Scammers are now deepfaking central bankers, and Malaysia's regulators are fighting back

The face is familiar, the voice sounds right and the message is persuasive: a senior official from Malaysia's central bank appears in a video recommending an investment scheme. It is fake. Bank Negara Malaysia and the Securities Commission have jointly warned the public about deepfake videos that use the likenesses of their senior officers to promote private investment schemes and financial products, as reported by The Star.

The warning marks a disturbing escalation. Scammers have long impersonated celebrities and business leaders to sell fake investments. Now they are impersonating the very regulators whose job is to protect investors, borrowing the authority of the central bank to make their schemes look legitimate. It is a direct attack on public trust in financial institutions.

What the regulators said

The joint statement was blunt. Bank Negara Malaysia and the Securities Commission do not promote or recommend private investment schemes, so any video showing their officials doing so is fake. They urged anyone who encounters such content to report it to the social media platform where it appears, or to alert the regulators directly, according to The Vibes.

The regulators also pointed people to practical tools for checking whether an investment offer is legitimate. These include BNM's Financial Consumer Alert List, the SC's Investor Alert List, the BNMLINK service and the SC's Investment Checker, which let the public confirm whether an entity is authorised before handing over money.

This is not the first such incident. In May 2026, BNM said fabricated footage using AI generated images and voices of its Governor and several senior officials was circulating, and in early September it warned about deepfake advertisements using the Governor's face. The October warning shows the problem is persistent and growing, not a one off.

Why regulators make perfect targets

Scammers choose their disguises carefully. Impersonating a celebrity can attract attention, but impersonating a central banker lends something more valuable: authority. Many people assume that if a senior regulator appears to endorse an investment, it must be safe, which is exactly the assumption fraudsters want to exploit.

The technology makes this easier every month. Tools that can clone a voice from a few seconds of audio or generate convincing video of a real person are now widely available. Senior officials appear frequently in public speeches, interviews and press conferences, providing scammers with plenty of material to train their fakes.

When criminals can borrow the face of the regulator, the most important protection left is a public that knows how to check.

The result is a crisis of verification. If people cannot trust that a video of an official is real, the regulators' ability to communicate with the public is weakened. That is why the regulators are emphasising simple verification steps rather than relying on people to spot fakes by eye.

The global scale of deepfake fraud

Malaysia's experience is part of a worldwide surge. A report by identifAI published on 14 October estimated that deepfake enabled scams generate about 40 billion dollars a year in financial fraud, as reported by SecurityBrief Asia. It is a single company's estimate and should be treated as indicative, but it captures the direction of travel.

Institutions are being targeted too, not just individuals. An Italian bank recently lost close to 100 million euros to an AI assisted scam in which a cloned voice helped push a series of transfers to foreign accounts, mainly in China and Hong Kong, according to Biometric Update. Part of the money was later recovered with the help of law enforcement in several countries, but the case shows that even large, sophisticated institutions are vulnerable.

Banks are fighting back with their own technology. In Hong Kong, Ping An Digital Bank reported deepfake detection accuracy above 96 percent in the second cohort of the HKMA's generative AI sandbox, although it did not publish a full methodology. The race between fakes and detection is now one of the defining contests in financial security.

How to protect yourself

The most effective defence against deepfake investment scams is not spotting the fake but refusing to act on any unsolicited investment offer without checking it independently. Regulators and banks across the region agree on a few simple rules that dramatically reduce the risk of being scammed.

Here is what individuals and businesses should do:

• Remember that central banks and securities regulators never endorse private investment schemes.
• Check any investment firm against official alert lists and licence registers before paying.
• Verify unusual requests for money through a separate, trusted channel, not the one the request came from.
• Report suspicious videos to the platform and to the regulator, so they can be taken down quickly.

Southeast Asia has become a global hotspot for scams, a theme we covered in our report on the UN's estimate of Asia scam losses. Deepfakes make those scams more convincing and harder to stop, which is why public education is now as important as enforcement.

What it means for financial firms

For banks, brokers and payment companies, deepfakes create a new kind of reputational risk. Fraudsters can impersonate their executives, their brands and their customer service staff, and victims may blame the real company for losses caused by impersonators. Protecting a brand now means actively monitoring for fakes and responding quickly when they appear.

Internal controls matter just as much. The Italian case shows how a convincing voice or message can push employees to authorise large transfers. Firms need clear procedures that require independent verification of unusual payment requests, no matter how senior or familiar the person making them appears to be.

There is also a communication challenge. When fakes of executives circulate, companies must warn customers quickly and clearly without causing panic. The Malaysian regulators' approach, a joint statement with practical verification tools, offers a useful model for how financial institutions can respond.

Trust as the battleground

Deepfakes are ultimately an attack on trust, the foundation on which every financial system rests. When people cannot trust what they see and hear, they become more vulnerable to fraud and less confident in legitimate institutions. Regulators impersonating themselves to warn against impersonation is a sign of how strange the landscape has become.

The answer lies in a combination of better detection technology, faster takedowns by social media platforms, stronger internal controls at financial firms and a public trained to verify before acting. No single measure is enough, but together they can make deepfake scams far less profitable.

Deepfakes of central bankers are a warning that financial fraud has entered a new era, one where seeing and hearing are no longer believing. Malaysia's regulators have responded the right way, with clear statements and practical tools, but technology will keep making fakes more convincing. The lasting defence is a culture of verification, where no investment offer, however authoritative it looks, is trusted until it has been checked.