Research: The Deepfake Economy

Chapter 10 of The Secret Life of Evil Robots carries these cases in a paragraph each. These are the long versions. Every quotation is from the source linked beside it.

The pattern is the same in all six. The fake did not need to be perfect. It needed to arrive through a channel the target already trusted: a phone call, a video meeting, a classmate’s group chat, a school’s social feed. The victims were not fooled by technology. They were fooled by their own reasonable habits, which someone had learned to rent.

A defence minister’s voice: Guido Crosetto (Italy, early 2025)

Callers posing as Italy’s Minister of Defence, Guido Crosetto, and his staff phoned some of the richest people in the country with a patriotic emergency. Italian journalists had been kidnapped in Iran and Syria, and the State needed help to free them (“chiedevano loro di intervenire in aiuto dello Stato per liberare giornalisti italiani rapiti in Iran e in Siria”). The minister’s voice was reproduced with software (“riproducendone la voce con un software”) (Il Post, 11 February 2025).

At least one target paid. Massimo Moratti, the former president of Inter Milan, “ha versato quasi un milione di euro”, nearly a million euros, in two transfers to an account in the Netherlands. Italian investigators blocked two foreign accounts, and Milan prosecutors opened a case for criminal association aimed at fraud (Il Post).

The pitch is worth admiring for a second. It asked a patriot to do something secret, urgent and unverifiable for his country. Nobody checks a ransom with the Ministry. That is the point of a ransom.

A CFO’s face: Arup (Hong Kong, early 2024)

A finance employee in the Hong Kong office of Arup, the British engineering firm, received a request to move money and had his doubts. He joined a video call to settle them. The call carried “deepfakes of Arup’s CFO and other staff members”, and after it he set aside “his initial suspicions”. He made “over 15 transactions” totalling “$25.6 million (200 million Hong Kong dollars)”. Arup: “We can confirm that fake voices and images were used.” (Fortune, 17 May 2024)

The employee did the thing every security trainer says to do: he verified on a second channel. The second channel was also fake.

A daughter’s sobs: Jennifer DeStefano (Arizona, 2023)

Jennifer DeStefano told the story herself, in a written statement to the Senate Judiciary Subcommittee on Human Rights and the Law on 13 June 2023 (her statement). Everything below is from it.

On a Friday afternoon she answered an “unknown” number on its final ring, because her fifteen-year-old daughter Brie was away at ski-race training. She heard Brie sobbing, “mom”, then “mom, I messed up”. A man’s voice said “lay down and put your head back”. Then Brie: “MOM THESE BAD MEN HAVE ME, HELP ME, HELP ME!!”

The man: “Listen here, I have your daughter, you tell anyone, you call the cops, I am going to pump her stomach so full of drugs, I am going to have my way with her, drop her in mexico and you’ll never see her again!”

“The kidnapper demanded a million dollars. That was not possible and so the kidnapper decided on $50,000, in cash.” He refused a wire, “that’s traceable”, and wanted to collect her himself, “in a white van, with a bag over your head”.

Another mother at the studio called 911. The dispatcher “was familiar with an AI scam where they can replicate your loved one’s voice.” Her husband, with Brie in Northern Arizona, “located Brie resting safely in bed.” DeStefano on what she had heard: “It wasn’t just Brie’s voice, it was her cries, it was her sobs that were unique to her.”

Then the police. It was “a prank call. That it happens often”. In her own summary: “no actual crime had been committed, no one was physically kidnapped, and no money was transferred, period, the end.”

It was not the end. Her mother later received a call in her brother’s voice, claiming an accident and asking for hospital money.

A threat to drug, rape and dump a child, delivered in the child’s own voice, is not a crime in the jurisdiction where it happened, because nobody paid.

A principal’s career: Eric Eiswert (Maryland, 2024)

In January 2024 an audio clip spread of Eric Eiswert, principal of Pikesville High School in Baltimore County, “expressing frustration with Black students and their test-taking abilities” and disparaging Jewish people. Angry calls flooded the school, and “police were sent to patrol Eiswert’s home in response to threats.” (AP, 29 April 2025, via Yahoo News)

The recording was made with AI. Prosecutors charged Dazhon Darien, the school’s athletic director, whom the principal had told his contract would not be renewed. Darien’s original charges were theft, stalking and retaliating against a witness. In April 2025 he “entered an Alford plea to the single misdemeanor charge” of disrupting school operations, acknowledging the evidence without admitting guilt, and was sentenced to four months in jail (AP).

Eiswert “said from the beginning that he believed the recording was fake.” He now runs another Baltimore County school and has sued the school district (AP).

This is the liar’s dividend run backwards. Chapter 10 describes how fakes let the guilty dismiss real evidence. Here a real man had to prove a fake was fake, while police guarded his house.

Twenty-eight schoolgirls: Almendralejo (Spain, 2023)

In September 2023, in Almendralejo, a town in Badajoz province, girls “aged between 11 and 17” learned that naked photographs of them were circulating. They had never posed for them. “Around 28 girls have so far found that they are victims.” Eleven local boys, “all said to be aged between 12 and 14”, were identified as making the images or spreading them on WhatsApp and Telegram, and “one of the girls has been blackmailed using the photos.” (The Scotsman, 24 September 2023)

The photos were taken from the girls’ Instagram accounts and run through an app called ClothOff, whose slogan was “Undress anybody, undress girls for free” (Euronews, 19 September 2023). Miriam Al Adib, a local doctor and the mother of one victim, went public. Her daughter told her, “Mum, look what they have done to me.” To the boys: “You are not aware of the damage you have done to these girls and you’re also unaware of the crime you have committed.” (Euronews)

The Badajoz juvenile court declared fifteen minors responsible for twenty offences of child pornography and twenty offences against moral integrity, and imposed a year of supervised probation, plus mandatory education on sexuality, social media and equality (Europa Press via Diario de León).

830 links: Breeze Liu (2020 onward)

In 2020 a friend called Breeze Liu: “there’s a video of you circulating on PornHub.” It was a nude recording, made and published without her knowledge or consent, and it “spawned hundreds of deepfake iterations”. At the peak there were “more than 830 links”. “That was really one of the most devastating moments in my entire life.” She thought about jumping from the roof of her apartment building (Ian Krietzberg, TheStreet, syndicated by The Bulletin, 5 April 2024).

The police were dismissive. A nonprofit she turned to called it “just one stupid boy who made one tiny mistake”. A French internet hotline got many of the links taken down. 142 instances sat on Microsoft’s Azure servers; Microsoft said it was investigating (The Bulletin).

She left venture capital and founded AlectoAI, which pairs facial recognition with reverse image search so a person can find where their face has been put. It is free to individuals (The Bulletin).

The tool that found her abuse is the same tool, aimed the other way, that the rest of this site documents as surveillance. That is not a contradiction. It is the whole problem in one product.

The count, the law, and an election (2026)

The FBI started counting AI as its own category in 2025: 22,364 complaints, $893,346,472 in losses. More than $30 million went to AI-assisted business email compromise, more than $5 million to “distress” scams where “voice cloning technology is used to mimic the sound of a loved one in distress,” and almost $13 million to AI-involved employment scams, in which “the actions and lip movement of the person interviewed on-camera do not completely coordinate with the audio,” usually as a way into a company’s network (FBI IC3, 2025 Annual Report).

Since 19 May 2026 US platforms must “remove those intimate images, and known identical copies, within 48 hours of a valid request,” AI-generated ones included. FTC Chairman Andrew Ferguson: “In the age of AI, anyone can be targeted, and that becomes even more appalling if children are involved” (FTC). Breeze Liu had needed four years and a company of her own.

In Hungary’s April 2026 election the governing party ran “an AI-fuelled campaign”; “Some deepfakes were shared by Orbán himself and by mainstream media, including the PSB, M1”; a Fidesz-allied company’s “AI-generated videos smearing Magyar were shown an estimated 650m times across YouTube and Facebook,” and “Deepfake images of Magyar also appeared on billboards nationwide.” Voters “ousted Fidesz, the governing party, after sixteen years in power and elected Péter Magyar in a landslide victory” (Reuters Institute Digital News Report 2026, Hungary).