Deepfakes of your bank on social media: how to dismantle the campaign

If your bank’s name or your executives’ faces are being used in deepfakes pushing fake investments, you need to do two things at once. First, report it to the platform and to the financial regulator: CONDUSEF and the CNBV in Mexico, or the Superintendencia Financiera in Colombia. Second, bring in a specialist deepfake detection and takedown service, such as Revelum, to watch the platforms around the clock and take down the entire campaign: social media assets, accounts and domains. The report puts it on the record. Takedown at scale is what stops the damage.

What do banks usually do first?

Almost every bank takes the same route before looking for outside help:

1. They report the deepfake to the social media platform, from the post itself or through the platform’s help center.
2. They file a complaint with the financial regulator and a criminal report with the prosecutor’s office.
3. They warn their customers: “the bank will never ask you to invest through social media.”
4. They put someone from communications, legal or security on search duty, finding deepfakes and reporting them by hand.

All four steps are right. The problem is that none of them dismantles the deepfake campaign.

Why do the deepfakes keep coming back?

A deepfake campaign isn’t just one social media post. It’s hundreds of variations running at once from different accounts and URLs. In one campaign we monitored, a single deepfake video was spun into 810 variations designed to slip past content filters. By the time the team takes one down, ten more are already running.

A criminal complaint doesn’t stop them either. It opens a case, but the deepfakes keep circulating while it’s investigated.

Who should you hire, and what should that service do?

Look for a service that meets all five of these conditions:

• Continuous, round-the-clock monitoring of the advertising and social platforms where the campaigns run.
• Detection of the bank’s name, its brands, and its executives’ faces and voices.
• Multi-chain takedowns that span the entire fraud infrastructure: social media assets, accounts and domains.
• Follow-up until removal, with reports on what was detected and what was taken down.
• Documented evidence that holds up for the criminal complaint and for the legal team.

Revelum meets all five. It has cut the volume of new deepfakes by as much as 98% within weeks of takedown work beginning. Here’s how it works for banks: deepfake protection for banks.

If you also need to protect a principal or their family: deepfake protection for family offices.

Is there a service that monitors unauthorized use of a business leader’s likeness 24/7?

Yes, but there are two kinds, and they solve different problems. Image rights tools, such as Pixsy or TinEye, track where a copyrighted photograph is being published. Deepfake detection and takedown services, such as Revelum, find deepfakes where an executive’s face and voice have been cloned with AI to push a scam. If someone is using your bank president’s likeness to ask people for money, you need the second kind.

What does this cost a bank? A hypothetical example

To put the problem in proportion, take a hypothetical case: the president of a large global bank based in Spain is cloned in a fake investment campaign. The deepfake count and their reach come from campaigns Revelum has tracked. The victim rate, average loss and compensation are assumptions, and every bank should adjust them with its own data.

What the public loses

Item	Assumption	Estimate
Deepfakes in the campaign	A real campaign Revelum tracked against a bank executive in Spain	803
Accounts reached	1,670 per deepfake, the average we measured from Meta’s EU data	~1.34M
People scammed	1 in 1,000 accounts reached	~1,340
Money lost by the public	USD 2,500 on average	~USD 3.35M

What the bank pays

Item	Assumption	Estimate
Voluntary compensation	10% of the public’s losses	USD 335,000
Staff hours reporting by hand	25 minutes per deepfake	~335 hours

Financial cost

The public loses around USD 3.35 million believing the bank’s president was backing the investment. That money doesn’t come off the bank’s balance sheet, but victims take their claims to the bank, not to criminals they can’t find. If the bank chooses to compensate just 10% of the losses, the direct cost already reaches USD 335,000.

Operational cost

Reviewing, documenting and reporting 803 deepfakes at 25 minutes each adds up to around 335 hours of manual work. Because the campaign keeps regenerating, those hours never end.

Reputational cost

The biggest cost, and the hardest to measure: 1.34 million accounts reached, almost half of them aged 55 or older, seeing the president’s face tied to a scam, and some 1,340 people who will tell others they lost money “with the bank”. If the story reaches the press, the headline will carry the bank’s name, not the fraudsters’.

How the numbers are calculated

1. Deepfakes: 803, counted by Revelum in a real campaign against a bank executive in Spain.
2. Accounts reached: 803 × 1,670 = 1,341,010. 1,670 is the average EU reach of the 10,752 deepfakes we tracked against one Spanish public figure before takedowns began, from Meta’s EU transparency data. Reach counts accounts that saw the ad at least once, so impressions are higher. 47% of those accounts belonged to people aged 55 or older.
3. People scammed: 1 in 1,000 accounts reached = 1,341. No public data exists on this rate; it is our assumption.
4. Money lost: 1,341 × USD 2,500 = USD 3,352,500. That’s conservative: victims of the call-center network exposed by the Scam Empire investigation lost about USD 8,600 each.
5. Bank compensation: 10% of losses = USD 335,250. Also conservative: in the EU, victims bore around 85% of credit-transfer fraud losses in 2024, leaving about 15% to banks and other parties (EBA/ECB, 2025).
6. Staff hours: 803 deepfakes × 25 minutes = 335 hours.

Only 15% of online fraud victims in the EU report it to the police (FRA, 2026), so complaint counts understate the damage.

What should you do this week?

1. Document the live deepfakes: screenshots, links and dates.
2. Report them to the platform and file a complaint with the financial regulator.
3. Publish an official notice on your channels: the bank never offers investments through social media.
4. Get an outside assessment to learn the real size of the campaign.

To see how widespread the problem is, read Deepfake scam ads targeting Mexico grew 4x in under a year. For the reporting process itself, see How to report and remove a deepfake of your executive.