Could Insurers Face Liability for Missing Deepfake Fraud?

In early 2024, a Hong Kong employee of the engineering firm Arup transferred HK$200 million (about US$25.6 million) to fraudsters after a video call in which the company’s chief financial officer and other colleagues were deepfakes. The case raised immediate questions: should the company have had controls that would catch it? Who answers for the loss?

The same questions now reach insurers themselves. AI-enabled fraud is being measured for the first time: the FBI’s Internet Crime Complaint Center included an AI section in its 2025 annual report, recording more than 22,000 AI-related complaints and nearly US$900 million in reported losses. So when an insurer pays a claim supported by deepfake evidence, is anyone liable for missing it?

The honest answer is more nuanced than “yes.” Direct legal liability for paying a fraudulent claim is limited. The real exposures sit with boards, with regulators — and, just as importantly, with the opposite mistake of wrongly accusing honest claimants.

Who Bears the Loss From a Missed Deepfake?

When an insurer pays a fraudulent claim, the loss falls first on the insurer and, over time, on policyholders through premiums. There is generally no legal duty, owed to other policyholders or the public, to detect fraud — and no one with standing to sue the insurer simply for having been deceived.

The duties insurers owe in claims handling run mostly the other way: toward the claimant.

In Australia, s13 of the Insurance Contracts Act 1984 requires both insurer and insured to act toward each other with the utmost good faith. ASIC has been able to take action for an insurer’s breach since 2013 (s14A), and 2019 reforms made breach by an insurer a civil penalty provision (s13(2A)). Since January 1, 2021, claims handling has also been a financial service, subject to the obligation to act efficiently, honestly and fairly.
In the United States, insurers owe insureds a duty to investigate claims reasonably and handle them in good faith. State unfair claims settlement practices laws require prompt, fair investigation, and unreasonable denial can support bad-faith claims.
In England and Wales, the Insurance Act 2015 lets insurers refuse fraudulent claims, while the Enterprise Act 2016 amendments require valid claims to be paid within a reasonable time — which includes reasonable time to investigate.

These duties shape how deepfake detection should be used. They don’t create liability for missing fraud; they create liability for mishandling claims — including honest claims wrongly flagged as fake.

Exposure 1: Board Oversight

The most credible “liability for missing fraud” argument concerns governance, not the individual claim.

US: Caremark and Marchand

Under Delaware law, In re Caremark (1996) held that directors can be liable for failing to make a good-faith effort to implement reporting and monitoring systems. Marchand v. Barnhill (2019) confirmed that boards must make that effort for risks that are “mission critical” to the business. The bar is high — plaintiffs must show bad faith, such as an utter failure to put any reporting system in place or conscious disregard of red flags — but for an insurer, claims fraud is plainly mission critical.

A board that:

Is aware of the deepfake fraud threat (by 2026, few can claim otherwise)
Never asks management how claims controls address synthetic media
Receives no reporting on fraud detection effectiveness
Ignores warning signs of a growing problem

…is far more exposed to an oversight claim than one that can show it considered the risk and made a reasoned decision — whatever that decision was.

Australia: Directors’ Duties and FAR

In Australia, directors owe a duty of care and diligence under s180 of the Corporations Act 2001. Since March 15, 2025, the Financial Accountability Regime (FAR) has also applied to insurers, requiring accountable persons to take reasonable steps to prevent matters arising that would breach the entity’s obligations. APRA’s prudential standards place responsibility for the risk management framework, including operational risks such as fraud, with the board.

A Board Decision Lens

The Learned Hand formula (United States v. Carroll Towing Co., 1947) — comparing the burden of a precaution (B) with the probability (P) and magnitude (L) of the loss it prevents — is a negligence test, not a rule that makes insurers liable for being defrauded. But it is a useful way for a board to frame the decision.

Illustrative example (assumptions, not measured rates): a general insurer with AUD 2 billion in gross written premium and a 65% claims ratio pays about AUD 1.3 billion in claims. If fraud supported by manipulated media were 1% of that, the annual exposure would be AUD 13 million. A board that compares a figure like that with the cost of detection, documents its reasoning and acts on it is in a strong position. A board that never runs the numbers is not.

D&O Insurance

D&O policies typically exclude claims arising from the directors’ own fraud but respond to allegations of negligent oversight. Oversight claims over missed third-party fraud would generally fall into the latter category — one reason D&O underwriters increasingly ask how boards oversee emerging risks.

Exposure 2: Regulators

Regulators are the more immediate source of pressure. They generally don’t mandate specific technology, but they expect controls that fit the risks.

Australia

APRA has said its existing standards already cover AI, and its April 2026 letter to industry on AI called for a “step-change” in AI risk management, listing claims triage and fraud and scam disruption among the uses it sees. Its 2026–27 Corporate Plan tells entities to expect more frequent and deeper engagement on cyber and AI risks. See our guide to APRA’s expectations. The Insurance Council of Australia’s General Insurance Code of Practice also governs how claims investigations are conducted.

United States

Most states require insurers to maintain anti-fraud plans or special investigations units, and 43 states plus DC require suspected fraud to be reported
The NAIC Model Bulletin on AI, adopted in 25 states and DC, governs how insurers use AI — including in claims and fraud detection

European Union

Solvency II requires an effective system of governance and risk management, which covers operational risks such as fraud
The Digital Operational Resilience Act (DORA) has applied since January 17, 2025, including to ICT third-party providers such as AI vendors
EIOPA’s August 2025 Opinion on AI governance sets supervisory expectations for insurers’ AI systems, and the EU AI Act adds obligations for high-risk uses

United Kingdom

The FCA’s Consumer Duty (in force since July 31, 2023) requires firms to deliver good outcomes for retail customers. It cuts both ways: weak fraud controls push up costs for honest customers, but aggressive or opaque fraud screening that delays legitimate claims is also a poor outcome.

Exposure 3: The Reverse Risk — Wrongful Denial

The most established legal exposure in this area is not missing a deepfake. It is treating genuine evidence as fake.

A false positive that leads to a delayed or denied claim can bring:

Bad-faith and unfair claims settlement exposure in the US
Utmost good faith, efficiently-honestly-and-fairly and Code of Practice issues in Australia, and complaints to the Australian Financial Complaints Authority
Late-payment damages and Consumer Duty concerns in the UK
Defamation risk if the claimant is reported to authorities without reasonable grounds

This is why how detection is deployed matters as much as whether it is deployed. Detection results should prompt human review, the claimant should have a chance to respond, and decisions should be documented. See our guide to fraud reporting obligations.

Adjusters and Investigators

Claims adjusters and investigators are expected to exercise the skill and care of a reasonably competent professional. As synthetic media becomes common, that standard is shifting. An adjuster who accepts video or photo evidence at face value when there are obvious warning signs, or ignores detection tools that the insurer has provided, is in a weaker position than one who follows a documented protocol.

For independent adjusters and outsourced investigators, that can translate into errors-and-omissions exposure under their own contracts. For in-house staff, it’s a matter of training and supervision. Either way, training on synthetic-media risk, access to detection tools and documented investigation protocols are the best mitigation.

Recovery When Fraud Is Found Later

Against the Fraudster

Recovery against the person who submitted fabricated evidence is straightforward in principle — they obtained money by deception. In practice, they may be hard to identify, located in another jurisdiction or unable to pay.

Against Technology Vendors

If an insurer deployed detection that failed to catch the fraud, any claim against the vendor will turn on the contract: what was promised, what was excluded, whether the specific technique was within the tool’s documented scope, and whether the tool was integrated and operated as intended. No detector catches everything, which is why human review and layered controls matter.

With Reinsurers

Reinsurers take an interest in cedants’ claims controls, and serious control weaknesses can become a point of discussion at renewal. Insurers should be ready to explain how their fraud controls address synthetic media.

Common Reasons for Waiting — and Better Answers

“We haven’t seen deepfake fraud in our book.” Without tools that look for it, that is hard to know. A proof of concept on recent claims media is a low-cost way to find out.
“The technology isn’t mature.” Evaluate it on your own representative data rather than relying on anyone’s headline benchmark, including a vendor’s.
“It’s too expensive.” Run the board-level cost comparison above with your own assumptions.
“Our existing controls are adequate.” Ask whether they examine the authenticity of photos, documents and recordings — or only the claim data around them.

Risk Mitigation Strategy

Immediate Actions

Board briefing on deepfake fraud risk, detection options and the wrongful-denial risk
Gap analysis of current fraud controls against manipulated and synthetic media
Market assessment of detection solutions, including insurer-first tools built around claims workflows
Training program for claims staff on synthetic-media awareness

Medium-Term Actions

Pilot deployment of detection in the highest-risk claims channels
Policy review so fraud management frameworks address synthetic media and human review of flags
Reinsurance discussion to understand treaty partners’ expectations
Regulatory engagement to understand supervisory expectations

Ongoing Actions

Monitor detection effectiveness and update tools as generation techniques evolve
Document everything — the board’s consideration, the technology evaluation, the deployment decision and ongoing performance
Review the fraud detection program at least annually

The Trajectory

Standards of reasonable practice rise as technology becomes more widely available and affordable. That happened with cybersecurity controls and data encryption, and we expect the same with synthetic-media detection in claims. Insurers that evaluate and deploy early — with good human review — will be able to show a reasoned, documented response. Those that ignore the issue will find it harder to explain their choices to boards, regulators and reinsurers.

Conclusion

Could insurers face liability for missing deepfake fraud? Not in the simple sense that paying a fraudulent claim makes an insurer liable to someone. But the exposure is real: boards must oversee mission-critical risks, regulators expect controls that fit current threats, and the documented record of how an insurer responded to deepfakes will matter when things go wrong. At the same time, the clearest legal risk is wrongly denying honest claims — so detection must be paired with human review.

The case for acting now is strong: evaluate detection on your own claims media, deploy it with proper governance, and document the decision. Request a demo to see how deetech™ fits into your claims workflow and your fraud controls.

This article is for informational purposes only and does not constitute legal, regulatory, or compliance advice. Insurers should consult qualified legal and compliance professionals for guidance specific to their circumstances and jurisdiction.