Impersonation is an old trick; what has changed is how cheap it has become. Criminals can turn publicly available video and audio into a "manager" convincing enough to fool staff[1], and generative AI cleans up the spelling mistakes and rough edges that used to give fraud away[2]. For a company the risk runs in two directions. Criminals pose as your boss, colleagues or business partners to get your people to send money or hand over access; and they use your company's name, through fake websites, fake fan pages and fake customer-service lines, to defraud your customers and job seekers, leaving you to deal with the complaints and the damage to your reputation.

This article is for finance and procurement managers, IT help desks, customer-service and brand/marketing staff, and the managers who decide on process and budget. Email phishing, business email compromise (BEC) and verifying payment-detail changes are covered in Phishing and Business Email Compromise and are not repeated here. This article focuses on deepfake impersonation by voice and video, monitoring and taking down brand impersonation, the relevant parts of Taiwan's Fraud Crime Hazard Prevention Act, and what to do once money has already left the account.

Deepfake executives: seeing the boss is no longer verification

The Hong Kong case: a pre-recorded video conference

In a written reply to the Legislative Council on 26 June 2024, Hong Kong's Secretary for Security described a case reported to police at the end of January 2024. The victim received a phishing email from someone posing as the chief financial officer of the company's UK head office and was invited to a multi-person video conference about "confidential transactions"; following instructions, the victim authorised transfers to five local bank accounts and lost about HK$200 million[1]. Police believe the conference was pre-recorded using publicly available online video and the voice of the impersonated officer, so there was no real interaction between victim and fraudster; after giving instructions, the fraudster ended the meeting on a pretext and continued issuing payment instructions over instant messaging[1].

The same reply describes a second case: on 20 May 2024, an employee of a multinational trading company received a WhatsApp message from someone posing as the UK head office's CFO and joined a video conference lasting nearly 30 minutes, in which the "fake boss" asked for a transfer of nearly HK$4 million; police believe the content played in the meeting was public online video altered with deepfake technology[1].

Why "I saw him, I heard him" is not verification

The FBI's Internet Crime Complaint Center (IC3) warns that criminals use AI-generated video for real-time video chats posing as company executives, law enforcement or other authority figures, and use AI-generated audio to impersonate individuals and gain access to their bank accounts[2]. IC3 lists imperfections to look for, such as distorted hands, feet or faces, unnatural shadows, lag and mismatched voices[2], but it also notes that generative AI can correct the human errors that used to serve as warning signs of fraud[2]. Telling real from fake by eye and ear will only get harder.

Many executives have earnings calls, interviews or talks posted online, and the Hong Kong case was built from exactly this kind of public material[1]. The practical assumption is that any executive's face and voice can be cloned, so "I saw the boss on the video call" or "it was definitely his voice on the phone" can never count as authorisation. Verification has to rest on things the attacker cannot control: a call you place yourself, a process agreed in advance, and confirmation from a second person.

Verify by process, not by eye

  • Define high-risk requests first: payments, adding or changing a payee account, sending confidential data, resetting passwords or MFA, granting system access, buying vouchers or gift cards. Any such request goes through the same verification whether it arrives by email, messaging app, phone or video.
  • Hang up and call back: IC3 advises hanging up, looking up the organisation's contact details yourself and calling that number directly[2]. A company can require call-backs to use the staff directory or the number on the contract, never a number or link supplied in the message or meeting.
  • Second-person approval: above a set amount, or for a first payment to a new party, another manager must confirm through a different channel; the full payment-change verification steps are in Phishing and Business Email Compromise.
  • Agree on a verification phrase: IC3 recommends that families agree on a secret word or phrase[2]. Companies can have executives agree with finance staff and assistants on a verification question for urgent requests, kept offline, changed regularly and never written in email or chat. A code word supplements the call-back; it does not replace it.
  • Use interaction as a test: Hong Kong police suggest asking the person to make specific movements on camera, such as turning their head up, down, left or right, and watching for anomalies, or using the conversation itself to test whether the other party is genuine[1]. Avoiding interaction, hurrying to end the meeting and switching to a messaging app for instructions are all patterns seen in the Hong Kong case[1].
  • The IT help desk is a target too: if AI-generated audio can be used to impersonate someone and get into their bank account[2], it can just as well be used to call the help desk and ask for a password or MFA reset; identity checks before a reset are covered in the account recovery section of the MFA rollout guide.
  • Get backing from the top: have the CEO state publicly, "I will never ask anyone to skip the process, and nobody will be blamed for following it," so front-line staff have the confidence to stick to the process when "the boss is in a hurry".

Brand impersonation: criminals using your name against your customers

Impersonation scams have topped the list of fraud complaints reported to the US Federal Trade Commission (FTC) in recent years: in 2025 the FTC received more than one million imposter-scam reports, with reported losses of nearly US$3.5 billion, and nearly 30% of all consumers who reported losing money to scammers said they were first contacted on social media, with reported losses reaching US$2.1 billion[3]. In September 2026 the FTC sought public comment on whether to amend its impersonation rule or take other action over platform ad-optimisation tools that may be furthering impersonation scams[3].

The same pattern is visible in Taiwan. The 165 anti-fraud website regularly publishes "high-risk businesses reported by the public" and, in those notices, warns people to watch out for fraudsters who impersonate a business's email or customer service and claim a data leak, an order set up incorrectly, an order mistakenly placed as a bulk order or a membership upgrade, then hand the victim to a fake bank officer who asks them to use an ATM, online banking or e-payment for "transfer verification"[4]. The Ministry of Digital Affairs set up its online fraud reporting platform on 30 September 2024; by 29 August 2026 it had received 1,314,577 reports of suspected fraud messages, of which 673,351 were confirmed as fraud after review and referred under the Fraud Crime Hazard Prevention Act to Meta, Google, LINE, TikTok and other platforms for removal[5].

Common forms

  • Fake websites and look-alike domains: copies of the official site on similar domain names that take orders or collect card details and login credentials.
  • Fake fan pages and ads: pages and ads that misuse a brand or a celebrity's image. The Ministry of Digital Affairs has observed fraudsters posting on social media with "limited-time offer" and "buy now" pitches that lure people to click unknown links and place orders, then steer them into entering personal and card details; its weekly bulletins also list the celebrities most impersonated that week[5].
  • Fake customer service: emails or calls in the business's name claiming an order or membership was set up wrongly, followed by a handover to a fake bank officer who asks for a transfer[4].
  • Fake recruitment: job ads in the company's name that ask applicants for ID documents or bank accounts, or for an upfront fee.
  • Fake apps: imitations of the official app, or links that trick people into installing a package that steals their login details.

What a company can do

  1. Publish your official channels: create an "official channels" page on your website listing the domains, social media accounts, customer-service numbers, LINE official account and app download links you use, along with "things we will never ask you to do", for example never asking customers to use an ATM or online banking to cancel a setting, and never charging job applicants a fee. Put the same text in order notifications, e-invoices and the app so customers have something to check against when a suspicious call comes in.
  2. Monitor: regularly search social platforms, ads and app stores for your brand and executives' names and watch for newly registered look-alike domains; add an "impersonation report" category in the customer-service system, treat customer reports as security signals and pass them to security or legal for follow-up; and check whether your company appears on the 165 high-risk business list[4].
  3. Preserve evidence, then report for takedown: screenshot and record the URL, account ID and time of discovery, then use each platform's impersonation or trademark report function. Fraudulent ads and posts can be reported to the Ministry of Digital Affairs' online fraud reporting platform, which refers confirmed cases to platforms for removal[5]; they can also be reported online through the 165 website[6].
  4. Deal with domains: abuse of .tw and .台灣 domains such as phishing, malware or pharming can be reported to TWNIC's ccTLD abuse reporting window, whose form asks for the reporter's identity or organisation documents along with the suspicious URLs and screenshots[7]. For domains that squat on or imitate your trademark or company name, you can file a complaint with an accredited dispute resolution provider under TWNIC's Domain Name Dispute Resolution Policy; the complainant must establish three elements: the domain is identical or confusingly similar to the complainant's trademark, name or other identifier, the registrant has no rights or legitimate interests in it, and it was registered or is being used in bad faith; the only remedies available are cancellation or transfer of the domain[8]. For other top-level domains, report to the abuse contacts of the registrar and hosting provider; other channels for reporting phishing sites are covered in Phishing and Business Email Compromise.
  5. Trace where the data came from: if fake customer-service callers can correctly quote customers' names, order details and payment methods, the data may have leaked from your company or a partner (e-commerce platform, logistics, CRM or outsourced customer service), and you should open an incident investigation; see The First 24 Hours of a Suspected Breach and Supply Chain Attacks.

Taiwan's legal framework and reporting channels

The Fraud Crime Hazard Prevention Act was enacted on 31 July 2024 and partially amended in January 2026. Under Article 58 it took effect on promulgation, except for a few provisions whose effective dates are set by the Executive Yuan; for the parts of Article 39, paragraphs 2 to 5, on traffic management, DNS suspension and access restriction, and for Article 40, paragraph 1, subparagraph 6, the national law database still shows the effective date as not yet set[9]. The Act's obligations fall mainly on financial institutions, telecoms operators and online platforms. The points most relevant to an ordinary company are:

  • Which ad platforms are covered: an online advertising platform operator under the Act is one that provides paid ad placement or push services and is the final platform through which the public sees the ad; it applies to operators serving Taiwan above a certain scale, and the list is published by the competent authority for the digital economy[9].
  • Advertisers will be identity-checked: platforms must verify the identity of the party commissioning the ad and the party funding it by digital signature, a fast identity verification mechanism or another equally secure method, and must maintain a fraud prevention plan and publish an annual fraud prevention transparency report[9].
  • What ads must disclose: that the content is an ad, information on the commissioning and funding parties, any permit number required by law, and whether the ad uses deepfake technology or AI-generated images of a person[9]. The Act defines a deepfake as a technical form of expression that uses computer synthesis or other technological methods to fabricate words or actions of a person that are untrue and sufficient to make others believe they are genuine[9]. Platforms make these disclosures in the ad, but they need the advertiser's input; if your ads use an AI-generated spokesperson or executive likeness, prepare for this in advance.
  • Takedown and joint liability: when a platform knows an ad is fraudulent or clearly fraud-related, it must remove it, restrict viewing or stop serving it, either on its own initiative or within the deadline set in a notice from judicial police or the competent authority, and give judicial police information on the commissioning and funding parties and on any messaging accounts and phone numbers in the ad; a platform that fails to do so is jointly liable with the commissioning and funding parties to anyone harmed by relying on the ad[9]. Failing to act within the notice deadline carries a fine of NT$500,000 to NT$10 million, or NT$2.5 million to NT$100 million in serious cases[9].
  • Emergency blocking of fraud sites: to stop people reaching fraudulent websites in time, the competent authorities or judicial police may order internet access providers to stop resolving or restrict access to a site when they consider immediate action necessary[9].
  • Duty of care for e-commerce operators: e-commerce operators (businesses mainly engaged in online retail, or running an online platform for others to sell goods) must exercise the care of a prudent manager to prevent their services being abused for fraud; when notified by judicial police or the competent authority of suspected fraud, they must cooperate and suspend the user accounts involved for a reasonable period[9].
  • Reporting channels: the Act requires the central competent authority to run a 24-hour reporting window, an online reporting platform or a reporting hotline that provides advice, takes reports and refers cases for assistance[9].

Note that what triggers a platform's takedown obligation in the text is the platform's own knowledge, or a notice from judicial police or the competent authority[9]; the Act does not give an impersonated company a direct right to demand removal. In practice, besides reporting to the platform yourself, you should also report through 165 or the Ministry of Digital Affairs' channel so that the authorities can confirm the case and formally notify the platform.

Money already sent: stop the payment, file a report, keep the evidence

Time is critical. Under Financial Supervisory Commission rules, a recipient account is designated a "flagged account" (警示帳戶) when a court, prosecutor's office or judicial police notifies the bank, and in urgent cases the notice can first be given by phone, fax or similar means; once an account is flagged, the bank must suspend all of its transaction functions and return any incoming remittances[10]. In other words, calling your own bank is not enough on its own: you need to report to the police quickly so they can notify the bank.

  1. Call your bank immediately, and call 165 or 110 at the same time: give the time, amount, receiving bank and account number of the transfer and ask the bank to help stop the funds.
  2. Trigger the joint-defence process at a bank branch: when a fraud victim goes in person to any bank during business hours to report being defrauded, the bank must confirm the person's identity, the transfer details and what happened, have them sign a declaration and call 165, and then notify the receiving bank; the receiving bank must place a hold on the notified amount and, if the money has already moved on, notify the next receiving institution[11]. Police must send officers to the bank within 2 hours to take the report and flag the account if needed; within 48 hours of the hold, police must tell the bank either to flag the account or to release the hold, and if no flagging notice arrives in time the bank releases the hold[11].
  3. Complete a formal police report: an online report on the 165 website only counts as a tip and a pre-filled statement; you still have to give a statement at a police station to complete the formal report, and 165 will call you after receiving an online report to help refer you[6]. After reporting, obtain the case acceptance certificate issued by the police.
  4. Apply for return of remaining funds: if a flagged account still holds money the victim transferred in that has not been withdrawn, then once judicial police notify the bank in writing, the victim can submit ID, the police case acceptance certificate and a declaration, and the bank returns the portion it determines has not been withdrawn, working through the deposits in order of arrival[11].
  5. If the money went abroad: flagging and holds are a joint-defence mechanism among domestic financial institutions; if the money has already been wired overseas, tell your bank explicitly that it was an international transfer, ask it to request a recall through the remittance channel as quickly as possible, and report to the police at the same time.

Evidence to keep

IC3 suggests including as much of the following as possible in a report: the other party's name, phone number, address and email; the transaction date, payment type, amount, account numbers involved, and the name and address of the receiving financial institution; and how contact began, the stated reason for the payment, how you were told to pay and what information you provided[2]. In practice, also keep:

  • Original emails (with full headers), meeting invitations and links, messaging-app chat logs and account IDs, and call logs.
  • Any video or call recordings together with when they were obtained; if there are none, write down what happened and a timeline straight away.
  • URLs and screenshots of fake websites or fan pages, plus remittance slips and online banking transaction records.
  • Do not delete chats or accounts, and do not reply to the other party for now.

Internal follow-up

  • If the fraud started with a compromised company mailbox or messaging account, handle the account compromise as well: reset passwords, revoke sign-in sessions and check forwarding rules, in the order set out in The First 24 Hours of a Suspected Breach; if you need outside help, see our incident response service.
  • A listed company with a material loss may have a disclosure obligation; see Cyber incident disclosure by Taiwan-listed companies.
  • Tell the impersonated executive, suppliers and customers what happened so the same script cannot be reused on the next person.
  • Victims of fraud crimes who file a civil claim for damages are temporarily exempt from court fees[9]; discuss recovery with your legal team or a lawyer.

Action checklist

  • Write "every high-risk request is confirmed by calling back a number already on file" into finance, procurement and IT help desk procedures, state explicitly that it covers video, voice and messaging apps, and have the CEO endorse it publicly.
  • Require two-person approval for large and first-time payments; have executives agree with finance staff and assistants on a verification question that is kept offline and changed regularly.
  • Run a deepfake drill at least once a year, for example a fake boss on video demanding an urgent transfer or a fake employee calling for an MFA reset, then review whether the process held; security awareness training can support this.
  • Publish an "official channels" page and a "things we will never ask you to do" list on your website, and include them in order notifications, e-invoices and the app.
  • Regularly search for your brand and executives' names, look-alike domains and fake apps, follow the 165 high-risk business notices, and add an "impersonation report" category in the customer-service system.
  • Prepare a takedown kit: an evidence screenshot template, each platform's report links, the Ministry of Digital Affairs' fraud reporting platform, the 165 online report, and how to file TWNIC abuse reports and domain disputes.
  • Prepare a one-page fraud response card for finance and customer-service managers: your bank's emergency contact, 165 and 110, the nearest police station, and the evidence checklist.
  • Follow fraud advisories and incidents on this site and feed new techniques into training.