New fraud analytics released this quarter put a stark number on a trend enterprises have felt anecdotally for two years: document deepfakes are on track to increase 3,892% in 2026, based on annualised data from over one million analysed fraud attempts. Identity fraud attempts are up 495%, and injection attacks against iOS identity verification flows are up 1,151%.
The framing from fraud researchers is telling: deepfake fraud is "becoming infrastructure for impersonation," not a single novel attack type but a layer underneath investment scams, business email compromise, and identity verification bypass alike.
The Numbers Enterprises Need to Know
- US complaints referencing AI-generated content accounted for $893.35 million in adjusted losses during 2025 across 22,364 reports, according to FBI data.
- At least $14 billion reached crypto scam addresses in 2025, with 2026 projections exceeding $17 billion, per Chainalysis.
- Investment fraud linked to AI-generated content accounted for $632 million in losses; business email compromise, $30.2 million.
- One in ten Americans has experienced a voice-clone scam, and 77% of those targeted reported a financial loss, according to McAfee research. A convincing clone can now be produced from as little as three seconds of audio.
Why Human Detection Is Losing the Race
Perhaps the most uncomfortable figure in the new data: human visual identification of deepfake content scores an average of just 0.07 to 0.08 on standard detection scales, essentially indistinguishable from chance for the general public. The gap between generation quality and human perceptual ability to catch it has widened sharply since 2024, which is precisely why detection has shifted from "look closely" training to automated, API-based verification layered into identity and communication workflows.
Where Enterprises Are Most Exposed
Finance and Treasury Operations
Voice-cloned "CEO" or "CFO" calls authorising urgent wire transfers remain the single most costly attack vector for mid-size and large enterprises, building directly on the pattern this site covered in 2026's CEO fraud reporting, now amplified by cheaper, faster cloning tools.
Customer Onboarding and KYC
Injection attacks against liveness detection and identity verification, particularly on iOS, are growing fastest of any category tracked. Any enterprise relying on video or photo-based identity checks for account opening should treat this as an active, escalating threat rather than a theoretical one.
Investment and Trading Platforms
AI-generated endorsement videos and cloned executive voices remain the largest single dollar-loss category, at $632 million and rising, typically deployed in fake investment schemes that borrow a real company's or real person's likeness without consent.
Defence Priorities for the Second Half of 2026
1. Mandatory Callback Verification for High-Value Transactions
Any payment or credential change request received by voice or video should require verification through a separate, pre-established channel, never a callback number provided in the same communication.
2. Layer Liveness Detection With Behavioural Signals
Given the sharp rise in injection attacks, identity verification should not rely on a single biometric check. Combining liveness detection with device fingerprinting and behavioural anomaly signals significantly raises the cost of a successful attack.
3. Retrain Staff Away From "Trust Your Ears" Heuristics
With human detection scoring near chance levels, security awareness training built around "listen for robotic tone" or "look for unnatural blinking" is now actively counterproductive. Training should instead reinforce verification procedures that don't depend on human perceptual judgment at all.
Conclusion
The 2026 data confirms what enterprise security teams have suspected: deepfake fraud has matured from a novelty attack into commodity infrastructure available to any scammer with a laptop. The organisations weathering it best are the ones that stopped asking employees to spot the fake and started building verification processes that don't require spotting anything at all.