In April 2025, Hong Kong police broke up a network that used AI to merge fraudsters' faces onto lost or stolen ID photos, pass remote bank onboarding, and open real accounts tied to reported losses above 190 million US dollars. The control that failed was automated face-match and liveness. That is a different failure from the 25-million-dollar deepfake video call of 2024, which defeated a human rather than a system, and the difference decides where you spend.
The case where a control failed
In April 2025, Hong Kong authorities dismantled a fraud operation that used AI to graft the operators' own faces onto photographs from lost and stolen identity documents. Clearing the remote identity-verification step banks use to open accounts, the composites produced accounts that were real: opened, funded, and moved through, with reporting tying the network to losses exceeding 190 million US dollars.
What failed was the face-match and liveness layer, the automated check meant to confirm that a live, present person matches the document photo. Handed synthetic input, it returned a pass, and no human approved the match at the moment it counted.
Nor is this an isolated trick. Examining a set of face-swapping and camera-injection tools with the biometrics vendor iProov, the World Economic Forum found that most of them defeated standard biometric onboarding checks in testing. The mechanism is now commodity. Real-time face replacement runs on ordinary hardware and reproduces blink and micro-movement well enough that passive liveness returns a match, while a further class of attack, camera injection, feeds synthetic video straight into the verification step through a virtual device, so the liveness check never sees a real sensor at all.
The case where a control did not fail
The most famous deepfake-fraud story of all, the early-2024 incident in which a finance employee at the engineering firm Arup wired about 25 million US dollars after a video call with what appeared to be the company's executives, is a different animal.
Extraordinary as it was, and real as the loss was, what it bypassed was a person's judgment on a live call. There was no automated authenticity control in the loop to defeat. Filed correctly, it is high-fidelity social engineering rather than a defeated control, and if anything it argues that no technical control stood where one should have. Two executives at Ferrari and WPP faced the same class of attack and stopped it with a question.
The distinction is not pedantry, because it tells you where to spend. The Arup case argues for out-of-band verification, a transfer-approval protocol, and process. The Hong Kong onboarding ring argues for not trusting a single biometric control that current tooling can beat.
On the scary numbers
Coverage of this threat is dense with percentages: large year-over-year rises in injection attacks, in the deepfake share of fraud, in face-swap volume. Many of those figures originate with the detection and identity-verification vendors who also sell the defense, so treat them as directional, vendor-reported context rather than load-bearing fact.
The load-bearing facts are the ones from primary reporting and independent assessment: real accounts opened in the Hong Kong case, and the World Economic Forum and iProov finding that commodity tools defeated standard onboarding in testing. Those are enough.
What this means for liveness checks
If a face-match or liveness step gates account opening or access in your system, the question is not whether deepfakes look convincing. They do. The question is whether your specific deployment, today, returns a pass on a current-generation face-swap or an injected stream, and the document step in front of it has already been shown to accept a 15-dollar generated passport.
You cannot answer that from a datasheet. Liveness vendors publish results against the attacks they tested, on the timeline they tested them, while attackers do not hold still and injection deliberately sidesteps the sensor the liveness model assumes. The only honest answer is a measured one against your control, with current attacks. That same pattern, clean-lab numbers that do not survive realistic conditions, is what our detector benchmark documents in detail.
The deepfake that opens a real account is a control problem. The deepfake on a video call is a process problem. Margen does not sell identity verification or detection; we measure, as an independent third party, whether the control holds against current attacks, so the two can be solved as the different problems they are.
Related reading
- Fraud storiesA cloned voice that said the password, and the bank let it in.Reporters cloned their own voices and passed bank voiceprint authentication. Researchers defeated it with up to 99 percent success in six tries. The industry now concedes the control is beaten.
- ExplainersMeta's Muse watermark, and what it does not do for deepfake detection.Meta's Content Seal watermark labels the content Meta itself generates. That is useful, and it is not the same as detecting the deepfakes an attacker actually makes.
- BenchmarksDetectors collapse from near-perfect to near-random.Fourteen open-source deepfake detectors, evaluated on about 26,500 face crops across 12 demographic cells. The two that scored a perfect AUC of 1.000 collapsed to 0.34 once real and synthetic images shared one encoder, and a control isolated the file format itself as the cause.