Overview
Deepfakes are supercharging scams with seemingly credible news, endorsements, and testimonials that were actually generated by scammers. As the barrier to entry for realistic deepfake generation across images, voice, and video has lowered, threat actors have increasingly used this technology to abuse the reputation of trusted figures. Netcraft has observed deepfake scams impersonating individuals associated with wealth, authority, and public appeal. This often includes executives, journalists, and celebrities. If individuals are involved in banking, forex, or cryptocurrency offerings, the ability to abuse their reputation for cryptocurrency schemes increases greatly. In some cases, an unknown person was used in deepfakes for fake testimonials, creating a relatable but unidentifiable person. These unknown people are used in recovery scams to create credibility for non-existent services.
Deception through fake controversy
This year, Netcraft has observed several deepfake activity clusters using ads, banking executives, and alleged “leaked” arguments to direct victims to cryptocurrency investment scams. Scammers used the images of mainly bank leaders and journalists to create narratives of conflict over hidden information, preying on distrust of traditional banking. Distrust in established financial institutions and practices has been used by some crypto platform advertising, normalising this kind of advertising as a way into cryptocurrency investment.
In one example, both a banking executive and a notable journalist were impersonated in a series of fake images used across websites and social ad campaigns promoting a cryptocurrency investment scam. In one sample of ads on X taken by Netcraft between 7 and 15 July 2026, roughly one third were related to this deepfake cluster. Many linked to false articles or included false images of Emily Maitlis speaking to banking CEOs regarding an “accidentally leaked” investment opportunity. Further activity in this campaign saw additional deepfakes of the same scenario used in lures on X.
These deepfake lures were supported by a fake article on a site imitating the BBC. The use of fake news sources can further legitimise this scam in the eyes of would-be victims and make it less obvious that a cryptocurrency investment scheme is the source behind the salacious headline.
This threat actor released these images over dozens of accounts making these claims, expanding to other language targets and impersonated persons, still focusing on journalists and executives. In the below example, the scheme is repeated as a leaked conversation between Italian journalist Lilli Gruber and wealthy John Elkann, chairman of Stellantis and CEO of Exor.
Investment scheme lure claiming to show a secret conversation between Lilli Gruber and John Elkann.
This format has continued with “leaked” conversations and confrontations involving banking executives. Another example targeting UK audiences included deepfake video and images of Reform UK leader Nigel Farage arguing with and pointing a gun at Andrew Bailey, the governor of the Bank of England.
Though this strays from the journalist-banker format, Nigel Farage’s image being used in this scheme may be explained by his ties to cryptocurrency magnates and his party’s stance on cryptocurrency.
Deception through trusted advisors
Other scams have relied on impersonation of trusted public financial advisors, such as Martin Lewis in the UK, a financial journalist and one of the nation’s leading consumer rights activists. According to NatWest’s Scam Super League, deepfakes of Lewis have accounted for some of the largest financial losses among celebrity personalities used in scams. Scam lures abusing his reputation are often distributed through fake accounts and ads on social media platforms. As a source of trusted financial advice and a consumer advocate, his reputation is particularly useful for scammers wishing to legitimize their own operations.
In the above example, Lewis was also deepfaked alongside another common impersonation target: Elon Musk. Musk’s image has been one of the most commonly used in cryptocurrency investment schemes, benefiting from his association with memecoins, his wealth, and his fame. Though his image had been appropriated for scams prior to the rise of deepfake technology, Musk has further had his image used by scammers with voice and video deepfakes.
In other cases, where credibility for a service may be built by testimonials, unknown faces are deepfaked to create fake happy customers. Netcraft has observed this in recovery scams aimed at re-victimizing those who have already lost money to scammers.
A fake customer appearing in a testimonial video for a recovery scam.
Multi-modal scamming
As deepfakes become easier to produce and weaponise, they are becoming more frequently deployed across different formats. Voice, image, and video can each be deepfaked cheaply. However, when scammers promote their schemes through multiple formats, this can appear as a more robust narrative. In the above example of banker and journalist confrontations, the use of video in ad lures and images in fake news stories is one of the ways that deepfakes can aid in creating the appearance of multiple sources. It is important to verify media not just by the existence of corroborating content but checking that those other content sources are legitimate as well.
What now and what’s next
The rise of deepfakes’ use in scams can be tied to the rising ease of creating convincing images, the lowering costs of deepfake generation, and political polarisation that can be used to gain interest through lures showing controversy. They still rely on the same emotional appeals of many scams but with a cheap sense of credibility added. As scams go forward, deepfakes will almost certainly continue to become a normalised part of threat actor capabilities. Meanwhile, taking down such deepfakes may increasingly rely on a holistic view, evaluating the legitimacy of hosting and delivery infrastructure in addition to media content.
