Don't Be Fooled: Inside the UAE's Growing Deepfake Fraud Problem

In January 2020, a bank manager in the UAE took a phone call from a company director he recognised instantly. The voice was right. The urgency was believable: a corporate acquisition was closing, and the director needed funds moved immediately. Supporting emails from a lawyer confirmed the details. The manager approved transfers totaling roughly $35 million.

The director had never made that call. According to a UAE request for assistance filed with US courts — first reported by Forbes and since repeated across cybersecurity trade press — investigators concluded the voice on the line had been synthetically cloned. The money was routed through accounts around the world, and years later, authorities were still trying to trace where it had gone.

At the time, it read like a one-off curiosity: a bizarre, almost sci-fi crime. Six years later, it looks more like a preview.

The warning campaigns are here now

This September, the UAE's Ministry of Human Resources and Emiratisation (MOHRE) launched a public awareness push under the slogan "Don't be fooled," warning residents that scammers were producing fake videos, voice recordings and images designed to look like official ministry communications, according to Khaleej Times. The fabricated material has reportedly been used to pressure people into handing over personal data, clicking malicious links, or transferring money — in some cases using fake notices claiming an employment contract had been terminated, Gulf News reported.

It's part of a broader pattern. Dubai's Telecommunications and Digital Government Regulatory Authority has separately flagged a surge in scam calls where fraudsters impersonate government entities, and the UAE Central Bank has had to explicitly bar banks from requesting sensitive documents over channels like WhatsApp, Khaleej Times reported — a sign of how much fraud now rides on everyday messaging habits rather than exotic hacking.

What's changed since 2020 isn't the concept. It's the cost of pulling it off. Voice cloning that once required specialist tooling and a reasonable audio sample is now accessible through consumer-grade AI services, and generating a convincing clip no longer takes a skilled team — it takes a few minutes and a short recording, much of which people already have scattered across social media, voicemail greetings and conference calls.

Why the UAE is a frequent target

Khaleej Times' business desk has reported that the UAE's own strengths are part of what makes it attractive to fraudsters. Mortada Ayad of cybersecurity firm Delinea told the outlet that the government's aggressive digitalisation push has built a high baseline of public trust in official-looking digital communications — trust that scammers exploit directly. The region's heavy reliance on WhatsApp and similar apps for business, rather than more auditable channels, compounds the exposure, according to the same reporting.

The business impact is already visible in survey data. A QBE report cited by Khaleej Times found that nearly a third of UAE businesses surveyed carry no cyber insurance, and 27 percent have no formal incident response plan — meaning many companies have no playbook for the moment someone receives a call or video note from a "colleague" who isn't real. Separately, Khaleej Times has reported industry claims — attributed to security vendor Illumio — that AI-powered phishing now accounts for a large majority of digital breaches in the UAE; that figure comes from a vendor report rather than independent government data, so it's worth treating as directional rather than precise.

How the fraud actually works

Modern voice-cloning fraud typically follows a pattern security researchers now recognise: criminals gather a short public audio sample of a target (an earnings call, a conference talk, a voicemail), feed it to a cloning model, and generate new speech matching that voice saying whatever the scammer scripts. Paired with forged emails, fabricated urgency (an acquisition, a regulatory deadline, a family emergency) and targets who have a plausible reason to trust the voice, the illusion holds up long enough to authorize a transfer.

Crucially, in documented corporate cases — including the 2020 UAE incident — the fraud wasn't caught by anyone spotting audio artifacts or technical tells in the cloned voice. It worked precisely because it sounded convincing. That's an important, counterintuitive lesson for businesses betting on detection software alone: spectral-analysis tools that hunt for synthetic-speech fingerprints exist and are improving, but security teams increasingly say the more reliable defense isn't technical detection — it's procedure.

What actually stops it

The consistent advice from fraud investigators and the outlets covering the UAE's campaigns boils down to verification that doesn't rely on recognising a voice at all:

Callback verification: independently call the person back on a known, previously verified number rather than continuing on the inbound call — never transfer funds based on a single phone or video interaction.
Out-of-band confirmation: large transfers or data requests get a second confirmation through a completely different channel (email to a known address, an in-person check, an internal ticketing system).
Codewords for high-value requests: some firms now use a rotating shared phrase for any request involving money movement, specifically because it can't be inferred from a cloned voice or a scraped email thread.
Treat urgency as a red flag, not a reason to skip steps: the UAE's MOHRE campaign and multiple bank warnings all emphasize that urgency and authority are the lure, not a legitimate reason to bypass normal checks.

None of this requires exotic technology — which is itself the point. The 2020 heist and the 2026 awareness campaigns are separated by six years of AI progress, but the fix hasn't changed much: slow down, verify through a second channel, and don't let a familiar voice be the only evidence you check. As cloning tools get cheaper and more convincing, that discipline is likely to matter more than any detector.