Deepfake scam: cloned voices, fake video calls and how to verify at work

What a deepfake scam is

A deepfake is audio, video or an image generated or altered by AI so that it looks or sounds like a real person. A few seconds of someone’s voice from a social media video, a voice note or a recorded webinar can be enough to produce a convincing clone. Video tools can map a face onto another person in a live call or a pre-recorded clip.

A deepfake scam uses that fake to borrow trust. The scammer does not need to hack your systems. They only need you to believe, for a few minutes, that the voice on the phone is your sister or that the face on the screen is your finance director.

The technology is new, but the scam is old. It is still impersonation, urgency and a request to move money or share something secret. That is good news for training: the same habits that stop a phone scam or a fake e-mail also stop a deepfake.

The main types: voice, video calls and fake endorsements

AI also makes ordinary phishing better: well-written e-mails in good Bahasa Malaysia or English, tailored with details from LinkedIn or a company website. See phishing awareness training for that side.

Deepfake scams in Malaysia

Malaysian police have been tracking these cases since at least 2024.

• In August 2024, the director of Bukit Aman’s Commercial Crime Investigation Department (CCID), Datuk Seri Ramli Mohamed Yoosuf, said police were investigating 454 fraud cases believed to involve deepfake technology, with losses of about RM2.72 million since the start of that year. He described scammers posing as victims’ acquaintances on WhatsApp, claiming to be in trouble and asking for a loan paid into a mule account.
• In one case he described, a travel agent in Kuala Terengganu transferred RM49,800 after a call from an unknown number in a voice that sounded like a close friend. Police did not rule out deepfake technology. Smaller losses were reported in Kuala Lumpur and Penang using the same method.
• Deepfake videos of national leaders, prominent business figures and royalty have been used to promote fake investment schemes. In July 2025 the Johor Royal Press Office warned the public about a fake video of the Sultan promoting an investment on Facebook.

The CCID’s advice was simple: do not trust what you see or hear alone, and verify by contacting the person directly on the number already saved in your phone.

Overseas, the best-known workplace case was reported by Hong Kong police in February 2024: an employee of a multinational firm’s Hong Kong office paid about HK$200 million across 15 transfers after a video conference in which the “chief financial officer” and other “colleagues” were all fakes built from earlier recordings.

How to verify: the call-back rule and other checks

Trying to spot a deepfake by looking for odd blinking or lip sync is unreliable, and it gets less reliable every year. Build the check into the process instead.

1. Pause. Urgency and secrecy are the scam. A real boss or relative can wait five minutes.
2. Call back on a known number. Hang up, then call the person on the number in your contacts, the company directory or the supplier master file. Never use a number, link or meeting invite in the message itself.
3. Ask something only they would know, or use a family or team code word agreed in advance and never posted online. A code word does not stop a fake being made, but it stops the conversation that follows.
4. Move channels. If the request came by WhatsApp, confirm by phone. If it came by video call, confirm by a separate call or in person.
5. Check the money trail. A new beneficiary account, a personal account for a business payment, or a request for gift cards or top-up codes is a stop sign on its own.
6. Check the account. Search the account number or phone number on the police Semak Mule portal before paying. A clean result does not prove it is safe.

The Scam Smart: AI Tricks to Watch For lesson lets staff practise these checks on a cloned-voice call and a deepfake investment ad in a 3D scene, and Fact Check: Fake News and AI Images covers tracing fake pictures and clips.

Workplace controls: stop CEO fraud by design

Executive impersonation works because staff want to help senior people quickly. Remove the need for judgement under pressure with a few written rules:

• No payment on a call alone. No transfer, new beneficiary or change of bank details is approved because of a phone call, voice note or video call, whoever appears on it.
• Dual approval. Urgent or unusual payments need a second approver who checks independently, not someone on the same call.
• Call-back for bank detail changes. Any request to change a supplier’s or employee’s bank account is confirmed by calling a number already on file.
• Permission to say no. Senior leaders should state openly that they will never ask staff to skip a control, and that staff who stop a payment to check will be backed.
• Watch your public footprint. Executives with many public videos and podcasts are easier to clone. That is not a reason to go silent, but it is a reason for finance teams to apply the rules strictly.
• Report near misses. Most attempts fail. Each one reported tells others what the current script sounds like.

Deepfakes & AI-Enabled Fraud takes staff through a finance floor facing deepfake video calls, cloned voices and fake bank detail changes, with call-back and dual approval as the fix. Payment Fraud & Scams covers e-mail compromise and fast recall.

What to do if you have been targeted

1. If money has gone, call 997, the National Scam Response Centre, which runs 24 hours a day. Give the time, amount and receiving account of each transfer.
2. Call your bank’s fraud hotline or use the kill switch in its app to suspend your account.
3. Tell your employer straight away if a work payment, account or company data is involved. Finance and IT may be able to recall a transfer or block access.
4. Keep the evidence: the number, the voice note or video, screenshots of chats and any account details. Do not delete the conversation.
5. Warn the person who was impersonated, so they can alert their own contacts.
6. Report fake ads and videos to the platform. Since 1 January 2026 the Online Safety Act 2025 (Act 866) has required large social media and messaging platforms in Malaysia to deal with harmful content, including financial scam content.

Full steps, including Semak Mule and when you still need a police report, are in How to report a scam in Malaysia.

This guide is general information based on official statements and news reports as of October 2026. It is not legal advice.