Fraud has industrialized, and deepfakes are the newest product line

Fraud used to require a human on the other end of the scam: a caller impersonating a bank, a phisher drafting a convincing email, a fraudster manually testing stolen cards. That labor requirement was, in effect, a natural rate limiter. It no longer is.

Generative AI has turned identity spoofing into a production line: voice clones from a few seconds of audio, face-swapped video good enough to pass a liveness check, synthetic documents generated on demand. What was once a bespoke con is now a repeatable, scalable service; synthetic media detection now has to contend with voice cloning fraud, document forgery, and full synthetic identity fraud sold and resold across criminal marketplaces.

This is the shift Group-IB has been tracking closely: fraud is no longer a series of isolated incidents but an industrialized supply chain, and deepfakes are its fastest-growing product. Organizations still treating deepfake fraud as an edge case, something to bolt onto an existing KYC fraud prevention stack, are the ones that will feel this shift first, and hardest.

The economics behind the surge

This shift feels sudden because the underlying economics changed fast. A complete synthetic identity kit, an AI-generated face, a cloned voice sample, and fabricated supporting credentials, now sells on underground marketplaces for approximately $5. A subscription to AI-generated social engineering scripts runs around $30 a month. At that price, testing an institution’s defenses stops being a specialized skill and becomes more like a subscription service.

Group-IB has been tracking the supply side of this directly: between 2022 and September 2025, researchers collected more than 300 dark web posts referencing “deepfake” and “KYC,”  not a handful of isolated sellers, but a market maturing in real time. As Group-IB CEO and co-founder Dmitry Volkov put it in the company’s Weaponized AI: Inside the Criminal Ecosystem Fueling the Fifth Wave of Cybercrime research: “Cybercrime’s business models are evolving. The effect is profound: cybercrime is getting cheaper, faster, and more scalable.”

It’s also part of why this fraud is hard to catch after the fact. Unlike traditional malware, which often carries a recognizable code signature or infrastructure footprint, AI-generated artifacts- a phishing lure, a deepfake voice clip- can be produced on demand and leave almost no forensic trace. If the defense only kicks in during a post-incident review, there’s often nothing left to find. 

How deepfake fraud actually reaches an enterprise

Deepfake fraud rarely announces itself as a single, dramatic event. It shows up inside processes that already assume a human is on the other end:

• Account takeover and onboarding fraud. Synthetic video or voice used to pass identity verification during account opening or recovery, particularly in banking, fintech, and insurance
• Business email compromise, upgraded. A cloned executive voice on a call, not just a spoofed email, authorizing a wire transfer or vendor payment
• Mobile banking and payment fraud. Face-swapped liveness checks defeating biometric authentication on banking apps
• Synthetic identity fraud. Deepfaked documents and faces combined to construct identities that pass automated verification but belong to no real person
• Deepfake investment and romance scams. Video calls with a synthetic “advisor” or “partner” building trust before financial extraction

The common thread: each of these attacks succeeds by exploiting the assumption that a live face, voice, or document proves a live person. That assumption is now attackable at scale.

Real deepfake fraud cases Group-IB has investigated

These aren’t hypothetical vectors. Group-IB has investigated each of them directly.

A bank in Indonesia, and 8,065 attempts to fake a face

In August 2024, a major Indonesian financial institution came to Group-IB with a problem: deepfake fraud was showing up inside its mobile app, despite the bank already running multi-layered security. Group-IB’s investigation found roughly 1,000 fraud cases among 2 million users, a detection rate of just 0.05%, but enough to make the national-scale cost of deepfake-driven loan fraud worth calculating. 

Over the following year, the same institution logged 8,065 separate attempts to fool its liveness checks with AI-generated faces during digital KYC for loan applications. That’s not one clever attacker; it’s a technique being run at volume.

A $15 tool that beat a crypto exchange’s ID checks. 

OnlyFake, an AI image generator, could produce a realistic fake ID in seconds for about the price of a sandwich. It was good enough to pass identity verification on a major global cryptocurrency exchange, a reminder that “our KYC caught it” is a claim worth retesting regularly, not a box to check once.

A fake analyst, a real stock, and a 42% loss

Group-IB’s research team has been tracking two connected investment-fraud operations it calls GoldBull and CoinLure. GoldBull runs short-lived deepfake video ads impersonating financial professionals, funneling victims into WhatsApp groups run by a fake “head analyst” who tells them exactly which small-cap stock to buy and at what price. 

In one documented case, victims bought in at $24.79; coordinated buying pushed it to $27.87, and the operators sold into that peak. The stock later fell to $14.27, a 42% loss for everyone who followed the “analyst’s” advice. CoinLure, the sister operation, runs a network of 200+ fake crypto investment platforms built off shared templates, with an estimated $187 million in network revenue. Group-IB has flagged both as risks likely to migrate into fast-growing retail investing markets like the GCC, not because the region is uniquely vulnerable, but because the playbook travels wherever WhatsApp and retail crypto adoption are high.

Why standard fraud detection wasn’t built for this

Most fraud prevention stacks rely on behavioral and transactional signals, device fingerprinting, velocity checks, and anomaly detection in spending patterns. These are necessary, but they were designed for a threat model where the identity itself wasn’t the attack surface. Deepfakes target the layer underneath all of that: the verification step that establishes whose behavior you’re even monitoring.

This creates a structural gap. A platform built purely for behavioral fraud detection has no visibility into whether the video, voice, or document behind an interaction is synthetic in the first place. A platform built purely for media forensics, detecting a deepfake in isolation, has no fraud context: no way to connect that detection to the broader criminal infrastructure behind it, the actor group running the campaign, or the pattern of similar attempts across other victims.

The vendors currently addressing this space tend to specialize in one half of the problem:

• Behavioral and biometric specialists can flag anomalies in how a session unfolds, but typically lack a threat intelligence layer that tracks the actor groups, tooling, and marketplaces behind synthetic media production
• Identity and AML-focused platforms are built for compliance workflows and known fraud typologies, not for a threat that evolves as fast as the underlying generative models do
• Pure threat intelligence providers can track the infrastructure and actors, but don’t have a fraud protection product to act on that intelligence in real time at the point of transaction

An enterprise assembling a deepfake defense from single-purpose tools ends up stitching together detection, intelligence, and action across vendors that don’t share data. That seam is exactly where dwell time and false negatives accumulate.

Group-IB’s position is built on not having that seam. Deepfake and synthetic media detection sits inside the same platform as fraud prevention and threat intelligence, so a detected deepfake attempt is cross-referenced against known actor infrastructure, campaign patterns, and prior incidents from Group-IB’s broader investigative record. 

The same intelligence that tracks ransomware groups and underground marketplaces also tracks the criminal supply chains producing synthetic identity kits, because they frequently overlap at the infrastructure level.

What this looks like in practice

1. Detection at the point of interaction

Synthetic voice, face, and document detection is integrated directly into onboarding, authentication, and high-risk transaction flows through Group-IB’s Fraud Protection platform, rather than running as a separate post-hoc review that catches fraud only after the damage is done. Because detection sits inline with the transaction itself, a synthetic identity attempt can be interrupted at account opening or before a high-value transfer clears.

2. Attribution

A detected deepfake attempt is enriched in real time with intelligence from Group-IB’s Threat Intelligence platform, which tracks the fraud-as-a-service operations, underground marketplaces, and actor groups producing and distributing synthetic media. 

Instead of a fraud analyst seeing an isolated “synthetic media detected” alert, they see which known operation the attempt most likely traces back to, what other campaigns that group has run, and what infrastructure it typically reuses, turning a single detection into actionable context.

3. Cross-signal correlation

Deepfake detection doesn’t operate in a silo. Fraud Protection and Threat Intelligence work together as part of Group-IB’s Cyber Fraud Intelligence Platform, a combined suite for fraud prevention that correlates synthetic media detection with device fingerprinting, behavioral biometrics, and transactional signals so a single fraud decision reflects the full picture. A synthetic voice on a call, combined with an anomalous device and an unusual transaction pattern, is scored together rather than requiring a fraud analyst to manually stitch together alerts from separate tools.

• APAC. Mobile banking fraud centered on face-swapped liveness checks defeating in-app biometric authentication, the same pattern Group-IB investigated directly at the Indonesian institution above
• GCC and emerging investment markets. Deepfake-driven investment fraud combining synthetic video, messaging-app groups, and fake trading platforms, the GoldBull and CoinLure pattern Group-IB has warned could migrate into Gulf markets alongside the region’s rapid growth in retail investing and digital assets
• Global crypto and fintech onboarding. Synthetic document fraud, as seen in the OnlyFake case, targets the identity verification step itself rather than transaction monitoring downstream

4. Continuous model adaptation

Because the same Group-IB teams investigating underground marketplaces also feed the Fraud Protection and Digital Risk Protection products, detection models are updated against newly observed generative techniques as they surface in criminal channels, rather than waiting for a periodic vendor update cycle to catch up with tooling that iterates faster than most institutions’ review processes do.

By the numbers

• $5. Cost of a complete synthetic identity kit (face, voice, credentials) on underground marketplaces
• $30/month. Cost of a subscription to AI-generated social engineering scripts
• 300+. Dark web posts referencing “deepfake” and “KYC” tracked by Group-IB between 2022 and September 2025
• 8,065. Attempts to bypass one financial institution’s liveness checks using AI-generated deepfake images in an 8-month window
• 0.05%. Detected fraud rate that still translated into 1,000+ fraud cases across 2 million users at a single bank

Why this matters now

The market data reflects the urgency. Fraud detection and prevention is projected to grow from roughly $32B to $65.7B by 2030, and cyber threat intelligence from $11.6B to $23B over the same period — two markets growing at nearly identical rates, both converging on the same underlying problem: verifying whether the actor on the other end of a digital interaction is who, or what, they claim to be. A vendor that can credibly operate across both markets has a positioning advantage a pure-play specialist in either one cannot replicate.

Deepfake fraud compounds this urgency because the technology producing it is improving faster than most institutions update their verification processes. The gap between “our liveness check works” and “our liveness check still works” is measured in product release cycles for the generative models being weaponized against it.

Related reading: How to evaluate an incident response retainer

Where Group-IB fits in, and what to do next

Deepfake fraud isn’t a future risk to plan around; it’s already moving through onboarding flows, executive impersonation attempts, and account recovery processes at organizations that assume a face or voice on a screen is sufficient proof of identity. Treating it as a detection problem alone misses half of what’s actually needed: knowing not just that a piece of media is synthetic, but understanding the criminal infrastructure producing it, so defenses can adapt as fast as the threat does.

1. Audit where your verification processes assume a live human. Map every onboarding, authentication, and high-value transaction flow that relies on a face, voice, or document as proof of identity; these are the points a deepfake attack is built to exploit, and most institutions haven’t inventoried them as a single attack surface.
2. Stop treating detection and intelligence as separate purchases. A synthetic media flag without attribution is a dead end for a fraud analyst. Evaluate any deepfake defense on whether it connects a detection to the actor group, campaign, and infrastructure behind it.
3. Talk to Group-IB about defending your organization against deepfake and synthetic identity fraud. Group-IB’s position in this space comes from sitting at the intersection of both problems; the same organization tracking the underground marketplaces producing synthetic identity kits is also building the fraud protection that defends against them.