On this page
AI as attacker: deepfakes and the new scam toolkit
Crypto's scam problem (the Security unit catalogued it) did not need AI — but AI industrializes it. made the classic “celebrity giveaway” scam dramatically more convincing: fake “live” streams of Elon Musk promising to double any crypto sent to a QR code have contributed to billions of dollars in reported US fraud losses, and the deepfakes are good enough that victims routinely insist the person they “met” on a call was real.
The defining case is Arup, the British engineering firm: a Hong Kong finance employee joined a video call with what looked — and sounded — like the company's CFO and several colleagues. All of them were AI-generated recreations. Following instructions from the “call,” the employee made 15 transfers totaling HK$200 million (~US$25 million) before anyone noticed. Multiply that playbook by phishing written at scale, AI-generated scam sites cloned in seconds, and voice clones of family members — and the crypto rails' one irreducible property becomes the attacker's best friend: a confirmed transaction cannot be reversed. The same finality that makes meaningful makes a deepfake-induced payment permanent.
The defenses in the Security unit predate AI and still hold: verify identity through a second, out-of-band channel before any transfer; treat urgency as a red flag, because manufactured urgency is what the deepfake call and the giveaway stream both depend on; and remember that no real person or company guarantees returns or doubles deposits. Deepfakes defeat eyeballs — not process.
The broader crime picture is not only deepfakes: Chainalysis reported that ~$2.2 billion was stolen in crypto hacks in 2024, up ~21% year over year, with North Korean attackers alone responsible for ~$1.3 billion — state-sponsored groups that use tooling of every sophistication, and for whom AI is one more weapon in the kit. AI lowers the cost of running a scam and raises the quality of the props; the targets and psychology are the ones you already learned.