AI Security

AI deepfake investment scams cost UK victims £24.3m this year: police

Report Fraud says AI-enabled schemes, including deepfake endorsements, took £24.3m from UK investors in eight months; over-60s made nearly 80% of reports.

Illustration of an AI deepfake face on a fraudulent investment advert with the figure £24.3m

Report Fraud says criminals took £24.3m from UK victims between January and August 2026 using investment schemes that relied on AI, including deepfakes of public figures and trusted financial brands, to look credible. Almost four in five reports came from people aged 60 or over, and the playbook is one every organisation with a recognisable face or logo should understand.

What happened

Report Fraud, the national fraud and cyber crime reporting service run by City of London Police, has published figures on what it calls AI-enabled investment fraud. According to the release, fraudsters took £24.3m over the first eight months of 2026 with bogus investment offers dressed up using artificial intelligence, including deepfake video and images.

The service says it received more than 1,300 reports of this type over the eight months. Of those, 1,033 came from people aged 60 or over, which is nearly 80 per cent of the total. Report Fraud says it reviewed each report individually to confirm whether AI or deepfake technology had played a part, which matters when you come to read the numbers.

Commander Ollie Shaw of City of London Police warned that investment fraudsters’ tactics are “becoming ever more sophisticated”, and urged anyone thinking about investing to take their time, research carefully and check the firm on the Financial Conduct Authority’s Firm Checker.

How it works

The release describes a familiar fraud structure with a synthetic front end. The lure is a deepfake: an online advert or a fabricated news article in which a well-known public figure, or a trusted financial institution, appears to endorse an investment product. Generative tools make such endorsements cheap to produce and quick to refresh with new faces and branding.

Clicking through leads to a form that harvests personal details. Shortly afterwards a criminal posing as an investment adviser or account manager makes contact. After a first payment the victim is given access to a polished trading dashboard that shows healthy paper profits. That fake performance is used to justify larger deposits. When the victim tries to withdraw, new “fees” or “charges” appear, and the losses mount.

Report Fraud also notes that schemes borrow credibility by tying themselves to emerging technology, government-backed initiatives or supposedly exclusive opportunities. In other words, the AI is not only the delivery mechanism; it is frequently part of the sales pitch too.

The wider context is grim. Report Fraud’s figures for 2025 put total UK investment fraud losses at £879.8m, about £2.4m a day, from 34,673 reports, a 31 per cent rise on the previous year, with an average loss of £25,612. The same analysis listed AI-generated video, deepfake endorsements and cloned websites among the tactics in use, alongside “recovery” fraudsters who approach existing victims offering to get their money back for an upfront fee.

Five-stage flow diagram of an AI deepfake investment scam, from fake endorsement advert to fake withdrawal fees

Why it matters for UK organisations

Filing this under consumer fraud would be a mistake, for three reasons.

First, the impersonated brands are real UK organisations. Banks, building societies, investment platforms, pension providers and broadcasters are the trusted names criminals borrow. Every fake advert using your logo or chief executive’s face erodes trust and creates complaints and reputational cost, even though you were never breached.

Second, the technique transfers directly to the enterprise. The same tooling that produces a convincing video endorsement for a fake trading platform can produce a voice note from a finance director approving a payment, or a video call from a supplier changing bank details. The investment fraud figures are a measurable proxy for how good and how accessible these tools have become.

Third, the regulatory picture is moving. Ofcom consulted between July and early October 2026 on fraudulent advertising codes of practice for the largest categorised services under the Online Safety Act, covering paid-for adverts, and says final codes will follow by mid-2027 at the latest. For firms in financial services, the volume of impersonation also feeds into reimbursement and complaints exposure. Which? has highlighted that reimbursement under the authorised push payment rules is capped and does not reach every case, so victims, and the firms they bank with, will continue to argue over who carries the loss.

Expert view

In my experience, organisations treat brand impersonation as a marketing or legal problem, and deepfake risk as something for the board deck. Neither is quite right. The pattern described here is social engineering at industrial scale, and the controls that blunt it are mostly procedural and unglamorous.

A few points stand out. The 60-plus figure is not a sign that older people are naive. It reflects who holds pension pots and savings worth targeting, and who is still most likely to trust a familiar presenter or a household-name bank. Criminals go where the money and the trust are.

The 1,300 reports are also almost certainly an undercount. Report Fraud depends on victims recognising the fraud, reporting it and describing the AI element. Many victims never report, and many will not know the video was synthetic. The £24.3m should be read as a floor.

Finally, the weak point in these schemes is not the deepfake. It is the hand-off from advert to human contact to payment. When we run social engineering exercises, the pretext rarely survives a call back to a number the target already holds, or a pause to check with someone else. The release’s advice to slow down and verify is not a platitude; it is the actual control.

What to do now

  1. Monitor for impersonation of your brand and leaders. Set up takedown processes with the major ad platforms and social networks, and keep a log of fraudulent adverts using your name. If you are a regulated financial firm, coordinate with your fraud team so trends feed into customer warnings.
  2. Publish a clear “we will never” statement. Tell customers in plain terms that your senior staff and presenters do not endorse investments in adverts, and how to verify genuine contact. Point them to the FCA Firm Checker and ScamSmart.
  3. Harden payment and approval processes internally. Require out-of-band verification, using known contact details, for any change of bank details or urgent payment request, however convincing the voice or video. This sits alongside the user access control principles in Cyber Essentials: no single message should be enough to move money or grant access.
  4. Train staff on synthetic media, including for their families. Awareness sessions that cover deepfake adverts and voice cloning help employees protect themselves and older relatives, and the same instincts protect the business.
  5. Make reporting easy. Encourage staff and customers to report suspected fraud to Report Fraud online or on 0300 123 2040, or to Police Scotland on 101 in Scotland. Better reporting is what produces data like this.

Bottom line

AI has not invented a new fraud here. It has made an old one cheaper, faster and more believable, and the £24.3m that Report Fraud can attribute to it so far this year is the visible part of a larger problem. For UK organisations, the response is the same discipline that defeats any social engineering: protect your brand, verify through channels you control and make it normal to stop and check before any money moves.

Sources

Related Posts