DEEPFAIC THREAT INTELLIGENCE - 02 APRIL 2026 - 06:00 LOCAL

Deepfake · Social Engineering · AI-Generated Media Threats

AI-enhanced fraud is hitting critical velocity: deepfake BEC now accounts for 40% of business email compromise, synthetic identities are defeating KYC at scale, and political deepfakes are proliferating unchecked across 2026 midterm campaigns with no federal guardrails in place.

AI deepfakes have become the dominant vector in business email compromise, with 40% of BEC incidents now involving synthetic voice or video - up from under 5% in 2023. Average losses from AI-augmented BEC have surged to $4.1 million per incident, more than triple the cost of traditional phishing. Attackers layer AI-written emails with real-time voice clone follow-up calls, and increasingly, deepfake video on Teams or Zoom to present a fully synthetic executive presence.

📰 Digital Applied, February 2026 · Attack Type: BEC/Voice Clone · Vector: Executive Impersonation

Scammers across the US are cloning children's voices from social media, then calling parents claiming their child has been kidnapped and demanding immediate wire transfers. Police in Olathe, Kansas have logged multiple reports of callers threatening violence and demanding payment within minutes. Criminals need only seconds of publicly available audio to generate a convincing replica - enough for a single TikTok or Instagram reel.

📰 KCTV5, February 3, 2026 · Attack Type: Vishing/Voice Clone · Vector: Family Emergency Scam

The UN Office on Drugs and Crime (UNODC) issued a global wake-up call at the 2026 Global Fraud Summit, warning that transnational criminal networks in Southeast Asia have evolved into full-service "criminal service providers" selling deepfake tools, voice cloning, and AI-powered fraud kits. Recent raids in the Philippines and Cambodia exposed scam centres generating billions in illicit flows, with operations connected to human trafficking and money laundering networks. UNODC called for urgent coordinated international action.

📰 UN News, March 2026 · Attack Type: Organised Crime / DaaS · Vector: Fraud-as-a-Service

Fraudsters are building AI-generated synthetic identities that blend real SSNs with fabricated biometrics, bypassing legacy KYC checks at financial institutions. US lenders faced $3.3 billion in exposure to synthetic identities across auto loans, credit cards, and personal loans in H1 2025 alone - and the trend is accelerating into 2026. AI-generated fake IDs can now be produced for as little as $15 in under 30 minutes, flooding onboarding systems with near-undetectable fraudulent applicants.

📰 PYMNTS, 2026 · Attack Type: Synthetic Identity Fraud · Vector: KYC/KYB Bypass

The National Republican Senatorial Committee released an AI-generated video in which a synthetic version of Democratic Texas Senate candidate James Talarico appears to speak directly to camera for over a minute, reciting old social media posts out of context. The ad is one of multiple AI-fabricated political videos now circulating in 2026 midterm races, with Reuters confirming Republicans are using the technology more frequently than Democrats this cycle. No federal law restricts the use of deepfakes in political advertising.

📰 CNN Politics, March 13, 2026 · Type: Political Deepfake · Platform: Online Ad / Social Media

A Reuters analysis confirmed that deepfake ads are now a mainstream campaign tactic ahead of November's midterms, with AI tools improving faster than any regulatory or platform response. A 2025 peer-reviewed study found that voters consistently struggle to identify deepfake videos - and that their political opinions are measurably affected by synthetic misinformation. Twenty-eight states have passed disclosure laws, but none have enacted outright bans.

📰 Detroit News / Reuters, March 28, 2026 · Type: Political Disinformation · Platform: Multi-platform Campaign Ads

A World Economic Forum analysis published in March warns that AI-driven cognitive manipulation is the defining disinformation challenge of 2026. The report identifies hyper-targeted synthetic content as more dangerous than broadcast deepfakes because it exploits individual psychological vulnerabilities at scale, making traditional media literacy defences inadequate. The WEF calls for systemic resilience-building rather than reactive content takedowns.

📰 World Economic Forum, March 2026 · Type: AI Disinformation Analysis · Platform: Cross-platform

The US Senate passed the DEFIANCE Act in January 2026, creating a federal right to sue over nonconsensual intimate deepfakes generated by AI. It is the first federal legislation specifically targeting AI-generated synthetic sexual imagery and passed with bipartisan support. Congress has still not moved to restrict deepfakes in political advertising - leaving election integrity to a patchwork of state laws.

📰 Roll Call, January 13, 2026 · Jurisdiction: United States (Federal) · Status: Passed Senate

The Take It Down Act has been signed into US federal law, making it a criminal offence to knowingly publish sexually explicit images - real or AI-generated - without the depicted person's consent. Schools and organisations now face new compliance obligations under the Act, which takes effect immediately. The law creates precedent for regulating AI-generated content at the federal level, covering both authentic and synthetic imagery.

📰 Fisher Phillips, 2026 · Jurisdiction: United States (Federal) · Status: Signed into Law

Washington Governor Bob Ferguson signed Substitute Senate Bill 5886, prohibiting the use of AI to create deceptive audio or video of real people without consent. The law takes effect June 10, 2026, and is among the most broadly scoped state-level deepfake protections to date - covering commercial, political, and personal contexts beyond the nonconsensual intimate imagery focus of most state laws.

📰 NBC Right Now, 2026 · Jurisdiction: Washington State, USA · Status: Signed - Effective June 10, 2026

As of early 2026, 46 US states have enacted legislation directly targeting AI-generated media - a dramatic acceleration from 2023. However, no federal law restricts deepfakes in political campaigns, leaving a critical gap as the midterms approach. Twenty-eight states have passed AI political ad disclosure requirements, but none have enacted outright bans, and enforcement of existing state laws remains largely untested.

📰 NBC News, 2026 · Jurisdiction: United States (Multi-State) · Status: Active / Expanding

🔺 BEC has fundamentally changed. AI deepfakes now account for 40% of business email compromise - the attack has evolved from text-based social engineering to fully synthetic audio-visual executive impersonation. Finance teams need real-time voice verification protocols, not just email filters. The $4.1 million average loss figure should reframe how organisations budget for controls.

🔺 Voice cloning is a mass-market scam tool. Kidnapping voice clone scams targeting families are running at volume across the US. The barrier to entry is under $20 and three seconds of audio. Any individual with a public social media presence is now a viable target, and awareness campaigns have not kept pace with deployment velocity.

🔺 Organised crime has productised deepfake fraud. The UN's Global Fraud Summit findings confirm that Southeast Asian criminal networks are selling deepfake tools and AI fraud services at scale. This shifts the threat model from opportunistic attacks to systematic, well-resourced campaigns with professional support infrastructure behind them.

🔺 The 2026 midterms are a live deepfake stress test. Deepfake political ads are already in circulation with no federal constraint. Republican-aligned PACs have deployed synthetic candidate videos with millions of views. Research confirms voters cannot reliably distinguish AI-generated content - meaning epistemic damage is happening regardless of fact-checking efforts.

🔺 Regulatory momentum is real but fragmented. The DEFIANCE Act and Take It Down Act represent genuine federal movement - but both target intimate imagery, not fraud or political manipulation. With 46 states having deepfake laws and zero federal political ad rules, the compliance landscape is a patchwork. Organisations should also be preparing for EU AI Act enforcement in August 2026 simultaneously.

Real-time deepfake video in business calls - the final authentication frontier is falling. The Arup $25M incident established proof of concept, but the attack has now commoditised: tools capable of real-time face and voice synthesis during live video calls are available on dark web markets for under $100. Every video call-based approval workflow - wire transfers, contract sign-offs, personnel decisions - is now a viable attack surface. Organisations still relying on "seeing is believing" for executive identity verification are operating on borrowed time. Out-of-band verification protocols for any financial action taken via video call should be treated as a critical control, not a nice-to-have.

Deepfaic Threat Intelligence · [email protected] · 02 April 2026 · deepfaic.com