AI, Impersonation, and Investor Fraud: What Every Organization Should Learn From the SEC's Latest Warning
As Cybersecurity Awareness Month continues, we are turning from how AI behaves inside your firm to how criminals use AI against it. To kick off the month, we looked at AI tools that ignore their guardrails. This week, the threat comes from the outside.
During World Investor Week 2026, the SEC, CFTC, FINRA, NASAA, NFA, and SIPC released a joint Investor Bulletin. It warns that AI has made impersonation scams more convincing and harder to tell apart from the real thing.
The bulletin is written for investors. However, the same tactics are now aimed at employees, executives, and vendors. AI impersonation fraud is no longer just a consumer problem. It is a business problem.
Key Takeaways
- The SEC and five partner regulators warned in October 2026 that AI is making impersonation scams harder to detect.
- The FBI recorded $20.9 billion in internet crime losses in 2025, including $893 million tied to AI.
- Deepfake voices and video can now impersonate executives convincingly enough to trigger multimillion-dollar wire transfers.
- The best defense is independent verification: call back on a known number, require dual approval, and test staff with realistic AI scenarios.
What Is AI Impersonation Fraud?
AI impersonation fraud is a scam in which criminals use artificial intelligence to pose as a trusted person or organization, such as a CEO, a vendor, or a regulator. They use cloned voices, deepfake video, fake documents, or AI-written messages to convince victims to send money or share sensitive information.
The Numbers Behind AI Impersonation Fraud
The SEC is not the only agency sounding the alarm. The data from across government tells the same story.
- $20.9 billion in reported losses. The FBI’s 2025 Internet Crime Report logged over one million complaints for the first time, a 26% jump in losses from 2024.
- $8.6 billion lost to investment fraud and $3 billion lost to business email compromise (BEC). Together, they make up more than half of all losses the FBI tracked.
- AI gets its own category. For the first time in the report’s 25-year history, the FBI tracked AI-related complaints separately: 22,364 complaints and about $893 million in losses.
- Imposters lead the pack. The Federal Trade Commission says imposter scams were the most reported fraud in 2025, with $3.5 billion in losses.
In short, investment scams and impersonation scams are the two costliest fraud trends in the country. AI is now fueling both.
When the CFO on the Video Call Isn't Real
If this still sounds like a consumer issue, consider what happened to Arup, the global engineering firm behind the Sydney Opera House.
In early 2024, a finance employee in Arup’s Hong Kong office joined a video call with the company’s CFO and several colleagues. Every person on that call was a deepfake. Convinced by faces and voices he recognized, the employee sent about $25.6 million across 15 transfers. Arup later confirmed to CNN that fake voices and images were used.
The attackers did not hack a single system. They simply looked and sounded like the people the employee trusted.
Government leaders are targets too. In May 2025, the FBI warned that criminals were sending AI-generated voice messages posing as senior U.S. officials to gain access to accounts. The FBI’s advice was blunt: do not assume a message is real just because it sounds familiar.
Why This Matters for Your Firm
1. Trust is the new attack surface
The SEC bulletin describes “relationship investment scams,” where criminals spend weeks building rapport over text or social media before asking for money. That is the same playbook behind BEC, vendor payment fraud, and executive impersonation. Attackers win by earning trust first, then exploiting it.
2. Seeing and hearing is no longer believing
A familiar voice, a face on a video call, or an email from the right address used to be enough. Not anymore. The U.S. Treasury’s FinCEN alert on deepfake fraud reports that criminals are using AI to create fake IDs, photos, and video to get past identity checks at financial institutions.
3. Fake "official" documents are part of the scam
The SEC also warns that fraudsters misuse real SEC filings, such as Form D and Form 4, and even fake SEC certificates to look legitimate. For asset and wealth managers, this means your firm’s name, filings, and people can be used as props in someone else’s scam.
How to Defend Against AI Impersonation Fraud
The common thread across the SEC, FBI, and FinCEN guidance is simple: verify, don’t trust. Here is where we recommend firms start.
- Use out-of-band verification. Confirm every wire request or change in payment details by calling a known number on file, never one provided in the request.
- Require two people for money movement. Dual approval stops a single deceived employee from sending funds.
- Agree on a code word. Executives and finance teams can use a private phrase to confirm urgent requests made by phone or video.
- Deploy phishing-resistant MFA. Follow CISA’s guidance on phishing-resistant MFA to protect email and financial accounts from takeover.
- Lock down your email domain. Check that DMARC, SPF, and DKIM are set up correctly so criminals can’t spoof your firm’s address.
- Update your training. Add deepfake voice and video scenarios, and teach staff that a polished message is not proof of identity.
- Test your people. Run social engineering exercises that reflect today’s AI-enabled tactics, not last decade’s phishing emails.
For a deeper look at payment controls, watch our webinar, The Wire Fraud Epidemic and How to Protect Your Firm.
Frequently Asked Questions
What did the SEC's World Investor Week 2026 bulletin warn about?
The joint bulletin from the SEC, CFTC, FINRA, NASAA, NFA, and SIPC warned that relationship investment scams and impersonation scams are rising. It noted that AI makes impersonations of people, firms, and even regulators more convincing.
How much money is lost to AI-enabled fraud?
The FBI’s 2025 Internet Crime Report tracked AI separately for the first time. It recorded 22,364 AI-related complaints with about $893 million in losses.
How can a business spot a deepfake call or video?
Don’t rely on how someone looks or sounds. Watch for urgency, secrecy, or a request to move money or change payment details. Then hang up and verify through a known phone number or a second approver.
What is the best defense against AI impersonation fraud?
Independent verification. Confirm every financial or sensitive request through a separate, trusted channel, and require more than one person to approve payments.
Are investment firms more at risk?
Yes. Asset and wealth managers move large sums and hold sensitive client data. Fraudsters also misuse SEC filings and firm names to make their scams look legitimate.
How BW Cyber Can Help
AI has changed what a convincing scam looks like. Our team helps firms close the gaps attackers exploit. We will:
- Test your defenses with social engineering exercises built around real AI-enabled tactics, through our Security Testing services.
- Review your payment and approval workflows to make sure no single call, email, or video can move money.
- Assess AI-related risk across your firm as part of our AI Risks and Governance Services.
Don't Let a Familiar Face Fool Your Firm
The SEC’s warning was written for investors, but the lesson applies to every organization. Today’s attacks exploit trust first and technology second. Therefore, the firms that stay safe will be the ones that verify every request, no matter how real it looks or sounds.
Contact BW Cyber to find out how prepared your team is for AI impersonation fraud.
This Cybersecurity Awareness Month, let’s make verification a habit, not an afterthought.
