FinCEN’s deepfake alert was a job-design problem for three groups of staff

The week

On November 13, 2024, the Financial Crimes Enforcement Network issued an alert to help financial institutions identify fraud schemes that use deepfake media created with generative AI. FinCEN said it had seen an increase in suspicious activity reports describing suspected deepfakes, particularly altered or synthetic identity documents and images used to open accounts and evade identity checks. The alert listed red flags, including inconsistencies between identity documents and other customer information, customers who could not authenticate convincingly during live verification, and the use of tools that inject images into a webcam feed. It asked institutions to use the key term “FIN-2024-DEEPFAKEFRAUD” in related reports. Earlier in 2024, the engineering firm Arup had confirmed that an employee in Hong Kong transferred about $25 million after a video call with deepfaked colleagues.

FinCEN alerts usually land with financial crimes compliance teams, who translate them into monitoring rules and training. That work was needed here. Earlier articles in this series covered the technical side: authentication that does not rely on purchasable facts, and the evidence New York’s regulator expected for AI-driven impersonation. This alert raised a different question. Inside every bank and credit union, some employees are allowed to act because a face, a voice or a document looks right. Generative AI makes recognition unreliable, so those jobs have to be redesigned.

Three groups of staff hold that kind of authority, defined by whom they are asked to trust. Onboarding reviewers decide whether a new applicant is real. Service agents in contact centers and branches decide whether a caller or visitor is an existing customer. Payment and treasury operators decide whether an internal request comes from a real colleague. Each group has different managers, metrics and failure modes, and each needs its own redesign. All three also feed the institution’s suspicious activity reporting, which ties the redesign together.

Onboarding reviewers: exceptions are where synthetic applicants get through

The alert focused on account opening. Fraudsters used generated or altered documents and synthetic selfies to pass remote identity verification, then used the accounts to receive and move illicit funds. Automated document and liveness checks catch much of this. What they do not catch goes to a human exception queue.

That queue is where job design matters. Reviewers are usually measured on throughput and backlog age. A reviewer who spends ten minutes on a suspicious application lowers their numbers, and one who approves it moves on. Institutions can change that by adding quality measures, such as post-approval fraud rates by reviewer, and by giving reviewers a fast path to escalate without penalty. Reviewers also need training on the alert’s specific indicators, such as photos with visual artifacts, identity documents that do not match the device or location data, and live checks interrupted by claimed technical glitches. The vendor relationship belongs here too. Institutions should ask identity verification providers how they detect injected video and synthetic faces, and how often those detections are retrained.

Service agents: recognition must stop being a credential

Contact center agents and branch staff authenticate existing customers, often by voice and by knowledge questions. Voice cloning can reproduce a voice from a short recording, and knowledge answers are widely available after years of breaches.

The redesign removes recognition from the agent’s decision. Verification should come through a channel the attacker does not control, such as a push approval in the customer’s app or a callback to a long-standing number. The system, not the agent, should then show a pass or fail. Agents then need explicit permission to slow down a caller who sounds right but fails that check, and scripts that make refusal routine rather than confrontational. Handle-time targets should exclude calls escalated for verification, or agents will quietly work around the control. Requests to change phone numbers, addresses, payees or limits deserve a second check, because those changes typically come before the loss.

Payment and treasury operators: the fake executive problem

The Arup case showed that the target need not be the customer. An employee can be persuaded to move money by an apparent senior colleague on a video call. Treasury, wire operations and accounts payable staff in financial institutions execute large transfers every day.

Here the redesign is about authority. Payment authorization should rest on a process, never on a person’s recognition of a colleague. Requests should arrive through a defined system, with dual approval by people using phishing-resistant authentication. Any change to payment instructions should be verified through an independent channel, using contact details already on file. The decisive element is cultural: a written statement from senior leadership that no executive will ever request an urgent payment outside the process, and that staff who refuse such a request will be supported. Without that statement, a convincing deepfake of the CFO tests an operator’s career risk as much as their judgment.

Practice makes the commitment real. Some institutions already run simulated phishing; the same idea extends to a scheduled test call or message, apparently from a senior leader, asking an operator to bypass the process. The exercise should end by rewarding the refusal publicly. A test that ends in a reprimand teaches staff to hide near misses, which is the opposite of what the reporting loop needs.

All three groups connect through reporting. FinCEN’s key term lets the government aggregate cases. Inside the institution, consistent tagging shows which group is being targeted and whether its controls are working. That only works if front-line staff can record a suspected deepfake easily, and if investigators send findings back to the teams that saw the attempt. A monthly summary to each group’s manager, with examples, keeps training current as generation tools change.

With hindsight

The alert’s categories held up through 2025 and 2026. Synthetic and altered identities kept targeting account opening, and identity verification vendors invested heavily in injection and liveness detection, with generation tools improving at the same time. Impersonation of senior figures spread beyond companies. In May 2025 the FBI warned that malicious actors were sending AI-generated voice messages impersonating senior U.S. officials to build trust before seeking access or information. Voice-based authentication lost ground as a primary control in contact centers, and phishing-resistant methods gained it. Across these cases, the controls that held were procedural: verification through channels the attacker did not control, dual authorization with independent callback for payments, and staff who had explicit permission to say no. Where an institution treated the alert only as a monitoring exercise, the front-line roles remained the weakest point.