From a Chief Minister to a Crypto CEO: The Deepfake Scam Playbook Every Company Should Know

This month, Tamil Nadu's Chief Minister became the latest public figure to have his likeness hijacked for a financial scam, a pattern worth every company's attention too.

On September 1, 2026, Tamil Nadu’s Cyber Crime Cell registered a case after AI-generated videos impersonating Chief Minister C. Joseph Vijay began spreading across Facebook and other platforms. The videos promised financial assistance and told viewers to reach out over WhatsApp to claim it. Authorities asked Meta to remove the content. No confirmed financial losses have been reported yet.

The OECD’s AI Incidents Monitor already logged this as a materialized incident, meaning it produced measurable economic and reputational harm. Institutions everywhere are already tracking this same pattern, well beyond one regional case.

Here is the detail worth sitting with: a government official was the target this time, and the method works just as well against a company’s own CEO.

Strip the incident down to its parts and the pattern becomes obvious. A recognizable face. A voice trained convincingly enough to sound official. An urgent promise of money. And a single, unofficial channel, in this case a WhatsApp number, built to catch anyone who reaches out before thinking twice.

Each of those four ingredients has existed for years. What’s changed is the cost and speed of assembling them, and how persuasively they can now be aimed at anyone with enough public video and audio to train from.

Hany Farid, a digital forensics researcher at UC Berkeley, has watched this shift up close, case after case. “Fraud is now being supercharged by generative AI in terms of voice scams,” he told Scientific American earlier this year. The same tools that can generate a training video or a customer service message can just as easily generate a government official promising money, or a CEO promising a bonus. These tools treat a Chief Minister and a chief executive exactly the same way. They only need a face and a voice public enough to learn from, and most visible leaders already provide plenty of both.

Public figures have had their faces and voices cloned to deceive people before, not always for money. In July 2025, an AI voice impersonating U.S. Secretary of State Marco Rubio contacted foreign ministers, a U.S. senator, and a governor over Signal, borrowing his voice to get past people who had no reason to doubt it. That same month, on the financial side, an AI-generated video of Ripple CEO Brad Garlinghouse promised XRP holders a fake 100-million-token airdrop, using his face to funnel believers toward fraudulent sites. Different office, different goal, the same trusted face or voice, borrowed.

Why This Reaches Every Company

Widen the lens for a moment. Any organization with a visible leader, a CEO on an earnings call, a founder posting on social media, a spokesperson in a training video, already has exactly the raw material this technique needs. The financial promise translates just as easily: a fake bonus announcement, a fake refund program, or a fake vendor payment update works exactly like a government benefit, each one wearing a convincing executive’s face.Öykü Işık, professor of digital strategy and cybersecurity at IMD Business School, put it directly last year: “Deepfake attacks succeed not simply because the technology is convincing, but because organizations are conditioned to respond quickly to senior authority.” That conditioning is exactly what a familiar face lets an attacker borrow: trust that took years to build, spent in a single phone call or video conference.

A finance director at a multinational company in Singapore learned this the hard way last year. In March 2025, he joined what looked like a routine video call with the firm’s CEO and other senior leaders to discuss a confidential restructuring. Every face on that call was synthetic. He transferred roughly US$499,000 before a follow-up request, for another US$1.4 million, exposed the scheme. Singapore’s police worked with counterparts in Hong Kong to trace and freeze the funds within three days, but the mechanism that moved the money matched the pattern above exactly: a familiar face, an urgent financial reason, a channel built to feel legitimate.

This is a shared challenge: public institutions and private companies are learning from the same handful of incidents, and the organizations that learn to verify a familiar face before acting on its requests fastest will be the ones borrowing lessons from wherever they appear, instead of waiting for their own version of the story.

Here is the encouraging part. The response to the Tamil Nadu case moved fast: less than a day passed between the videos spreading and a formal cybercrime case being filed, and authorities went directly to the platform hosting the content and asked for its removal instead of leaving the public to sort out what was true on their own. Companies do not need to wait for a coordinated global response to build the same instincts into their own operations.

Building the Same Instincts Into Your Company

A few actions make the biggest difference.

• Publish one official channel for anything involving money, and repeat it often enough that everyone in the building knows it by heart. A bonus announcement, a refund, a benefits update, all of it should point to the same source, so anything arriving through a different channel stands out immediately.
• Watch for impersonation of executive likeness and voice across video and social platforms, not only in email inboxes. The tools have moved past text, and monitoring built only around phishing emails will miss this pattern entirely.
• Build the relationship with platforms before an incident, not during one. Knowing who to contact and how to request a takedown turns a scramble into a routine step.
• Brief leadership and communications teams on the exact shape of this scam: a familiar face, urgent financial language, one unofficial contact method. People spot a pattern fastest when they already know what it looks like.
• Farid’s own answer to this problem is refreshingly simple, and it mirrors something security teams already teach for phone scams. “I love safety words,” he said. “My wife and I have one. It's an analog solution to a digital problem.” A company can build the same habit at scale: a phrase or a callback number, agreed on in advance, that no video or voice clone can guess.

A government office in Tamil Nadu just saw AI-generated videos hijack its own leader's likeness for a scam. A trusted face now has to be actively protected instead of quietly assumed. The organizations that come out ahead will not wait for their own headline. They will borrow this one.