AI Deepfakes to BEC: The New Wave of Tech Scams Costing Billions

In one of 2024’s most alarming incidents, a Hong Kong finance worker was duped into sending approximately $25 million after joining a video meeting where every “colleague” on screen—including the CFO—was a convincing deepfake. This single case illustrates how fast AI-enabled fraud is evolving and why losses remain staggering: the FBI’s Internet Crime Complaint Center (IC3) logged $12.5 billion in reported cybercrime losses in 2023 alone, with Business Email Compromise (BEC), investment scams, and tech support fraud leading the way. Organizations and families alike now face threats that blend social engineering, stolen credentials, and AI-generated audio/video at unprecedented scale.

AI Deepfake Scams (Celebrity Impersonation, Fake Video Calls)

Recent Cases and Financial Impact

– Hong Kong deepfake heist (2024): A finance employee wired around $25 million after a video meeting featuring deepfaked executives and coworkers (case widely reported by international media).
– FBI IC3 (2023): Reported cybercrime losses reached $12.5 billion, underscoring escalating social engineering risks enhanced by AI.
– Verizon 2024 DBIR: 68% of breaches involved the human element—errors, social engineering, or misuse—making deepfakes especially dangerous as a persuasion multiplier.

How This Scam Works

• Recon: Criminals scrape public profiles, interviews, earnings calls, and social media to capture voices, mannerisms, and background details.
• Modeling: They train AI models to clone voices and faces or generate realistic avatars.
• Pretext: Targets receive urgent messages (e.g., “Join this confidential call” or “We must finalize a secret deal”).
• Execution: On a live video call, deepfaked executives instruct rapid wire transfers, share “confidential” vendor details, or demand gift cards/crypto.
• Cashout: Funds move through mule accounts or crypto mixers to obfuscate traces.

Warning Signs

• Unexpected, high-stakes video invitations that bypass normal scheduling or approval channels.
• Odd lip-sync, eye blink patterns, or unnatural delays in responses—especially during “urgent” money requests.
• Requests to keep the transaction secret or off standard systems.
• “Executive” refuses independent call-backs on known numbers or declines a second authentication channel.

Protection Strategies

• Out-of-band verification: For any money move or password reset initiated on a call, confirm via a separate channel (known phone number, in-person, or secured chat).
• Video call safe words: Establish a rotating code phrase for high-risk approvals known only to core finance/security staff.
• Disable auto-join: Require host approval, waiting rooms, and visual watermarks on recordings to deter spoof reuse.
• Security awareness: Train staff to pause and verify when “urgent” requests appear on live video, especially if they break policy.

Business Email Compromise (CEO Fraud, Vendor Impersonation)

Recent Cases and Financial Impact

– FBI IC3 (2023): BEC caused about $2.9 billion in reported losses across 21,489 complaints.
– IBM Cost of a Data Breach 2024: The global average breach cost reached approximately $4.88 million, showing the wider impact of account compromise and email takeover beyond a single fraudulent transfer.

How This Scam Works

• Credential theft: Attackers phish or brute-force email logins, then monitor mailbox activity.
• Thread hijacking: Criminals reply inside real email threads, alter invoices, or register lookalike domains.
• Payment redirection: They swap bank details on invoices or send “urgent CEO” requests to finance staff.
• Cashout and laundering: Funds move through mule networks or crypto to reduce recovery chances.

Warning Signs

• Last-minute banking changes without prior notice via known channels.
• Subtle domain misspellings (e.g., rn vs. m) or newly created supplier domains.
• Unusual tone, grammar, or timing from known executives or vendors.
• “Do this now and don’t call me” pressure that discourages verification.

Protection Strategies

• Payment control policy: No vendor banking changes without dual approval and an out-of-band callback to a verified phone number on file.
• Email security: Enforce MFA, conditional access, and phishing-resistant authentication for all finance and executive accounts.
• Inbox hygiene: Disable auto-forward rules, alert on new rules, and log impossible travel or atypical login locations.
• Vendor management: Maintain a verified contact registry; require signed change forms and cooling-off periods before any new payment method is used.

Tech Support Fraud (Fake Microsoft/Apple Calls, Remote Access)

Recent Cases and Financial Impact

– FBI IC3 (2023): Tech support fraud yielded over $1.3 billion in losses across 37,000+ complaints.
– FBI Elder Fraud (2023): Victims 60+ reported $3.4 billion in total losses; tech support schemes disproportionately harmed older adults.

How This Scam Works

• Initial contact: Pop-up warnings or cold calls claim your device is infected or your bank account compromised.
• Social engineering: The scammer poses as Microsoft, Apple, your bank, or law enforcement to build trust.
• Remote access: They request installation of remote software to “fix” the issue, then simulate problems and move funds.
• Money movement: Victims are guided into sending wires, buying gift cards, or transferring crypto to “secure” accounts.

Warning Signs

• Unsolicited calls/pop-ups claiming urgent device or banking issues.
• Pressure to install remote access tools or to bypass bank procedures.
• Requests for gift cards or crypto to resolve a supposed emergency.

Protection Strategies

• Never call numbers in pop-ups; use the official support site or card-back numbers.
• Bank safety phrase: Set up a known phrase for phone verifications; hang up and call your bank via the number on your card.
• Remote access lockdown: Only allow remote tools after verifying a support ticket you opened.
• Device hygiene: Keep OS, browsers, and AV up to date; block known scam domains and enable DNS filtering.

Cryptocurrency Schemes (Fake Investment Platforms, Crypto Draining)

Recent Cases and Financial Impact

– FBI IC3 (2023): Investment fraud led losses at about $4.57 billion, with a substantial share tied to crypto-related schemes, including “pig butchering.”
– Elder impact (2023): Many 60+ victims reported high-dollar crypto investment losses as part of the broader $3.4 billion elder fraud total.

How This Scam Works

• Romance or networking hook: Scammers build rapport via dating apps or social platforms.
• Fake platforms: Victims are steered to slick but fraudulent apps/sites showing fake “gains.”
• Deposit escalation: Small withdrawals “work,” then larger deposits are pushed; withdrawals suddenly fail.
• Drainers and approvals: Wallet “approval phishing” silently authorizes scammers to move assets later.

Warning Signs

• New online contact discussing trading “opportunities” within days.
• Pressure to move funds off reputable exchanges to little-known platforms.
• Demands for more deposits to unlock withdrawals, “taxes,” or “security fees.”

Protection Strategies

• Third-party validation: Before investing, check platforms with regulators (SEC Investor.gov, state regulators) and independent security reviews.
• Wallet permissions: Regularly audit token approvals; revoke unneeded permissions with trusted tools.
• No rush: Legitimate investments don’t force secrecy, timed bonuses, or off-platform payments.
• Cold storage best practices for long-term holdings; enable hardware wallet confirmations and phishing-resistant 2FA.

Romance/Social Engineering (Dating App Fraud, Pig Butchering)

Recent Cases and Financial Impact

– FTC (2023): Romance scams accounted for about $1.14 billion in reported losses; the median individual loss was roughly $4,400.
– FBI IC3 (2023): The human element remains central across scams; older adults endured high-dollar romance-investment crossovers.

How This Scam Works

• Trust-building: Weeks or months of chats establish intimacy and dependence.
• Crisis or opportunity: Scammer introduces a medical, travel, or investment emergency.
• Isolation: Victims are urged to keep the relationship secret and avoid advice from friends/family.
• Escalation: Requests shift from gift cards to wire transfers and crypto with increasing urgency.

Warning Signs

• Refusal to meet on video or inconsistencies in stories/timelines.
• Immediate talk of money, crypto, or investment schemes.
• Emotional manipulation tied to secrecy and urgency.

Protection Strategies

• Verify identities through live, unscripted video chats; reverse-image search profile photos.
• Never move money for someone you have not met in person and verified.
• Involve a trusted friend to sanity-check any request for funds.

Phishing Evolution (AI-Generated Emails, Smishing, Vishing)

Recent Cases and Financial Impact

– Verizon 2024 DBIR: 68% of breaches involve the human element; stolen credentials continue to be a leading factor in breaches.
– FBI IC3 (2023): Overall cybercrime reports reached 880,000+ complaints, with phishing and related social engineering driving initial access.

How This Scam Works

• AI-crafted messages: Attackers generate fluent, personalized emails/texts with few grammar tells.
• Multi-channel orchestration: Email plus SMS/voice prompts victims to click, read OTPs aloud, or install malware.
• Session hijacking: Stealers capture cookies or MFA codes to bypass logins.

Warning Signs

• Unexpected password resets or security alerts that demand immediate action.
• Links that resolve to lookalike domains; shortened URLs masking the destination.
• Requests for MFA codes by phone, chat, or email.

Protection Strategies

• Phishing-resistant authentication: Prefer FIDO2/passkeys or security keys over SMS codes.
• URL discipline: Hover to preview links; type sensitive URLs directly into the browser.
• Browser isolation and email link sandboxing for high-risk roles (finance, HR, IT).
• Credential hygiene: Unique passwords in a manager; monitor for stolen creds and auto-rotate where supported.

Industry Expert Insights

– Human factor remains the primary risk: Verizon’s 2024 DBIR attributes 68% of breaches to human-driven factors, reinforcing that training and process controls are as critical as tools.
– The high-dollar concentration persists: FBI IC3 (2023) shows BEC (~$2.9B), investment fraud (~$4.57B), and tech support fraud (~$1.3B) dominating losses—attacks that combine social engineering with credential theft.
– Older adults are disproportionately impacted: The FBI’s Elder Fraud report (2023) records $3.4B in losses among victims 60+, an average loss of about $33,915, and thousands losing over $100,000—highlighting the need for tailored education and bank safeguards.
– Deepfakes are operational, not just theoretical: The Hong Kong deepfake case demonstrates criminals can convincingly simulate entire teams on live video, accelerating decision-making under pressure. Expect more synthetic media in voice calls, voicemail, and short video clips, especially during quarter-end finance processes.

Immediate Action Steps

• For General Consumers: Enable passkeys or security keys where available; freeze your credit; set bank alerts for transactions over a chosen threshold; never call numbers in pop-ups.
• For Business Owners: Enforce MFA everywhere, especially for finance and executive email; implement dual-control and out-of-band callbacks for any payment change or wire; log and alert on mailbox rule changes; run quarterly deepfake drills for finance.
• For Elderly Users and Caregivers: Use a family “verification code” for any money request by phone/text; call your bank only via the number on your card; pre-authorize a trusted contact at your bank to flag unusual transfers; never install remote tools unless you initiated the support ticket.
• For Tech-Savvy Readers: Deploy phishing-resistant MFA (FIDO2), conditional access policies, and hardware-backed device compliance; enable DMARC/DKIM/SPF and monitor for lookalike domains; review wallet approvals regularly; use passwordless sign-in and session protection.

Conclusion

Scammers are moving faster than ever—now armed with AI voices, faces, and fluent messages that can pressure even experienced professionals into costly mistakes. The most effective defense is layered: verification across independent channels, strict payment controls, phishing-resistant authentication, and continuous education tailored to who is most at risk. Whether you’re approving a vendor change, helping a parent with a “bank security” call, or evaluating a “can’t-miss” crypto play, take a pause, verify through a trusted path, and make the attacker do the extra work. That’s usually where their script breaks.