Incident Overview
On May 1, 2026, Veriff, an identity-verification company based in Europe, confirmed an incident where scammers used a real-time deepfake of its CEO, Kaarel Kotkas, to target an employee via WhatsApp. The attack involved a fraudulent video call initiated through an urgent message sent to Andrea Rozenberg, who leads Veriff’s emerging markets division. The deepfake appeared convincing enough to prompt Rozenberg to engage in a video call, during which the impersonation was detected. The fraudulent call was later identified as a live deepfake or video clone, a technique that synthesizes real-time audio-visual content to mimic an individual’s appearance and voice.
The incident stands as a notable example of how synthetic media, particularly real-time deepfakes, can be weaponized in social engineering attacks. Unlike static deepfakes, which are pre-recorded and edited, real-time deepfakes dynamically generate audio and video during a live interaction, making them harder to detect without careful scrutiny. In this case, Rozenberg noticed inconsistencies in the deepfake, specifically the absence of Kotkas’s Estonian accent, which raised suspicions. She subsequently verified the legitimacy of the request through internal communication channels on Slack, preventing the fraud from succeeding.
No financial loss was reported as a result of the incident, but the attempt underscores the growing sophistication of scammers using AI-generated synthetic media. Veriff publicly disclosed the incident to highlight the risks faced even by organizations specializing in identity verification and fraud prevention. The case serves as a warning that employees across industries, regardless of their technical expertise, remain vulnerable to AI-driven impersonation tactics.
The attack exploited WhatsApp’s end-to-end encryption and video call capabilities, platforms that are commonly used for secure communication but can also be misused for malicious purposes. The scammers likely utilized commercially available or custom-developed deepfake technology to create the real-time impersonation, demonstrating how accessible such tools have become for malicious actors. This incident aligns with broader trends in AI misuse, where synthetic media is increasingly deployed to deceive individuals and organizations.
Possible Root Cause
The primary root cause of this incident lies in the deployment of real-time deepfake technology by scammers to impersonate Veriff’s CEO. Real-time deepfakes differ from traditional deepfakes in that they generate synthetic media dynamically during a live interaction, rather than relying on pre-recorded content.
The scammers likely leveraged existing deepfake generation tools, which have become more accessible in recent years. In this case, the deepfake was delivered via WhatsApp, a platform known for its encryption and widespread use in both personal and professional communication.
The success of the impersonation attempt hinged on the realism of the deepfake, which was designed to mimic Kotkas’s appearance and voice with high fidelity. However, the absence of his Estonian accent served as a critical red flag for Rozenberg, highlighting how subtle linguistic or behavioral cues can sometimes reveal the artificial nature of synthetic media. This incident also points to the broader challenge of detecting real-time deepfakes, which may lack the visual artifacts often associated with static deepfakes.
Social engineering tactics often rely on creating a sense of urgency or authority to manipulate targets into compliance. In this case, the scammers positioned themselves as Kotkas, a figure of authority within the organization, to pressure Rozenberg into taking immediate action. The combination of a convincing deepfake and a well-crafted social engineering strategy made the attempt particularly dangerous.
Takeaways
This incident provides several critical insights into the evolving threats posed by AI-generated synthetic media, particularly in the context of real-time deepfakes. One key takeaway is the increasing accessibility of deepfake technology, which has lowered the barrier to entry for malicious actors.
The case also highlights the importance of multi-layered verification processes in mitigating the risks of AI-driven fraud.
Another significant lesson is the need for heightened awareness and training among employees regarding the risks of synthetic media. Even in organizations that specialize in identity verification, such as Veriff, employees must remain vigilant against AI-driven impersonation tactics. Training programs should emphasize the potential for real-time deepfakes and provide practical guidance on identifying inconsistencies in synthetic media, such as unnatural speech patterns or visual artifacts.
WhatsApp’s end-to-end encryption, while enhancing privacy, also creates challenges for detecting and preventing malicious activity.
From a broader perspective, this case aligns with the Domain Taxonomy of AI Risks, which categorizes risks associated with AI systems into seven domains, including malicious actors and misuse, as well as human-computer interaction.
Even organizations with robust security measures and specialized expertise in fraud prevention are vulnerable to sophisticated attacks.
Sources
Incident summary from the AI Incident Database, used under CC BY-SA 4.0.