Deepfakes broke “seeing is believing”. Agents are breaking “logged in means present”.

Financial controls are built on assumptions so old that nobody writes them down. A person you can see on a video call is that person. An identity document that passes inspection is genuine. Someone who is logged in is the account holder, sitting at the screen.

Generative AI has broken the first two in public, with losses attached. The October 2026 reports of AI agents inside US bank accounts are evidence that the third is going the same way. This post sets out the record for each.

Assumption one: seeing is believing

In early 2024, a finance employee at the engineering firm Arup joined a video call with people who looked and sounded like the company's chief financial officer and other colleagues. All of them were deepfakes. The employee made 15 transfers totalling HK$200 million, about US$25.6 million, CNN reported. Arup confirmed that “fake voices and images were used,” and that none of its internal systems were compromised.

That last detail is the lesson. No system was breached. Every control that relied on recognising a familiar face worked as designed, and failed.

Assumption two: a document that passes is real

In November 2024, the US Treasury's Financial Crimes Enforcement Network issued an alert on fraud schemes involving deepfake media. FinCEN said it had seen an increase since 2023 in suspicious activity reports describing suspected deepfakes, especially falsified identity documents used to get past identity verification. The accompanying release described generative AI being used to create documents, photographs and videos to circumvent customer identification and due diligence controls.

Deloitte's Center for Financial Services put a forecast on the trend: generative AI could push US fraud losses to $40 billion by 2027, from $12.3 billion in 2023. It is a projection, not a measurement, but the direction is not in dispute.

What has been measured

The FBI's 2025 Internet Crime Report, released in April 2026, included a dedicated section on AI for the first time. It recorded about 22,000 complaints referencing AI, with reported losses of roughly $893 million, and about $17.6 billion in cyber-enabled fraud losses overall, The Record reported. Reported losses are a floor: many victims never file.

Assumption three: logged in means present

The third assumption is the newest to fail, and it fails differently. Deepfakes defeat checks by impersonating a person. AI agents don't impersonate anyone. They are invited in, with the account holder's real password, and the login is legitimate.

That is what US banks described in October 2026. Axios reported that several large banks had detected third-party agents operating inside customer accounts, some taking actions that appeared to go beyond what users asked. The identity was right. The person was not there.

Put the three together and a pattern emerges. Each assumption replaced a harder question with an easier one:

• “Is this really the CFO asking?” became “Does this look like the CFO?”
• “Is this really the applicant?” became “Does this document pass?”
• “Is the account holder doing this?” became “Did the login succeed?”

Generative AI made the easy questions cheap to fake. The hard questions are back.

What follows for controls

Identity checks still matter, but they answer a narrower question

Better identity verification and liveness checks are a reasonable response to deepfakes at onboarding. They establish who opened the account. They say nothing about who is acting in it six months later.

Out-of-band confirmation is back

The standard post-Arup advice, to confirm unusual payment requests through a separate, known channel, is an old control rediscovered. Its digital equivalent is to confirm sensitive actions through a step that the party already in the session cannot complete alone.

Presence has to be checked where it matters

For actions taken in a browser or app, the question “is a person in control right now?” is distinct from “who is this?”. It can be answered without collecting identity at all, and it should be asked at the moment of the action, not once at the door.

HEIP does that and nothing more. It does not detect deepfakes and does not verify identity. It tells the platform's server whether a person is at the controls for a specific action, such as a withdrawal or a payee change, without asking them to solve a puzzle and without learning who they are. Identity checks tell you who came in. HEIP is about who is at the controls when it counts.