Deepfake fraud: what Europe changes in 2026

The largest known case hit the British engineering group Arup. In January 2024 an employee in its Hong Kong office joined a video call in which the chief financial officer and other colleagues were deepfakes, and then transferred HK$200 million, about US$25.6 million. Arup confirmed the case in May 2024, as CNN reported.

In May 2024 fraudsters set up a Microsoft Teams meeting in the name of Mark Read, chief executive of the advertising group WPP, with a fake WhatsApp account, a cloned voice and YouTube footage of him, The Guardian wrote, but the attempt failed. In July 2024 a Ferrari executive received WhatsApp messages and then a call in which a cloned voice of chief executive Benedetto Vigna spoke about a confidential acquisition. The executive asked which book Vigna had recently recommended to him, and the caller hung up, according to a Bloomberg report.

Switzerland has seen the same pattern: the Federal Office for Cybersecurity reported in April 2024 an attempt in which criminals used deepfakes to pose as a chief executive in an online meeting.

In banking, deepfakes show up at two points of the customer relationship. At account opening, a generated face or an injected video stream tries to pass the remote identity check; such deepfake attacks in identity verification target the liveness check and the face comparison.

In payments, a cloned voice or face persuades an employee or a customer to approve a transfer. That is the old pattern of CEO fraud with better tools, because the caller now sounds and looks like the person whose authority the fraud relies on.

Article 50 of the AI Act obliges anyone who uses an AI system to create a deepfake to disclose that the image, audio or video content was artificially generated or manipulated. The duty has applied since 2 August 2026, together with the rule that people must be told when they are talking to an AI system.

Fraudsters ignore labeling duties, so the rule mainly governs legitimate use. A bank that puts an AI avatar into customer videos or a synthetic voice on its hotline has to make that recognizable. Credit scoring and other high-risk uses fall under separate and stricter duties of the EU AI Act for banks.

Negotiators of Parliament and Council agreed on the new package of PSD3 and the Payment Services Regulation on 27 November 2025. One rule targets spoofing: if a fraudster poses as an employee of the bank and gets the customer to approve a payment, the bank must refund the full amount, as long as the customer reports the fraud to the police and informs the bank, the European Parliament said.

Customers who acted fraudulently or with gross negligence lose that protection. A payment that a fraudster initiates or changes counts as unauthorized, so the bank carries the full loss there as well. Online platforms that were told about fraudulent content and did not remove it will have to compensate payment providers for the refunds. Parliament and Council still have to adopt the deal formally before it comes into force.

The Ferrari executive ended the call with a question that only the real chief executive could answer. Banks can write the same rule into their payment processes: a transfer above a threshold leaves only after a callback on a known number, and a call or a video alone is never enough. Verification of payee, mandatory for euro transfers since October 2025, also checks the name of the recipient against the account.

At account opening, methods that rest on cryptography resist deepfakes better than methods that rest on a camera image. The online function of a national ID card and, from the end of 2026, the EUDI Wallet prove identity with a key on a chip, which a generated face cannot reproduce.