Deepfake Statistics 2026: Fraud, Detection and Laws

Deepfake figures come from very different sources. Some count fraud attempts on an identity platform, others ask people about their experiences or track publicly reported incidents. None of them alone measures global prevalence. Each figure below therefore includes its measurement period and population.

The findings point to risks for identity checks, intimate imagery, and political communication. They do not add up to one growth rate or a reliable total for all deepfake losses.

1. The Key Numbers at a Glance

This is not a ranking. The table combines a platform series, fraud checks, two German surveys, and a detection test. Each figure has to be read according to its own method.

2. Fraud Share: Why a Widely Quoted Series Does Not Reconcile

A February 2026 Citi Institute report reproduces a time series from Signicat VideoID data. It puts deepfake attempts at 0.1% in 2022, 2.5% in 2023, and 4.7% in 2024. These figures describe Signicat's platform data, not every fraud attempt in Europe.

Source: Citi Institute et al.

PNG|SVG

CC BY 4.0

gradually.ai

Source: Citi Institute, published Feb 2026; underlying data: Signicat VideoID, full years 2021 to 2024

A February 2025 Signicat press release gives about 6.5% for 2024 and a 2,137% rise from 0.1% three years earlier. It also mentions a separate survey of 1,206 fraud decision-makers in seven countries. The release does not say those respondents are the denominator for its platform figures, and it publishes neither absolute counts nor an exact platform cohort. Taken as exact, the displayed endpoints imply a relative rise of about 6,400%. The release does not resolve the discrepancy with the later Citi series, so the chart uses the consistently presented Citi data and does not show a Signicat growth rate.

The discrepancy is a reason to avoid treating platform figures as general prevalence. The measurement base, period, and definition can differ even when figures appear to describe the same measure.

An earlier Sumsub analysis reported a tenfold rise in deepfakes detected in its own cross-industry checks from 2022 to 2023. It was based on anonymized platform data across 28 industries and more than two million fraud attempts. This older provider series has a different measurement base and cannot be compared directly with Signicat's shares.

3. Country Figures from Sumsub's Fraud Platform

In its Identity Fraud Report 2025-2026, Sumsub reported in November 2025 that deepfake fraud attempts increased in France, the UK, Spain, and Germany in 2025 versus 2024. The report compares internal verification and user activity data for 2024 and 2025. Sumsub says it analyzed more than four million fraud attempts overall, but the release gives no absolute country counts for deepfake fraud. The figures use aggregated, anonymized data from consenting customers and cover countries with significant platform activity.

An earlier June 2025 Sumsub press release compared millions of checks from Q1 2025 with Q1 2024. It reported much larger relative increases, including 1,100% for Germany. Those Q1 figures cover a different period from the later annual comparison and should not be read as a continuation of the same series. This release also gave no absolute country counts.

Canada

+3,400%

Hong Kong

+1,900%

Singapore

+1,500%

Mainland China

+1,183%

Germany

+1,100%

United Kingdom

+900%

United States

+700%

Source: Sumsub, published June 12, 2025

PNG|SVG

CC BY 4.0

gradually.ai

In the Q1 comparison, Canada led at 3,400%, followed by Hong Kong at 1,900% and Singapore at 1,500%. Mainland China followed at 1,183%, Germany at 1,100%, the UK at 900%, and the US at 700%. A large relative increase does not reveal how many cases were counted without the baseline. It therefore says little about the absolute risk to people in each country.

4. Germany: Awareness and Checking Habits

The German Cybersecurity Monitor by BSI and the police crime prevention agency is based on a weighted survey of 3,060 people aged 16 and older in Germany. The survey ran from January 6 to 12, 2026. The findings on AI content were published on April 13.

According to BSI and ProPK, 47% of internet users feel able to identify AI-generated content. Forty percent have considered whether a scene looks realistic, 28% have looked for inconsistencies in an image or video, and 19% have researched whether a source is credible. Thirty-two percent had not used any of the checking measures asked about. Multiple answers were possible.

A separate representative telephone survey by Bitkom Research covered 1,006 people aged 16 and older. It was conducted from calendar week 12 through week 17 of 2026, and Bitkom published the results on May 28.

“Encountered” means 20% were certain and 41% suspected that they had seen a deepfake. This is not a technically verified count of synthetic content. The media-format shares refer to people who said they had encountered deepfakes.

5. How Well Can People Identify Synthetic Content?

Survey responses about confidence and checking habits are not objective detection performance. Separate tests use selected content.

Feel able to identify AI content reliably

47%

Consider whether a scene looks realistic

40%

Look for inconsistencies in an image or video

28%

Check whether the source is credible

19%

Have never used concrete checking measures

32%

Source: BSI and ProPK

PNG|SVG

CC BY 4.0

gradually.ai

Source: BSI and ProPK, survey Jan 6 to 12, 2026, published Apr 13, 2026

iProov tested 2,000 adults in the US and UK. In the study published February 12, 2025, 0.1% correctly identified all real and synthetic images and videos shown. Participants had been primed to look for deepfakes. According to the company, participants were 36% less likely to correctly identify synthetic videos than synthetic images. The result applies to the stimuli shown, not to every detection task.

A newer survey by Veriff and Kantar was conducted in February 2026 among 3,000 adults in the US, UK, and Brazil. Veriff published the findings on June 18, 2026. US participants assessed 16 visuals, eight real and eight AI-generated or manipulated. Their average detection score was 0.07 on a scale from minus 1 to plus 1. Zero represented chance; Veriff says the result was statistically indistinguishable from chance. This is also a test using selected content, not a measure of all everyday deepfake detection.

6. Losses: Individual Cases, Complaints, and Estimates

The table does not add up deepfake losses. The FBI category is broader than deepfakes. Resemble's figure for civil exposure is modeled. Deloitte's number is a forecast for GenAI-enabled fraud overall.

In January 2024, Hong Kong police received a report about a prerecorded video conference featuring a fake finance chief. According to police statements on June 26, 2024, five local bank accounts were used and about HK$200 million was lost. Arup confirmed to the Guardian that it was the company involved; the official police release itself does not name the company.

In August 2024, carrier Lingo Telecom agreed to a $1 million civil penalty and enhanced compliance terms in an FCC settlement over its transmission of spoofed AI voice-cloning robocalls. The FCC settlement announcement is separate from the later forfeiture proceeding against political consultant Steve Kramer.

The FBI's 2025 annual report lists 22,364 complaints and $893,346,472 in losses under “How AI Could Be Used in Frauds/Scams.” This is neither a deepfake statistic nor proof that every complaint involved confirmed AI use.

Resemble AI counted 821 verified attacks from 1,760 news reports in the first half of 2026 in a report published on August 12. The company documented at least 15,736 affected people and 3.46 million synthetic files. It reported $6.95 million in direct losses and modeled $2.24 billion in statutory civil exposure under US law from documented cases involving non-consensual intimate imagery and child sexual abuse material. These are media monitoring, documented minimums, and a legal model, not a global census or a total of confirmed payments.

In 2024, Deloitte projected that losses from generative AI-enabled fraud in the US could rise from $12.3 billion in 2023 to as much as $40 billion in 2027. The Deloitte analysis was a forecast at the time for several forms of fraud, not a measurement of losses caused by deepfakes.

7. Industries: Where Entrust Recorded Deepfake Attacks

In the Entrust Identity Fraud Report 2026, crypto accounted for 60% of the deepfake attacks in its data, payments and merchants for 22%, and remittance and FX for 13%. The figures cover identity checks from September 2024 through September 2025. According to the report, the data spans more than one billion checks, 30-plus industries, and 195 countries. This distribution describes Entrust's checks, not the share of deepfake crime in the overall economy.

Entrust also estimates that deepfakes were linked to about one in five biometric fraud attempts. In the same report, the cadence of injection attacks rose roughly 40% year over year. Injection means feeding manipulated images or video into a verification system. Not every such attack has to be a deepfake.

The Entrust Identity Fraud Report 2025 estimated about one deepfake attack every five minutes across its Onfido checks. Its data covered September 1, 2023 through August 31, 2024. This is a historical platform measurement, not a current worldwide rate.

For historical context, Sumsub reported in November 2023 that crypto accounted for 88% and fintech 8% of its detected deepfake cases in 2023. These provider figures cover a different period and population from Entrust's industry split for September 2024 through September 2025.

8. Politics and Elections: Documented Events, Not Measures of Impact

In September 2023, an audio recording about alleged election deals circulated shortly before Slovakia's parliamentary election. In its report on the 2023 election, Slovakia's media regulator estimated that at least 100,000 people had seen that recording. This does not show that all of them believed it or that it changed the election result.

Automated calls using a cloned Biden voice circulated in New Hampshire in January 2024. On September 26, 2024, the FCC issued a final order for a $6 million civil forfeiture against Steve Kramer. That does not establish whether it was paid. Kramer was acquitted in a separate state criminal case in 2025, as reported by the Associated Press.

9. Non-Consensual Intimate Images

The September 2019 Deeptrace report estimated 14,678 deepfake videos in the English-language sources it surveyed. It classified 96% as non-consensual pornography. The study covered a limited selection of websites, so it is not a global or current count. It also does not show that women were the only people affected.

For its 2023 State of Deepfakes report, Home Security Heroes analyzed 95,820 videos, 85 dedicated channels, and more than 100 websites. The company classified 98% of the videos as pornographic. In its own analysis, 99% of targeted individuals were women, and 53% of people featured in deepfake pornography were South Korean singers or actresses. These are findings from a limited online review described by the provider, not a count of all videos or people worldwide. They are also not directly comparable with Deeptrace's 2019 study.

In its annual report published on March 20, 2026, Resemble AI classified 311 of 1,567 verified 2025 incidents, about 20%, as involving CSAM or non-consensual intimate imagery. For H1 2026, the company says 137 of 821 incidents, about 17%, involved non-consensual sexual imagery of adults or children. Both shares come from separate, curated media reviews and do not measure population prevalence.

10. Regulation: What Applies on October 7, 2026

Article 50 of the EU AI Act sets different duties. Providers must mark outputs of synthetic audio, image, video, and text in machine-readable form, as far as technically feasible. Exceptions include systems that only assist with standard editing or do not substantially alter their input. Deployers must disclose deepfakes to audiences. For evidently artistic, creative, satirical, or fictional works, disclosure may use an appropriate form that does not impair the work. Each duty has exceptions for systems or uses legally authorized to detect, prevent, investigate, or prosecute criminal offenses. The information must be clear, distinguishable, and accessible under applicable accessibility requirements no later than the first interaction or exposure. Providers of synthetic-media systems placed on the market before August 2, 2026, must take the necessary steps to comply with Article 50(2) by December 2. The consolidated text of Article 50 and the enforcement FAQ explain the deadlines and exceptions. For violations of Article 50, Article 99 allows possible fines of up to €15 million or, for companies, 3% of worldwide annual turnover in the preceding financial year, whichever maximum is higher. A lower ceiling applies to certain smaller businesses. This is not an automatic penalty for every person who creates a deepfake.

Regulation (EU) 2026/1744 was published in the Official Journal on July 24, 2026, and entered into force on July 27. The new prohibitions in Article 5(1)(ba) and (bb) apply from December 2, 2026. They cover certain systems that generate or manipulate realistic images, video, audio, or similar material depicting an identifiable natural person’s intimate parts or engagement in sexual activity without that person’s freely given, specific, informed, unambiguous, and explicit consent. A second prohibition covers certain child sexual abuse material or performances, except where a national-law “without right” defense applies. For providers, placing such a system on the market or putting it into service is prohibited only if either generating or manipulating this material is the system’s intended purpose, or such output is reasonably foreseeable and reproducible without significant technical modification based on the system’s design, training, architecture, capabilities, or user-facing functionalities, and the system lacks reasonable and adequate technical safety measures and other safeguards to reliably prevent it, taking reasonably foreseeable misuse into account, and to correct observed or reported misuse. For deployers, use is prohibited only when they use the system for that purpose. An edit that neither increases the exposure of intimate parts nor changes the nature of sexual activity does not count as manipulation. This is not a blanket ban on AI images. The rules appear in the EU AI Act amendment and the Commission’s explanation of Article 5.

In Germany, Section 184k of the Criminal Code covers certain unauthorized images of genitals, buttocks, female breasts, or covering underwear when those areas are protected from view. It is not a general deepfake ban. A new Section 201b was not in force. The table distinguishes the Bundesrat proposal 21/1383, the Greens' referred bill 21/4949, and the Justice Ministry draft. Their status is documented in the text of Section 184k, the DIP entry for the Bundesrat proposal, the Bundestag notice on the Greens' bill, and the government response about the Digital Violence Protection Act.

Denmark's proposed Copyright Act amendment 2025/0654/DK would protect against publishing realistic digitally generated imitations of personal characteristics and performers' performances without consent. The EU TRIS record documents receipt on October 31, 2025, a new notification after an earlier one was withdrawn, and European Commission comments on February 3, 2026. The record describes a draft and does not establish whether a law entered into force afterward.

In the US, the TAKE IT DOWN Act, in force since May 19, 2025, covers certain non-consensual intimate depictions, including covered digital forgeries. Its platform duty to provide a reporting process and remove eligible content took effect on May 19, 2026, as the FTC explains. The NO FAKES Act, S. 4591 remained a bill. On September 30, a request by Senator Marsha Blackburn to consider and pass the bill by unanimous consent failed after Senator Ted Cruz objected. This was not a vote on passage. The October 5 Senate calendar still listed S. 4591 under General Orders, calendar entry 446. It had not been enacted as of October 7. The request and objection appear in the September 30 Congressional Record.

In England and Wales, Section 66B of the Sexual Offences Act 2003 covers sharing or threatening to share non-consensual intimate images. The provision can also cover altered or manufactured images that appear to show a person. It has applied since January 2024. Its updated designation as a priority offence under the Online Safety Act applies from January 8, 2026. The Crown Prosecution Service guidance explains these offences. Since February 2026, creating or requesting certain purported intimate images of adults has also been an offence. Since June 29, 2026, making, adapting, or supplying related image generators is an offence. The Schedule 7 amendment appears in the Online Safety Act Priority Offences Regulations 2025.

11. Milestones

This timeline is a selection, not a complete history of synthetic media. The term “deepfakes” entered wider use in late 2017 around a Reddit account and the videos shared there. Deeptrace, Sumsub, Citi, BSI, Bitkom, iProov, Entrust, and Resemble figures refer to the studies described above. Legal dates were checked against the linked statutes and official guidance.

12. Conclusion: Read Every Figure with Its Measurement Base

A platform increase, a survey, media monitoring, and a statutory model answer different questions. They cannot be combined into a total count of deepfakes, one detection rate, or a global loss figure. The narrower findings are more useful: providers report attempted fraud in their identity checks, survey respondents describe what they think they have seen, and documented incidents show specific consequences.

For payments and identity checks, a face or voice alone should not confirm identity. Calling back through a known number or confirming through a separate, independent channel can help verify who is making a request.

For data on generative image models, see my AI image statistics. My AI statistics cover the wider industry.