The face on the screen looks real. The voice sounds familiar. The video is convincing. But it is not who you think it is.
1,500%
Rise in deepfake files
2023 to 2025
2,100%
Increase in deepfake
fraud attempts
24.5%
Human detection rate
for deepfake video
46s
Between fraud attempts
in contact centres
Deepfake technology — synthetic media generated by artificial intelligence — has crossed from novelty into mainstream threat. In 2026, it is no longer a question of whether your organisation will encounter AI-generated fraud. It is a question of whether you are prepared when it does.
The Numbers Are Not Reassuring
The scale of the problem has grown faster than most organisations have been able to respond to it.
Deepfake files surged from 500,000 in 2023 to an estimated 8 million by 2025 — a 1,500% increase in just two years. Fraud attempts involving deepfakes have climbed by over 2,100% across the same period. In the United States alone, deepfake-related fraud losses reached $1.1 billion in 2025, triple the figure from 2024.
For businesses and security teams, the most confronting statistic may be this: human beings can correctly identify a high-quality deepfake video only 24.5% of the time. In a world where fraud attacks now occur every 46 seconds in contact centres, that detection gap is not an inconvenience. It is a structural vulnerability.
What makes the current moment particularly challenging is that the tools to create this content have become cheap, fast, and widely accessible. Deepfake-as-a-service platforms now allow cybercriminals with no specialist technical knowledge to clone voices, fabricate video, and create synthetic personas at scale. Just three seconds of audio is enough to generate an 85% accurate voice clone. AI-generated phishing emails now achieve a 54% click-through rate, compared to 12% for manually crafted attempts.
What Deepfake-Enabled Fraud Actually Looks Like
Understanding the threat means understanding the attack vectors. There are several that security professionals and business leaders should be actively monitoring.
🎭
Identity Verification Bypass
Deepfakes now account for 40% of all biometric fraud attempts. Attackers use AI-generated video and face-swap technology to impersonate legitimate users during identity checks — defeating liveness detection and static biometric systems not designed to contend with this level of synthetic realism. In 2025, one in 20 identity verification failures was linked to deepfake usage.
📹
Executive Impersonation & BEC
AI-powered deepfakes were involved in over 30% of high-impact corporate impersonation attacks in 2025. Employees receive video calls from apparent executives authorising urgent payments. Finance teams receive voice messages that sound indistinguishable from their CFO. The fraudulent instruction feels legitimate because the face and voice are, for all practical purposes, real.
👤
Synthetic Identity Fraud
Fraudsters are combining real and fabricated personal information to construct entirely new identities. These synthetic personas are used to open accounts, access services, and commit fraud at scale — often going undetected for months because no genuine victim exists to raise an alert.
🤖
AI Fraud Agents
An emerging and particularly concerning development involves autonomous AI agents that can conduct multi-step fraud attacks — submitting deepfake verification attempts, adjusting minor variables, and re-attempting until they succeed — all without human involvement. Analysts expect 2026 to see a significant rise in this type of automated, coordinated fraud.
Why Traditional Identity Verification Is Struggling
The core challenge facing most organisations is architectural. Traditional identity verification relies on collecting and storing sensitive identity documents — copies of passports, licences, and biometric data held in centralised databases. This creates two compounding problems.
First, those databases are targets. The more identity data an organisation stores, the more attractive it becomes to attackers. A single breach can expose thousands or millions of records, each one a tool for future fraud.
Second, the verification methods built around those systems were not designed for AI-generated adversaries. Static document checks, knowledge-based authentication, and even many liveness detection systems were developed when the primary threats were poorly edited images and human actors. Generative AI has rendered many of those defences obsolete faster than organisations have been able to update them.
Gartnerhas predicted that 30% of enterprises will no longer consider standalone identity verification solutions reliable in isolation by 2026 — noting that traditional tools increasingly struggle to determine whether the person being verified is genuinely present.
The Architectural Shift: “Nothing Stored Is Nothing Stolen”
The most effective response to deepfake-enabled identity fraud is not simply adding more detection layers on top of a fundamentally vulnerable model. It is rethinking the model itself.
The Core Principle
"If sensitive identity data is never centralised, it cannot be exfiltrated or weaponised at scale."
This is the philosophy at the foundation of BlueKee — a digital identity platform built on the principle that identity verification does not require identity storage. BlueKee’s approach inverts the conventional model: rather than organisations collecting and holding user identity data, verified identity lives on the user’s own device, under the user’s control. Organisations receive the verification confirmation they need. The underlying data never leaves the individual’s hands.
How BlueKee Works
BlueKee is available as a standalone consumer app and as an SDK that can be embedded directly into an organisation’s existing mobile application — meaning the verified identity experience lives inside the tools your customers and employees are already using.
The setup process takes under three minutes. A user verifies their identity once, completing a biometric multi-factor authentication process on their own device. That verified identity can then be reused across any channel or use case that requires it — without the user or the organisation needing to repeat the verification process, and without sensitive documents being transmitted or stored.
-
✓Device-bound biometric authentication Because verification is anchored to a physical device and the biometrics of the individual who set it up, it is significantly harder to spoof with a synthetic persona or deepfake. The attack surface that AI fraud agents typically exploit is removed from the equation.
-
✓Zero data storage on BlueKee's side BlueKee stores no user identity data — independently noted by CyberCX's Privacy Lead, David Batch, as "quite an incredible feat." This is also why BlueKee won the Privacy by Design Award 2024, presented by CyberCX and the Tech Council of Australia.
-
✓Reusable, portable identity Once a user is verified, that verification travels with them. Banks, insurers, managed service providers, government agencies, and BPO operations can all benefit from the same verified identity — each interaction confident and frictionless.
-
✓User control and consent Individuals choose when and with whom to share their verified identity. This shifts the privacy risk profile away from organisations and returns autonomy to the individuals the system is built to serve.
Relevant Across the Sectors Most Exposed to Deepfake Fraud
The deepfake threat is not evenly distributed, but it is broadly felt. Several sectors face particularly acute exposure:
Banking & Finance
AI-assisted impersonation increasingly bypasses KYC checks and authorises fraudulent transactions. BlueKee’s SDK embeds directly into banking apps.
BPO & Call Centres
Fraud attempts every 46 seconds on average. Voice cloning has made voice-based caller authentication unreliable.
MSPs & IT Help Desks
Frequent social engineering targets. Deepfake executive calls authorising system changes are a known attack vector.
Insurance
Mounting losses from synthetic identity fraud and AI-generated claims. Biometric onboarding closes the entry point.
Government Services
BlueKee’s privacy-by-design architecture aligns with data minimisation requirements and individual rights legislation.
What Security Professionals Should Be Asking Right Now
For IT and cybersecurity teams evaluating their organisation’s exposure to AI-driven identity fraud, several questions are worth working through:
- Q1 Does your current identity verification process depend on centralised storage of identity documents? If so, that database is a target — and its contents can be used to construct synthetic identities or enrich deepfake attacks.
- Q2 Can your liveness detection distinguish a high-quality deepfake video from a genuine user? Given that only 24.5% of humans can make that distinction reliably, systems that depend on behavioural or visual detection alone are increasingly insufficient.
- Q3 How does your organisation verify the identity of a caller, requester, or applicant when they are not physically present? Remote verification is now the standard mode — and the one most exposed to deepfake and voice cloning attacks.
- Q4 Is your verification architecture building liability with every document you store — or eliminating it by keeping data off your systems entirely?
Conclusion: The Threat Is Here. The Architecture Needs to Match It.
Deepfakes are no longer a theoretical risk. They are an operational one, active across every sector that depends on knowing who it is dealing with. The tools to create convincing synthetic identities are cheap, accessible, and improving rapidly. The tools to detect them are struggling to keep pace.
The organisations best positioned to manage this threat are not necessarily those with the largest fraud detection budgets. They are the ones who have rethought the underlying architecture — who have recognised that collecting and storing sensitive identity data creates a liability that no amount of monitoring can fully mitigate.
BlueKee was built precisely for this moment. Not because identity verification was an interesting market, but because the consequences of getting it wrong are real, personal, and lasting. The principle is simple: nothing stored is nothing stolen.
Ready to rethink your identity architecture?
See how a privacy-by-design approach to verified identity changes the equation for your organisation.
