A fair settlement offer for a deepfake-authorized bank transfer reflects your actual legal leverage—which depends heavily on where you bank—plus documented proof of the bank's own verification failures. A "dangerously low" offer is one that falls far below your jurisdiction's reimbursement ceiling without any documented finding that you were grossly negligent. A deepfake voice is AI-generated audio that clones a real person's voice closely enough to fool someone who knows them.
The hard part is that the law often starts from a weak position for the victim. In the United States, a transfer you were tricked into sending is usually treated as "authorized," which strips away the automatic reimbursement most people assume they have. That single distinction reshapes what counts as a fair number.
Official resources:
- Explore the official data from FTC — Use this primary source to review the underlying data.
- Read the official notice from Consumerfinance — Use this primary source to verify the official announcement.
Table of Contents
- Why "authorized" is the word that decides everything
- The UK benchmark that shows what "fair" can look like
- The scale behind a single deepfake loss
- What separates a fair offer from a dangerously low one
- Practical steps before you respond
- Frequently Asked Questions
Why "authorized" is the word that decides everything
The core legal fork is whether the transfer was "authorized" or "unauthorized." Under U.S. law, Regulation E—the federal rule covering electronic fund transfers—defines an "unauthorized" transfer as one you did not initiate. The Consumer Financial Protection Bureau's Regulation E text makes clear this excludes transfers a consumer sends themselves, even under a false pretense. That means a payment you sent because a cloned voice told you to is legally "authorized." Reg E's familiar loss caps—$50 or $500 depending on how fast you report—generally do not apply.
Those caps protect you from stolen-card and hacked-account fraud, not from being deceived into pushing the money yourself. The practical consequence is stark. As the CFPB's electronic fund transfer FAQs reflect, a U.S. bank's baseline obligation to reimburse a deepfake-induced wire can be zero. Any offer above zero is therefore a negotiation, not a right—so you measure it against leverage, not against your full loss.
The UK benchmark that shows what "fair" can look like
The United Kingdom took the opposite approach, and it gives victims elsewhere a concrete yardstick. Since 7 October 2024, the UK's Payment Systems Regulator requires banks to reimburse "authorised push payment" (APP) scam victims—people tricked into sending money—up to £85,000 within five business days. The regulator's policy statement also splits the cost 50/50 between the sending and receiving banks. An APP scam is exactly the deepfake-voice scenario: the victim authorized the payment but did so because of deception.
So a genuinely fair UK offer approaches that £85,000 ceiling, paid quickly, unless the bank has a specific reason to reduce it. The ceiling itself is a real limit, not bad faith. The £85,000 cap was cut from a proposed £415,000 to align with the Financial Services Compensation Scheme, according to PwC's analysis of the final rules. A loss like the roughly US$25 million Arup case would be reimbursed only up to that ceiling—so a capped offer is not automatically a lowball.
The scale behind a single deepfake loss
These are not fringe events, and the dollar figures are large. In February 2024, a finance employee at engineering firm Arup paid out about US$25 million after a video call in which AI deepfakes of the CFO and colleagues—cloned voices and faces—approved the transfers, according to the AI Incident Database. It stands as the most costly documented deepfake-authorized transfer to date. Voice alone has been enough for years. In a 2020 case, a Hong Kong bank manager authorized around US$35 million after a call whose voice matched a company director he knew, as reported by ScreenRant.
An earlier UK energy-firm case used deepfake audio impersonating a CEO to move roughly US$243,000, an early proof of voice-only fraud. The wider pattern frames any single settlement. The U.S. Federal Trade Commission reported that consumers lost $3.5 billion to imposter scams in 2025—the most-reported fraud category—with bank impersonators drawing the highest losses, per the FTC's June 2026 release. Your case is one data point in a very large, well-documented problem, which strengthens the argument that banks should have controls in place.
What separates a fair offer from a dangerously low one
A fair offer is bounded by four things: your jurisdiction, the applicable ceiling, evidence of the bank's own verification failures, and any negligence dispute. In the UK, that anchor is the £85,000 cap; in the U.S., there is no statutory floor, so the bank's conduct and your documentation carry more weight. An offer far below the cap—without a documented gross-negligence finding—is the dangerously-low signal.
The main lever a bank uses to justify paying less is your own conduct. The UK regime lets firms reduce or deny reimbursement where the customer acted with gross negligence—the "consumer standard of caution"—as a Freshfields briefing explains. If the bank is cutting your offer, ask which specific act of caution it says you failed, and whether that is documented or merely asserted. Use these questions to test an offer before you accept:.
- Which jurisdiction's rules apply, and is there a statutory cap (like the UK's £85,000) the offer should approach?
- Has the bank documented a specific gross-negligence finding, or is it discounting without one?
- Did the bank's own systems flag the transfer—unusual amount, new payee, speed—and act, or not?
- Does the offer reflect the receiving bank's share of liability, not just the sending bank's?
- Are you being asked to sign a release before you understand the full loss and any co-liable parties?
Practical steps before you respond
Move quickly and preserve everything. The reimbursement clock and your evidence both decay fast, and the receiving bank may still hold recoverable funds in the first hours.
- Report to your bank in writing immediately and ask, in writing, whether it treats the transfer as authorized or unauthorized—the answer sets your entire path.
- Preserve the deception itself: call recordings, video, emails, payment confirmations, and the exact times you were contacted and acted.
- Ask the bank for its fraud-monitoring logs on the transaction; a payment its own systems should have flagged strengthens your position even where the law is weak.
- If you are in the UK, cite the PSR's mandatory reimbursement regime and the five-business-day timeline when you file.
- Get independent legal advice before signing any release, especially in the U.S., where the baseline obligation may be zero and the offer is pure negotiation.
Frequently Asked Questions
Does my bank have to refund a wire I was tricked into sending?
It depends on where you bank. In the U.S., a transfer you initiated is usually "authorized" and not covered by Regulation E's loss caps, so the baseline obligation can be zero. In the UK, banks must reimburse authorized push payment scam victims up to £85,000, subject to a gross-negligence exception.
Is a capped offer automatically unfair?
No. The UK's £85,000 ceiling is statutory, so even multimillion-dollar losses are reimbursed only to that limit. A capped offer can be fair; an offer far below the cap with no documented negligence finding is the warning sign.
What is the single most useful thing to establish early?
Whether the bank classifies the transfer as authorized or unauthorized. That one label determines which rules, caps, and reimbursement rights apply to your claim.