When a client calls to request an urgent wire transfer, financial advisors need to act fast. But that urgency can create an opportunity for bad actors, who are now using fake audio and video to convincingly impersonate real people and steal funds. They may pose as wealthy clients over the phone or on video calls to trick people into sending money to fake bank accounts.
For a registered investment advisory (RIA) firm, one bad wire transfer can cause massive financial losses and ruin stakeholder trust. Protecting client money starts with simple verification steps that keep your firm safe.
| At a glance: What RIAs need to know about deepfake fraud – Criminals use AI voice cloning and fake videos to trick victims into approving wire transfers. – Standard phone callbacks fail because scammers mimic a person’s voice using audio pulled from public websites. – Deepfake scams can bypass biometric security measures, making offline passphrases and strict approval steps essential to protect client funds and preserve client trust. – Weak identity verification can expose an RIA to fines, litigation, and reputational damage. – To guard against deepfake fraud, advisors should use callback protocols, dual-approval requirements, and offline passphrases. – Running regular security drills, reviewing privacy settings, and working with managed security professionals can further strengthen defenses. |
What is deepfake technology, and how does it work?
Deepfake technology uses AI to generate fake media. Scammers use it to produce fabricated images, video footage, and audio recordings that are difficult to distinguish from the real thing.
Creating deepfakes no longer requires a technical background. Modern AI software allows criminals to create a convincing deepfake in a matter of minutes. In the past, fraudsters spent months constructing fake identities. Today, voice cloning technology lets an attacker replicate someone’s voice from as little as 60 seconds of sample audio.
Bad actors typically gather audio clips from publicly available sources, such as:
- Podcasts and webinars
- Social media videos
- Media clips on company websites
- Public speaking events
From there, scammers upload a short audio clip into an AI generator. They type out a script, and the software delivers it in the target’s voice, capturing their tone, accent, and speech patterns. The result is remarkably realistic, even through a regular phone speaker.
The real-world impact of AI voice cloning and synthetic media
According to the Entrust 2026 Identity Fraud Report, deepfakes now account for one in five biometric fraud attempts, making AI-generated impersonation one of the most prevalent threats businesses face today. Wealth management firms have become a prime target for scammers using AI voice cloning technology. With access to sensitive financial information and large sums of money, these firms are high-value targets for cybercriminals looking to exploit both individuals and businesses.
The scale of damage caused by these attacks is significant, with several high-profile cases highlighting just how far scammers will go:
- Executive impersonation: In 2019, a UK energy company lost $243,000 when scammers used a cloned CEO’s voice on a phone call to request an urgent offshore wire transfer.
- Hong Kong video scam: In 2024, criminals used AI-generated video avatars to fake an entire video conference call. A finance employee at a Hong Kong firm joined the meeting and approved payments worth $25.6 million, all lost to deepfake fraud.
- Family emergency scams: Imposters impersonate distressed family members to manipulate high-net-worth clients into handing over large sums of cash.
Taken together, these cases paint a troubling picture of how agentic AI and synthetic media are being weaponized by criminals to impersonate authority figures and trusted individuals alike.
Are deepfake scams a legal issue for RIAs?
Creating synthetic content for fun or art is legal. Using a cloned voice or fake video to deceive individuals out of money is wire fraud. The Federal Trade Commission investigates AI-powered scams, and federal law enforcement prosecutions target criminals who steal money using fake media.
For an RIA, legal risk extends beyond criminal laws against scammers. Regulators hold each financial advisor responsible for protecting client asset security and sensitive information. If an employee approves a bad transfer after falling victim to a fake voice call, regulators will scrutinize the firm’s internal security controls. Inadequate identity verification processes can expose an RIA to regulatory fines, civil litigation, and lasting reputational damage.
How to spot voice clones and deepfake videos
Spotting a deepfake during a phone or video call comes down to noticing small details. Fake audio and video streams often give themselves away through subtle technical glitches.
Phone calls with fake audio have clear warning signs:
- Flat emotional delivery during urgent requests
- Metallic sounds or robotic hums
- Unnatural pauses between words
- Cuts in background noise
Fake video calls and video clips show visual errors:
- Blurring around a person’s face or neck
- Odd blinking patterns or stiff eyes
- Mouth movements that do not match the spoken voice
- Strange shadows across the face
How to verify suspicious communications
When you receive a suspicious phone call, ask the caller a personal question that wouldn’t be found on social media. For urgent requests made over video calls, out-of-band verification is recommended, meaning you must verify the request through a completely separate communication channel. For any emails that raise concern, avoid responding and instead call the client back on a preregistered phone number to verify the request.
Learning to recognize these red flags gives an RIA the tools to stop a growing threat before funds leave the building.
Stopping social engineering and deepfake phishing scams
Defending your wealth management firm starts with clear operational rules. Criminals use deepfake phishing and business email compromise scams to build trust before asking for money. Here are some core security steps advisors can take to prevent fraud:
- Mandatory callbacks: Never approve wire requests from an incoming call or email. Instead, call the client back using the primary phone number stored in your secure database.
- Dual approval rules: Require two staff members to review and sign off on any transfer requests above a set dollar amount.
- Offline passphrases: Set up secret verbal passcodes with clients during account setup. Store passphrases off online networks so a voice clone can’t guess them.
- Employee security drills: Run periodic phishing scam drills and voice impersonation tests. Regular practice builds employee awareness and speeds up threat response.
- Review privacy settings: Tighten privacy settings across all business and personal accounts. Limiting your firm’s digital footprint reduces the amount of publicly available information criminals can use to craft convincing deepfake attacks.
- Partner with managed security professionals: Modern cybersecurity requires expert management. RIA WorkSpace offers cybersecurity services built for RIAs to protect client data and stop impersonation attacks.
Prevent fraud in your financial advisory practice
Building a secure financial advisory firm starts with consistent habits. Scammers rely on speed, confusion, and fear to bypass safety rules. When your team enforces multistep checks for every transfer, you close the gaps that put client funds at risk.
Training staff to question unusual payment requests adds a strong layer of defense. Simple policies, paired with the right tech tools, help keep your organization safe from growing AI threats. Detection and prevention of deepfake fraud require multilayered security frameworks, making it essential to combine phishing training with robust verification technology.
Schedule a discovery call with the team at RIA WorkSpace to review your current setup and put the right verification controls in place.