The New Face of Fraud: Why Your Operational Risk Framework Must Evolve for the Age of Deepfakes

Editorial — Risk & Compliance Radar, September 2026 Edition (Auronova)

The rapid democratization of generative AI has transformed deepfake technology from a novelty into a serious operational risk. The February 2024 Arup incident offered a stark demonstration of what is now possible: a Hong Kong-based employee was deceived by AI-generated avatars of senior management during a video conference and authorized 15 fraudulent transfers, resulting in a loss of approximately $25 million.

The incident was particularly striking because no conventional system was hacked — the fraudsters exploited trust.

This represents a fundamental shift in fraud. Attackers are increasingly targeting human judgment, organizational authority and digital trust, rather than simply exploiting technical vulnerabilities.

The Sophistication Shift in Fraud

Fraud is evolving not only in scale, but in sophistication. Sumsub's 2025–2026 Identity Fraud Report highlights a 180% year-over-year increase in sophisticated fraud, roughly one in two companies have been hit by deepfake fraud, costing businesses an average of almost $450,000 per incident. The total financial losses associated with deepfakes reached $1.56 billion, with over $1 billion occurring in 2025 alone.

The significance is clear: fraudsters no longer need to rely on poorly constructed phishing emails or easily detectable fake identities. Generative AI enables them to create convincing voices, images, videos and synthetic identities at increasing speed and scale.

The threat is no longer emerging — it is operational.

Three Threat Vectors for Financial Institutions

Defeating Biometric Authentication: AI-generated images, video and voice can challenge facial and voice recognition systems used for onboarding and authentication. As synthetic media becomes more convincing, institutions cannot assume that biometric or visual evidence is inherently trustworthy.

Social Engineering and Impersonation: Deepfakes supercharge traditional social engineering by allowing fraudsters to convincingly impersonate senior executives, customers or trusted counterparties. The Arup case illustrates how authority and urgency can override otherwise sensible controls.

Misinformation and Disinformation: Convincing fake videos or audio of executives can spread false information, damage reputations and potentially influence markets or investor confidence.

Why Traditional Risk Frameworks May Fall Short

Traditional operational risk frameworks were largely designed around the assumption that seeing and hearing provide reliable signals of identity and authority. Deepfakes challenge that assumption.

Firewalls, MFA and encryption remain essential controls, but they may not prevent an attack that exploits psychology rather than infrastructure. A deepfake-enabled fraud can occur through legitimate communication channels and involve an authorized employee performing an apparently legitimate action.

This creates challenges across traditional risk categories, including External Fraud, Clients, Products and Business Practices, and Business Disruption. It can also create ownership gaps between fraud risk, cybersecurity, operational risk, technology and business functions.

The fundamental issue is therefore not simply a technology failure — it is a control-design failure.

Rethinking the Operational Risk Framework

Institutions should consider five priorities:

Recognize Deepfake Risk: Include deepfake-enabled social engineering and synthetic identity fraud within enterprise risk assessments and risk registers. Scenarios should be considered for severe-but-plausible operational risk testing.
Redesign Verification Protocols: High-risk transactions should never depend on a single communication channel. Independent callbacks, pre-established verification procedures and multi-person authorization can provide additional safeguards. Most importantly, established controls should not be overridden simply because a request appears to come from a senior executive.
Use Detection as One Layer of Defense: Institutions should evaluate technologies such as liveness detection, media forensics and watermarking or fingerprinting. However, detection alone cannot be the primary control in a rapidly evolving threat environment. Layered controls remain essential.
Build a Culture of Verification: Employees should be empowered to pause and verify unusual requests, even when they appear urgent or come from senior personnel. Requests involving secrecy, private communication channels, unusual payment instructions or pressure to bypass established procedures should trigger additional scrutiny.
Manage the Digital Footprint: Organizations should assess how much high-quality executive imagery, video and audio is publicly available and could potentially be misused to create synthetic media. Third-party vendors should also be considered, particularly where weaker controls could create an indirect attack pathway.

Beyond Fraud: Model Risk and AI Governance

The implications extend beyond fraud. Deepfakes and synthetic identities can also affect AI-driven onboarding, fraud monitoring and transaction-screening systems by compromising the quality or authenticity of inputs. Institutions therefore need to consider synthetic-media threats within AI governance, model risk management and validation frameworks.

For risk practitioners, the question is not whether your organization will encounter a deepfake attack, but whether your frameworks will hold when it does.

Originally published in the Risk & Compliance Radar Monthly Newsletter, September 2026 Edition, by Auronova.