AI-generated media is getting harder to detect. Singapore is not immune. Here is what deepfakes are. Here is how they fool people. Here is what to look for.
THE SHORT VERSION
- Deepfakes can fake videos. They can fake audios. They can fake an entire identity.
- Singapore has already seen losses in the millions from scams using this technology.
- Visual tells are getting unreliable. Verifying the source is the safer habit.
- If you suspect one: do not share it. Call the person on a known number. Call 1799 if unsure.
What is a deepfake?
A deepfake is a piece of media (video, audio, or image) in which a person’s likeness or voice has been altered or fabricated using artificial intelligence. The name combines “deep learning” and “fake.”
In Singapore the threat is growing fast. GovTech reports that 56% of Singaporean businesses have experienced audio deepfake fraud. For video deepfakes the figure is 52% (GovTech citing SecurityBrief Asia).
How they work
Most modern deepfakes are generated using advanced AI models known as Generative Adversarial Networks (GANs). One AI system creates fake content while another attempts to detect whether it is genuine. Through continuous training, the generated content becomes increasingly realistic.
(Source: SentinelOne).
A shallowfake is something different. It uses simple editing such as slowing or splicing. No AI involved. Easier to spot but still misleading.
Four Types of Deepfakes Every Business should know
1. Face swapping
One person’s face is mapped onto another person’s body in a video. The most common type. Used in fraud and non-consensual content.
2. Face reenactment
The real face stays. Its expressions and mouth movements are puppeteer to say things the person never said. Often used against public figures.
3. Voice cloning
AI systems can replicate a person’s voice from a short audio sample, typically 10–15 seconds.
Cybercriminals often use this technique to impersonate executives, suppliers, or family members and request urgent payments or sensitive information.
4. Fully synthetic faces
AI can generate realistic human faces that do not belong to any real person.
These fake identities are increasingly used to create fraudulent social media profiles, job applicants, investment testimonials, and online personas.
Real Deepfake Case Studies in Singapore
These are not hypothetical. The cases below were disclosed by Singapore authorities.
March 2025 / Fake CEO Zoom call / US$499,000
A finance director at a multinational firm joined a Zoom call with what looked like the company’s CFO and other executives. All of them were deepfakes. He transferred US499,000. He only grew suspicious when scammers requested a further US1.4 million. The Anti-Scam Centre worked with Hong Kong Police to recover the funds within days.
Source: Singapore Police Force media release, April 2025
March 2025 / PM Lawrence Wong impersonated
PM Wong warned the public on Facebook and X about deepfakes of his image being used to push cryptocurrency schemes. He urged people not to respond and to report content through ScamShield.
April 2025 / Former President files police report
Former President Halimah Yacob filed a police report after a deepfake video circulated featuring fabricated negative comments attributed to her about the government.
Source: GovTech Singapore citing Channel NewsAsia
May 2026 / Fake government Zoom meeting / S$4.9 million
The Singapore Police Force disclosed a scam in which a victim lost at least S4.9 million (about US3.8 million). Contact began on WhatsApp from someone using the Secretary to the Cabinet’s profile photo. The victim signed an NDA and submitted his ID. He was then invited to a Zoom meeting on the Strait of Hormuz “funding.” The call featured deepfakes of PM Wong. President Tharman. Minister Indranee Rajah. MAS representatives. Canada’s foreign minister. A UAE presidential adviser. Executives from BlackRock and the Dubai International Financial Centre. It ended with a deepfake of PM Wong personally acknowledging the victim by name. A fake “lawyer” then pushed the transfer through.
Source: SPF news releases 14 and 16 May 2026 (police.gov.sg); reported by Channel NewsAsia and SCMP
For context / Hong Kong / US$25 million
Not a Singapore case but widely cited as a warning. In 2024 a finance employee at engineering firm Arup in Hong Kong authorised transfers of about US$25 million after a video call where the CFO and colleagues were all deepfakes.
Source: CNN (cited by SentinelOne and Withers KhattarWong)
How a deepfake scam unfolds
Most of the financial cases follow the same pattern. The chain can be broken at any stage by pausing to verify on a separate channel.
Typical stages of a deepfake impersonation scam in Singapore.
How to identify a Potential Deepfake
CATOS director Yang Yanping cautions that visual tells are becoming unreliable as AI improves. Still no single sign confirms a deepfake. Look for a combination.
- Unnatural blinking or lip movement. Early deepfakes blinked less than real people.
- Skin that looks waxy or too smooth, or a mismatch between the face, hair, and eyes.
- Eye reflections that do not match. In a real person, the reflection in both eyes should be consistent (University of Hull research).
- Lighting that conflicts with the scene. Face shadows should match the light sources in the background.
- Audio that feels off. Odd pacing or flat emotion on a call with no video is a red flag.
- Urgency as a pressure tactic. Unusual financial request? Pause. Call the person at a number you already have.
Deepfake Detection and Verification Tools
Provo - free verification tool launching 2026
A free tool from CATOS at A*STAR embeds provenance labels into images and videos. Think of it as a nutrition label for digital media. If a label is missing or broken, that is itself a signal. A free browser extension lets anyone inspect the labels. Singpass integration is being explored. Built on technology agreed upon with Adobe in 2024. More details are expected in May 2026.
Sleuth - AI-Powered Deepfake Detection
Also developed by CATOS, Sleuth analyses images and videos for subtle digital artefacts and inconsistencies that may not be visible to the human eye. This includes pixel-level anomalies, irregular compression patterns, and signs of AI-generated manipulation that can indicate synthetic content.
Already in use at some public agencies and media companies. Part of a S$50 million investment under Singapore’s Research, Innovation and Enterprise 2025 Plan.
“Together with deepfake detection technology these tools can contribute to the scene of maintaining information integrity on the internet.”
Yang Yinping CATOS Director (The Straits Times November 2025)
National detection and Anti-Scam Ecosystem
INDEPTH is an internal deepfake detection hub for government agencies. It was deployed under the Elections (Integrity of Online Advertising) Act during the 2025 General Election. SATIS scans hundreds of thousands of websites a day for scam infrastructure. ScamShield protects the public: a free app for reporting suspicious calls and messages plus a 24/7 helpline on 1799 (Source: GovTech Singapore).
Legal and regulatory backdrop
The Elections (Integrity of Online Advertising) Act bans deepfake misrepresentation of election candidates. The Protection from Harassment Act gives recourse to individuals harmed by deepfakes. MAS issued draft Guidelines on AI Risk Management for public consultation on 12 November 2025 covering generative and synthetic-media models (Sources: GovTech Singapore; Withers KhattarWong).
If you suspect one
- Do not share. Sharing amplifies it.
- Verify on a known channel. Call the person on a number you already have.
- Report it. To the platform. To the police if money is involved. Or call ScamShield on 1799.
Five Security Controls Every SME should Implement Against Deepfake Fraud
1. Establish Out-of-Band Verification Procedures
Any request involving money transfers, sensitive information, changes to banking details, or disclosure of confidential data should be independently verified through a separate communication channel.
For example:
- A CEO requests an urgent transfer during a Teams or Zoom call.
- A supplier emails updated banking instructions.
- A senior executive leaves a voice message requesting sensitive documents.
Before taking action:
- Call the person using a known telephone number
- Use an existing corporate contact channel
- Verify the request with another authorised stakeholder
Remember: Never trust a request simply because the face or voice appears familiar.
2. Enforce Multi-Person Approval for Financial Transactions
Most successful deepfake scams target employees with the authority to approve payments.
Implementing a dual-approval or maker-checker process significantly reduces the likelihood of fraud.
Recommended controls:
- Two-person approval for all fund transfers
- Escalation procedures for unusually large transactions
- Verification requirements for changes to vendor bank accounts
- Independent approval chains for executive requests
No single employee should have the ability to execute high-value transactions based solely on verbal instructions or video calls.
3. Strengthen Identity Verification with MFA
Deepfakes are often combined with other attack techniques such as phishing, credential theft, and account compromise.
Organisations should implement:
- Multi-Factor Authentication (MFA)
- Conditional Access Policies
- Passwordless authentication where possible
- Privileged Access Management (PAM)
Even if an attacker successfully impersonates a trusted individual, strong identity controls can prevent unauthorised access to business systems and sensitive information.
4. Train Employees to Recognise AI-Enabled Social Engineering
Technology alone cannot stop deepfake attacks.
Security awareness training should include:
- Deepfake videos and voice cloning examples
- Business Email Compromise (BEC) scenarios
- Executive impersonation scams
- Verification and escalation procedures
- Reporting channels for suspicious requests
Regular awareness programmes help employees develop a healthy level of scepticism without slowing business operations.
The goal is not to distrust everyone, it is to verify before acting.
5. Develop a Deepfake Incident Response Plan
Every organisation should have a documented response process before an incident occurs.
Your plan should cover:
Detection
• How suspicious media is reported
• Who evaluates potential deepfake incidents
• Escalation procedures
Containment
• Removing fraudulent content
• Blocking malicious accounts
• Limiting further exposure
Investigation
• Preserving evidence
• Collecting logs and metadata
• Engaging forensic specialists where necessary
Communication
• Internal employee notifications
• Customer communications
• Regulatory reporting obligations
Recovery
• Restoring trust
• Reviewing control gaps
• Updating policies and training
A rapid response can dramatically reduce financial losses and reputational damage.
Sources
Zou Yu Heng is a cybersecurity and digital forensics practitioner specializing in vulnerability assessment, security testing, and risk management. He is actively involved in website and business security assessments and supports organizations in identifying and mitigating cybersecurity risks. As a member of the ISO/IEC 27001 and SS 714 Data Protection Trust Mark (DPTM) implementation team, he contributes to incident response, vulnerability testing, and IT policy development. Yu Heng holds a Diploma in Cybersecurity from Singapore Polytechnic.
Technical review and contributions by: Jamson Lim
Jamson Lim is an IT and cybersecurity professional with over 20 years of experience in cloud security, data protection, secure infrastructure, and AI workflows.
He holds a Master of Computing from the National University of Singapore and an Advanced Diploma in Data Protection from Singapore Management University. His certifications include Certified Ethical Hacker (CEH), Practitioner Certificate in Personal Data Protection, and Certified Linux Systems Engineer (CLSE).
Throughout his career, Jamson has supported small and medium-sized enterprises (SMEs), non-profit organizations (NPOs), and regulated industries in strengthening their cybersecurity posture and compliance frameworks. His advisory work covers ISO/IEC 27001 Information Security Management Systems (ISMS), Singapore’s Personal Data Protection Act (PDPA), the Monetary Authority of Singapore’s Technology Risk Management (MAS TRM) Guidelines, and the Ministry of Health’s Cybersecurity and Data Security Essentials (CS/DS Essentials) under the Health Information Act (HIA).
Need help protecting your organisation against AI-powered threats?
Entrust Network provides cybersecurity assessments, Microsoft 365 security reviews, security awareness training, vulnerability assessments, and incident response services to help organizations defend against emerging threats, including deepfake-enabled scams and business impersonation attacks.
