AI in Organized Crime: The Rise of Deepfakes

A new report published by Europol highlights the increasing threat coming from the use of AI in organized crime. Deepfake extortions, politically motivated cyberattacks and targeted data theft: cybercrime is evolving at a faster pace than Artificial Intelligence regulation. This article explores how organized crime is implementing Generative Artificial Intelligence to expand and professionalize illicit activities worldwide, and the massive human and economic costs that come with it.

Navigate

Imagine receiving a desperate call from a relative, saying that they’ve been kidnapped and begging to pay a ransom to save their lives. Minutes later, you find out that your relative is safe at home. Lookalikes are not real, but deepfake extortion is. And along with that, a new wave of digital threats is surging with the use of AI in organized crime.

According to a recently published study, Artificial Intelligence is one of the major accelerators of crime, with a wide spectrum of applications, ranging from impersonation to targeted cyberattacks.

When I started studying transnational organized crime in 2022, I quickly realized that a lot of the vocabulary used to describe its dynamics sounded very familiar to me. In fact, it mirrored the language I encountered in my previous background in management engineering: supply, demand, profit, and diversification.

Criminals, much like corporations, continuously evolve to seize new opportunities and maximize revenues.

Against this background, it is no wonder that with the advent of AI, criminal organizations around the world quickly adapted and implemented the technology in their operations. The picture that emerges from the 2025 European Union Serious and Organised Crime Threat Assessment (EU-SOCTA)¹, a study issued every 4 years by Europol, is worrisome on several aspects.

AI is the perfect companion of cybercrime

Europol’s analysis reveals how the accessibility of Artificial Intelligence, in particular Generative AI, has lowered the entry barriers for digital crime: today, these tools can be used for harmful purposes with little technical expertise. In addition, an emerging criminal business model is Cybercrime-as-a-service (CaaS), in which more sophisticated applications are sold to criminal organizations. This way, organized crime groups that want to profit from cybercrime can easily purchase ready-to-use malware, instead of investing massive resources to build their own infrastructure.

One threat in particular is highlighted as the most pressing one: social engineering attacks. Generative AI in organized crime can be used to manufacture deepfake videos, clone voices, and replicate writing styles, making online scams and data theft schemes perfectly crafted for each target.

A study published in 2020², when Large Language Models (LLMs) were not yet largely available to the public, had already identified audio/video impersonation as the most concerning application of AI in digital crimes. In particular, it was ranked as the most harmful and scalable threat, potentially impacting a larger portion of society, and the most difficult to counter.

The events of recent years have proven the study right: AI-generated deepfakes have become a worldwide reality.

Digital crime knows no borders

Criminal groups in Latin America didn’t lose any time to keep up with technology. Peru has witnessed a surge in deepfake extortions³. AI has been used to reproduce the targets’ voices, which are extracted from WhatsApp and social media, and then sent to relatives asking for ransom, simulating a kidnapping that never happened.

Similar cases have happened in Mexico⁴, where criminal organizations that operate around the US border are resorting to deepfakes to extort the families of missing migrants. Initially posing as organizations that search for people who have disappeared, they are able to obtain photos from families who are seeking help. These photos are then used to generate AI-generated images and videos that simulate kidnappings, defrauding the same targets who were looking for their relatives.

In Brazil⁵, stealing data for ransom has become the main focus of cybercrime groups. According to the country’s cybersecurity agency, data theft constitutes the majority of cybercrime incidents⁶, with almost 5000 cases recorded in the first eight months of 2025.

But these trends are not limited to the American continent: in South Africa⁷, impersonation cases have been on the rise since 2021.

Asia has a long history of criminal groups specializing in online scams. Chinese crime syndicates have established entire scam-cities in Myanmar, Laos, and Cambodia, where specialized workers from South Asia, Africa, and Southeast Asia are attracted with fake job postings and forced to conduct online fraud, usually targeting victims in Western countries.

Deepfake scams have massive human and economic costs

It is believed that only in Myanmar, more than 100.000 people⁸ are being held captive and forced to work in scam cities. Only in Southeast Asia, more than 43 billion USD⁹ is lost every year to online scams, and the use of AI to write convincing scripts and create fake personas¹⁰ is making this business more and more profitable.

The targeting and automation favored by AI make this type of attack extremely efficient. If previously, the most vulnerable targets were users with limited digital literacy, the evolution of technology is now scaling up at a faster rate. In February 2024, the Hong Kong office of a multinational company fell for a scam¹¹ in which the CEO was impersonated with a deepfake and lost 25.6 million USD.

But deepfakes can also be used for politically driven cyberattacks¹², spreading misinformation, or stealing sensitive government data.

An urgent need for AI regulation

The magnitude of this issue raises a crucial question: how can a criminal business that operates across borders and moves in the digital world be contrasted?

An approach that involves multilateral cooperation is already becoming the global standard for contrasting more traditional forms of transnational organized crime. The most important example is the United Nations Convention against Transnational Organized Crime (UNTOC)¹³, which was adopted in 2000.

In the context of AI, the main area of focus must be the private sector, though, considering that deepfake software and Generative Artificial Intelligence are generally developed legally by companies. In this field, technology is moving faster than legislation, allowing firms to operate with limited accountability.

If free market advocates have long believed that opportunities for innovation and technological advancements thrive in an environment of minimal state regulations, especially with major tech companies, we’ve already seen the nefarious effects of the lack of oversight.

Governments around the world are now moving towards stricter regulation: at the beginning of 2023, China introduced its new legislation on deepfakes¹⁴, prohibiting the production of content without user consent.

In 2024, it was the turn of the European Union with the launch of the AI Act¹⁵, a legal framework that aims to harmonise rules on AI development and use in the EU.

Even more ambitious is the United Nations Convention against Cybercrime¹⁶, which is planned to be signed at the end of October 2025, and is intended to facilitate global cooperation in combating cybercrime. This treaty hasn’t been spared from criticism and concerns¹⁷ regarding the risk that it will facilitate human rights violations and data collection by governments, harming the privacy of citizens.

But while governments and international institutions (rightfully) discuss the risks of abuse and misuse of regulation, criminal syndicates continue to extract massive profits from cybercrime, operating above ethics and law. In the end… business is business, right?