What is a deepfake?

Definition

A deepfake is synthetic media that makes it look or sound like a real person said or did something they didn't. Voice cloning from a short audio sample is the version advisors are most likely to meet.

The same technology powers legitimate AI avatar and voice tools, which some firms use for marketing videos with the person's consent.

Why it matters for advisors

The main risk is fraud: a cloned client voice asking for a wire, or a fake executive video call authorizing a transfer. FINRA's 2026 oversight report asks firms to consider how threat actors may use AI against the firm or its customers, and the SEC's fiscal 2026 exam priorities say examiners will look at the controls firms use to identify and mitigate new risks associated with AI.

Verification procedures that don't rely on recognizing a voice (call-backs to a known number, a second approver) are the practical defense.

Train staff on the warning signs and give them a simple rule: urgency plus an unusual request equals a callback. Scammers count on people acting before they think, so a habit of verifying through a known number is the best defense.

Example

A caller who sounds exactly like a long-time client asks for an urgent withdrawal to a new account. The firm's procedure requires a call-back to the number on file, which reveals the fraud.

Watch out for

If you use AI avatars or voice clones in your own marketing, disclose it and get written consent from anyone depicted.