Deepfake Threat Report, Week of 21 September 2026: Suspected Voice Clone Takes $66,000 Home Down Payment

How did a suspected voice clone take a Michigan couple's $66,000 closing payment?

CNN reported on 15 September that Brian and Wendy VanDoeselaar lost $66,026.92 while buying a $460,000 condo in Hudsonville, near Grand Rapids. On 19 May, days before closing, an email that appeared to come from their loan officer told them to wire the down payment and closing costs within 24 hours. The sender's address added two letters to the lender's real domain, and the phone number in the email differed from the loan officer's by its last two digits.

Brian VanDoeselaar called that number to confirm the instructions, and the voice that answered sounded like the loan officer. He told CNN he now believes the number was spoofed and the voice was made with AI-assisted cloning. Tyler Adams of CertifID, which is helping the couple pursue recovery, said the attackers probably cloned the voice from the loan officer's social media clips and likely had access to a compromised mailbox, given how precise the amount and timing were.

The scam stacked email compromise, a lookalike number and a cloned voice that passed the one check the buyers made. CNN cited FBI figures putting real estate scam losses above $275 million in 2025, up 58.5% on 2024. Our guide to voice cloning attacks explains how little audio a clone needs.

The control that would have stopped this payment is a callback to a number taken from the original loan documents, never from the email that asked for money. Voice deepfake screening helps most on the business side, where lenders and title agents take calls claiming to be a client or colleague.

What did the Matryoshka network's midterm deepfakes look like?

AFP reported on 15 September that a Russia-linked operation known as Matryoshka, also called Operation Overload, had started pushing deepfake videos at the November US midterms. The clips paired real footage of actors, including Sarah Jessica Parker, Julia Roberts, Emma Caulfield and Ed Begley Jr, with cloned audio attacking Democratic candidates such as Georgia Senator Jon Ossoff and Texas Senate candidate James Talarico. The source footage came from old advertising campaigns and from Cameo, where celebrities sell personalised videos.

Many clips carried fake CNN branding, which CNN disavowed. The research collective Antibot4navalny first attributed the videos, and Clemson University researcher Darren Linvill told AFP they were the first salvo against the vote. X, Bluesky and TikTok removed some posts.

The same day, France 24 showed that a viral selfie of BRICS leaders, posted by Russia's embassy in South Africa and shared by Iranian embassy accounts in India and Armenia, was AI-generated. Fact-checkers found an invisible AI watermark, and the image showed Brazil's president, who did not attend. For campaigns and newsrooms, the useful controls are fast verification of suspect clips and a prepared public response. Our explainer on how deepfakes can affect elections covers the wider pattern.

Why did Meta's Oversight Board call its deepfake rules inadequate?

On 17 September the Oversight Board ordered Meta to remove two AI-generated posts. The first was a November 2025 video of a Scottish Labour councillor appearing to make hateful claims about refugees. The audio did not fully match her facial movements. She and another user reported it, both appeals were refused without human review. Meta later told the Board it broke no rule.

A majority of the Board found the video broke Meta's hateful conduct rules and should at least have carried a High Risk AI label. Its six recommendations include lowering the threshold for that label, adding click-through screens, demoting high-risk content and publishing yearly label counts.

The second case involved AI-edited videos of a young Muslim woman in Europe who had appeared on television for a menstrual health campaign. The series drew tens of millions of views across platforms, and Meta automatically closed her report and appeal. The Board asked Meta to cover deepfakes of private people saying or doing things they never did, to add such imagery to its media matching banks, and to use signs of AI manipulation to prioritise reports for review. That last recommendation is a detection control: a manipulation score that sends a report to a person instead of an automatic closure.

What does the Montana SB 25 injunction mean for election deepfake laws?

On 16 September US District Judge Susan Watters granted a preliminary injunction in Accountability in State Government v. Knudsen, blocking Montana from enforcing Senate Bill 25 of 2025 against the two plaintiffs, former legislator Dan Bartel and his political committee. The law bars paying for or sponsoring a deepfake of a candidate or party within 60 days of voting, with an AI disclosure as a safe harbour.

Watters found the law likely discriminates by viewpoint, because it treats equally deceptive media differently depending on whether the message elevates a candidate, and called it presumptively unconstitutional. Citing Trump v. CASA, she limited relief to the named plaintiffs, so the statute still applies to everyone else in Montana while the case continues. Teams that publish political or advocacy content across states should follow these rulings alongside our guide to US deepfake laws, because disclosure and timing rules are being tested in court one state at a time.

What is new in the 2026 DHS Remote Identity Validation Rally?

On 21 September the DHS Science and Technology Directorate announced an expanded 2026 Remote Identity Validation Rally. It adds AI-generated fake documents to document validation testing, uses a wider set of genuine and fraudulent passports and driver's licences, and introduces a Biometric Deepfake Detection category for AI-generated impersonation, including in video chats and teleconferencing, next to presentation attack detection.

The schedule starts with an information webinar on 30 September, opens document validation and selfie-to-document matching applications in October, asks organisations to share real identity deepfake attacks in November, and opens presentation attack detection and deepfake detection applications in December. For identity teams, a government test that scores deepfake detection apart from liveness is useful, because a system can pass presentation attack testing and still accept an injected deepfake.

What should security teams do about deepfakes this week?

Each incident this week exploited a check that trusted what a person saw or heard. These five steps close the gaps they used:

For staff who handle payment calls, our guide on how to verify a suspected voice-clone call gives a short script that works under time pressure.

• Require callbacks to numbers already on file before any wire, payment change or closing instruction, and tell customers in writing that wire details are never changed by email or phone.
• Screen inbound calls that request payments, password resets or account changes for synthetic voice, and send high-risk calls to a second verifier.
• Prepare a takedown and statement plan for deepfakes of executives, spokespeople or candidates, naming who files platform reports and who checks the clip.
• Use manipulation scores to rank user reports and review queues so likely deepfakes reach a human instead of closing automatically.
• Test onboarding flows against injected deepfakes and AI-generated documents, and read the RIVR test protocol when DHS publishes it.

Where does Neural Defend fit for incidents like these?

NeuroCall (Beta) is Neural Defend's voice and call deepfake detection product, built for the attack behind the Michigan fraud and the cloned celebrity statements. Lenders, title agents and contact centres can use it to screen calls that ask for money or account changes before staff act on them.

NeuroVerify covers onboarding and KYC, the area the DHS rally now tests. One API call checks a face image, video or audio clip with six signals, including Face Manipulation Detection and AI Generative Model Analysis, and returns one risk score with signal-level evidence, in under 200 ms p95 on eligible image requests under defined test conditions. On the public VendorBench-100 benchmark of 100 adversarial still images, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor. That benchmark does not test audio, video or injection, and one of its authors also co-authored Neural Defend's ARCAS 1B paper.

NeuroDetect suits cases like the Oversight Board and Matryoshka videos, where an analyst needs to examine suspect media down to frames, regions and audio segments, read an explainability heatmap and export a forensic report that records uncertainty and model context. In each case the score is a signal, and the analyst or your policy makes the decision.