that appears to come from the CEO, is not just acceptable but expected.
-
Employee empowerment: Give your people explicit permission to pause and question when something feels off. Hesitation is a feature, not a bug.
-
Crisis simulations: Pressure-test your deepfake threat response and evaluate decision-making in real time. These exercises expose gaps before a real attack does.
-
Red-teaming: Regularly test your AI systems for points of weakness, including the potential for your own tools to be misused to generate synthetic content.
-
Third-party due diligence: Extend your culture of vigilance beyond your own walls. If you don’t know how frequently your vendors are conducting cybersecurity training, running phishing tests and enforcing internal protocols, that’s a vulnerability.
Stronger defenses through collaboration
No single organization can solve the problem of deepfake fraud alone. By sharing intelligence, best practices and technology innovation, organizations can strengthen collective defenses in ways no one can achieve independently. Institutions that act early will be best positioned to stay ahead of the threat curve and protect their clients, their operations and their reputations.
Deepfake fraud will continue to evolve, and so must the defenses. Agentic AI, embedded real-time risk visibility and smarter payment architectures are already reshaping how payments are secured and monitored. In fact, 57% of banking IT executives expect AI agents to be broadly adopted or fully embedded in risk, compliance and fraud detection within three years.4
Now is the time to build payment systems that are not only intelligent but secure, transparent and resilient by design—and to ensure that every organization, regardless of size or industry, has the tools and knowledge to defend itself.
To learn how we’re helping organizations defend against deepfake fraud and other emerging threats, visit the Trust & Safety Hub for resources, case studies and expert guidance.
References
Disclaimer
© 2026 JPMorgan Chase & Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Deposits held in non-U.S. branches are not FDIC insured. Non-deposit products are not FDIC insured. The statements herein are confidential and proprietary and not intended to be legally binding. Not all products and services are available in all geographical areas.
Visit jpmorgan.com/paymentsdisclosure for further disclosures and disclaimers related to this content.
