A finance employee in Hong Kong arrived at work on a Tuesday morning in February 2024. He received a message asking him to join a video call with his company’s CFO and several other senior executives. The call looked normal. The CFO looked like the CFO. The voices sounded right. Other faces from the team sat in their usual grid squares on the call.
He authorized fifteen transactions over the course of the call. The total came to HK$200 million — roughly $25 million US dollars.
Every person on that video call except him was a deepfake.
The CFO had never sent that message. The other executives had never been on that call. For the whole meeting, the employee had been talking to AI-generated video overlays. They were real-time deepfakes, built from publicly available footage of the actual executives. The South China Morning Post and BBC both covered the case. It remains the largest documented single instance of deepfake-enabled fraud.
The short answer. A deepfake is AI-generated video or audio that puts a real person’s face or voice onto a fraudster. Criminals use it to pass bank KYC checks and open accounts in your name. They also use it to impersonate a boss on a live video call and authorize a transfer. It takes as little as one good photo of your face, which they pull from LinkedIn, social media, or a data breach. This is not theoretical. It is happening, it is getting easier, and the source material the attackers need (your face) is almost certainly already out there. The defense is out-of-band verification, tighter liveness checks, and reducing the high-resolution photos of you that are public.
How a deepfake is made, and why it only takes one photo
The intimidating word “deepfake” obscures how accessible the technology has become. You do not need a supercomputer or a Hollywood visual effects team. You need a laptop, a webcam, an internet connection, and one decent photograph of the target.
Tools like DeepFaceLive are open-source and available on GitHub. DeepFaceLab — another widely used tool — has been downloaded millions of times. A person with basic technical literacy can install these in an afternoon and be running a real-time face swap over a webcam feed by evening. The deepfake overlay runs live, replacing the fraudster’s face with the victim’s face as it is captured frame by frame.
The source material requirement is minimal. A single high-resolution photograph of your face is often enough to generate a convincing model. That means the kind you post to LinkedIn, Instagram, or Facebook as a profile photo. If more images are available from different angles, the result improves. If video of you talking exists online, lip movement and micro-expression matching becomes more convincing still.
This is why your public photos are not just harmless social content. They are training data for attacks against you.
The KYC bypass: how your bank’s identity check became an attack surface
Know Your Customer verification is how Indian banks, fintechs, payment platforms, and telecom operators confirm you are who you say you are. It runs before you open an account or activate a SIM. For years, KYC relied on in-person document submission. The shift to digital infrastructure moved much of this online, and introduced a new attack surface.
Video KYC, now common across Indian fintech and banking, requires a live video session where the customer shows their face alongside a government-issued ID. The premise is that a live video cannot be faked. A fraudster cannot simply send a photograph.
That premise no longer holds.
To a video KYC system, a fraudster running a deepfake overlay on their webcam appears as a live person. Their face, which is the victim’s face, moves naturally. The liveness check that asks the user to blink does not stop a sophisticated deepfake tool. The AI generates the blink in real time. Head-movement prompts were introduced precisely to catch static image injection attacks. But tools that track the fraudster’s own head and apply the movement to the overlay defeat them too.
The Reserve Bank of India issued an advisory in 2023 warning that AI-generated faces were being used to bypass video KYC. The RBI mandated stricter liveness detection in response. The problem is structural. Liveness detection and deepfake generation are in a technical arms race. At the consumer-facing scale where most KYC checks happen, deepfake tooling currently keeps pace with or exceeds detection.
Here is the full shopping list to open a bank account in your name. One photo of your face, from your social media or a data breach. Your name and address, from data broker sites. Your PAN or Aadhaar number, from a breach or data broker. And a webcam with a deepfake overlay running. The video KYC session then confirms their identity as yours. A bank account opens under your credentials. They withdraw, transfer, or use it as a layer for other fraud. You find out months later, when something goes wrong with your credit or a notice arrives from an institution you never signed up with.
The executive impersonation attack, scaled down to your organization
The HK$200 million case was notable for its scale, but the mechanism works at any level of an organization. The attack exploits two things that are universally true: people trust familiar faces on video calls, and video calls have become the default medium for time-sensitive decisions.
An attacker targets a mid-level employee at a company. They identify who the employee reports to by checking LinkedIn. They find video of that manager — recorded webinars, conference talks, company YouTube videos, media appearances. They build a deepfake model from that footage. Then they impersonate the manager’s email address, send an urgent request for a call, and conduct the meeting as the manager’s face.
The request during the call is for something within the employee’s authority: a wire transfer, an approval for a purchase, credentials to an internal system. The employee sees their boss. They comply.
Real-time deepfake tools have reduced the technical overhead of this attack significantly. The gap between “sophisticated nation-state capability” and “available to organized criminal groups” has closed substantially.
Synthetic identities: the face that never existed
A parallel threat sits alongside deepfakes of real people: AI-generated faces of people who do not exist.
StyleGAN, the generative model behind sites like thispersondoesnotexist.com, produces photorealistic human faces that belong to no real person. These can be used to create entirely synthetic identities — faces paired with AI-generated names, AI-scraped backstories assembled from real people’s social media, and fabricated identity documents.
Synthetic identity fraud is not new, but AI has substantially lowered the quality threshold for a convincing fictional person. A synthetic identity built with AI-generated imagery can open bank accounts, apply for loans, and build credit history over months. It then “busts out,” maxing credit lines and disappearing, with no real person ever involved.
The organizations bearing the cost are lenders, banks, and payment platforms. Individuals whose real data was scraped to build the synthetic backstory may find their details associated with fraudulent accounts they never opened.
Non-consensual deepfakes and the targeting of women in India
The identity fraud dimension of deepfakes is severe. The harm extends further.
In November 2023, a deepfake video depicting Bollywood actress Rashmika Mandanna circulated widely on social media in India. The video used AI to place her face on another person’s body. It spread before any platform removed it. The incident triggered a public response at the highest level: Prime Minister Modi publicly condemned deepfakes and called for regulatory action within weeks of the video going viral.
The broader data on this category of harm is stark. A 2019 Sensity AI report found that 96% of deepfake videos online were non-consensual pornography, and 99% of those targeted women. The absolute numbers have grown substantially since that report was published, as the tools have become more accessible and the barrier to creating this content has dropped.
In response, India’s IT (Amendment) Rules 2023 explicitly prohibit deepfakes that impersonate individuals. Violations can result in criminal prosecution under the Information Technology Act. The Ministry of Electronics and IT (MeitY) issued advisories in November 2023 following the Rashmika Mandanna case. Those advisories direct platforms to take down such content within 24 hours of being notified.
Tools like FaceSwap and Roop — both open-source — can execute a face swap on video in minutes on a consumer laptop. The regulatory framework exists. Enforcement at scale, and platform compliance at speed, remain ongoing challenges.
Where attackers get your face
The supply chain for deepfake attacks runs through the same places your data has always leaked from — social media, data breaches, and data brokers.
LinkedIn headshots are high-resolution, professionally lit, and frequently updated. They are the deepfake attacker’s first stop for targeting professionals. A LinkedIn headshot is often better source material than anything else publicly available.
Instagram and Facebook profiles regularly contain dozens of photos of the same face from different angles, in different lighting, in motion. Public profiles are trivially scraped. Even private profiles have profile photos that are accessible without authentication on many platforms.
Data breaches compound the problem. The MobiKwik breach exposed KYC data including selfies. The BigBasket breach included personal information. KYC breaches are particularly damaging because the images submitted for identity verification are explicitly passport-quality photographs of your face, often alongside your Aadhaar number, PAN, and address.
Data broker sites are the people-search platforms that aggregate your name, address, phone number, email, and relatives. They sometimes include photographs scraped from social media alongside contact records. This creates a one-stop shop: face, name, address, and phone number together on a single results page.
Detecting deepfakes: what works and what doesn’t
Current detection tools include Microsoft’s Video Authenticator, Intel’s FakeCatcher, and enterprise platforms like Sensity AI. FakeCatcher analyzes blood-flow patterns in facial video. Real faces show microvascular movement that deepfakes do not replicate well. For a walkthrough of spotting fakes yourself, see the guide to deepfake video verification.
Human detection is unreliable without training. The tells are subtle: unnatural blinking, artifacts at the hairline where the overlay meets the background, lighting inconsistencies, and a slight lag between speech and lip movement. On a normal video call, these signals are easy to miss.
Algorithmic detection is better but not conclusive. Detection tools improve alongside the generative tools, and the most sophisticated deepfakes today outpace publicly available detection calibrated against last year’s attacks.
The structural answer for banks and fintechs is layering. Use randomized liveness challenges that require unpredictable responses. Add hardware-backed device attestation that binds a video KYC session to a specific device, not just the video stream. And run AI-powered detection as a parallel layer rather than the sole check.
What institutions and individuals can do
For financial institutions, the path forward is defense in depth. Liveness checks that ask for random actions — not just a blink, which is the most commonly trained-against prompt — reduce the effectiveness of current deepfake tools. Device binding, where a video KYC session is cryptographically tied to a registered device, makes remote deepfake injection substantially harder. AI detection as a layer alongside human review catches attacks that pass automated checks but exhibit artifacts a trained analyst notices.
For individuals, the levers are different but real.
Limit high-resolution photos of your face on public profiles. This is not about disappearing — it is about reducing the quality of source material available for training a model against you. A low-resolution thumbnail is harder to work with than a professionally lit headshot. Your LinkedIn photo does not need to be your best image; it needs to communicate professionalism, not provide biometric-quality data.
Enable privacy settings on Instagram and Facebook to restrict who can download or save your images. On Instagram, the “Private Account” setting requires approval for new followers. On Facebook, granular controls in the privacy settings allow you to restrict your photos to friends rather than public.
You may believe you’ve been targeted by a deepfake, whether for fraud, non-consensual content, or impersonation. In India, the reporting path runs through CERT-In and the National Cyber Crime Reporting Portal at cybercrime.gov.in. Under the IT (Amendment) Rules 2023, platforms have a removal obligation. Document the incident before reporting, including screenshots and URLs.
Set up a Google Alert for your full name. It takes two minutes and surfaces mentions of your name across the web. That sometimes includes unauthorized use of your image or identity on sites you’d never find through normal browsing.
Finally, understand that the data feeding these attacks — your name, phone number, address, photographs — is aggregated and sold by data broker sites. These sites collect publicly available information, bundle it, and surface it in a format that makes building a profile of you trivially easy. Removing your records from these sites reduces your exposure surface. A fraudster who has to work to find your address and phone number alongside your face is a fraudster who may move to an easier target.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.