The Answer in 60 Seconds Most coverage of deepfakes focuses on the CEO who tricks your finance team into wiring money. That is a real and separate problem, and we cover it in Deepfake Funds-Transfer Fraud. This article is about a quieter exposure: AI-generated voice, face, and synthetic identities defeating the controls that decide who gets in. Voice-print login, face-match onboarding, and "verify it's really you" account-recovery flows were built on the assumption that a live face or a live voice is hard to fake. That assumption has expired.

The Monetary Authority of Singapore says so directly. Its September 2025 information paper Cyber Risks Associated with Deepfakes names "circumventing biometric authentication and identity verification controls" as the first of three core deepfake threat vectors. (MAS Information Paper, September 2025.) Documented cases overseas have shown facial-recognition checks defeated repeatedly by imitating the person pictured on a stolen identity document.

If your SME uses biometric login, onboards customers remotely through a know-your-customer (KYC) flow, or relies on voice or face to authorise account changes, an attacker who clears those gates does not need to trick an employee at all. The legal exposure runs through the Computer Misuse Act 1993 and, where personal data is breached, the Personal Data Protection Act 2012. The insurance answer is split across Cyber and Crime/Fidelity, and the gaps are specific. We are an MAS-registered introducer under FAA-N02; we do not advise on, recommend, or arrange policies. We point you to a licensed Independent Financial Adviser (IFA) at the end.

The Sourced Detail

What "defeating authentication" actually means

Authentication is the gate that decides whether a request comes from a legitimate party. Three kinds of gate are now exposed to synthetic media.

Biometric login. Voice-print and face-match systems verify an identity by comparing a live sample against an enrolled template. A cloned voice or a real-time face-swap presents a sample that the system reads as genuine. MAS frames this as the lead deepfake risk for financial institutions, and the same logic applies to any SME that has bolted face or voice verification onto its own app, customer portal, or staff access. (MAS Information Paper, September 2025.)

KYC and onboarding. Remote onboarding typically asks a new customer to photograph an identity document and take a "liveness" selfie. Attackers now submit deepfake selfies and manipulated document images to pass these checks and open accounts under stolen or wholly synthetic identities. Documented overseas cases have shown facial-recognition programs fooled repeatedly by imitating the people pictured on identity documents.

Account recovery and step-up checks. The weakest gate is often the "I've lost access" flow. When a password reset, a new-device login, or a high-value change is challenged with a callback or a voice check, a cloned voice can carry the attacker through. The 12 March 2025 joint advisory by the Singapore Police Force, MAS, and the Cyber Security Agency of Singapore describes exactly this pattern of digitally manipulated synthetic media used to impersonate a known party in a live interaction. (SPF/MAS/CSA Joint Advisory, 12 March 2025.)

The distinction from CEO-fraud wire transfers matters for coverage. In wire fraud, a human employee voluntarily moves money after being deceived. In authentication defeat, the system itself is fooled and the attacker takes over the account or the identity. No employee makes a payment decision. That single difference changes which insuring agreement responds.

Why the "synthetic identity" angle is distinct

A synthetic identity is not a stolen person. It is a fabricated one, often stitched from a real identity number, an AI-generated face, and a cloned or generated voice, assembled specifically to pass an onboarding gate. Once the account exists, it becomes a mule account, a credit line, or a foothold for fraud against your other customers. The exposure for an SME is twofold: the direct loss when a synthetic-identity account defrauds you, and the liability when your platform was the gate that let a synthetic identity through to harm someone else.

The technical floor has dropped

None of this requires a state actor. A free voice-cloning tool needed only seconds of recorded audio to produce a usable clone in McAfee's 2023 research; commercial text-to-speech now generates convincing speech from a 15-second sample. Real-time face-swap runs on top of a webcam feed. Source material is harvested from the same public places your staff and customers already post: LinkedIn, conference recordings, media interviews. The older defensive advice, watch for unnatural blinking or lip-sync drift, has largely expired against current models. Singapore's CSA itself notes that consumer-grade deepfake detection tools remain nascent. (CSA Advisory AD-2024-006.)

The Singapore legal position

Computer Misuse Act 1993 (CMA). When an attacker uses a deepfake to clear an authentication gate and reach an account, the access is by definition unauthorised. Section 3 makes it an offence to secure access to any program or data without authority; section 5 covers unauthorised modification of computer material, which is in point when the attacker changes account details or recovery settings. (Computer Misuse Act 1993, Singapore Statutes Online.) The Act's own definition section confirms that access is "unauthorised" where the person is neither entitled to control that access nor has the consent of someone who is. (CMA 1993, section 2 interpretation.) Where the fraud turns on a stolen national digital identity credential, section 8B, added by Act 16 of 2023, separately criminalises supplying another person's Singpass credential. (CMA 1993, section 8B.) The most recent amendment, Act 21 of 2025 in force 30 December 2025, added a defined class of "scam offence" and a new Second Schedule, signalling how seriously the legislature now treats this category. (CMA 1993, current version.)

Personal Data Protection Act 2012 (PDPA), section 24. If a synthetic-identity or account-takeover attack succeeds because your authentication was weak, you also have a data-protection problem. Section 24 requires an organisation to protect personal data in its possession by making reasonable security arrangements. (PDPA 2012, section 24.) The Personal Data Protection Commission has repeatedly treated inadequate access controls as a breach of section 24. An authentication gate that a deepfake walks through is squarely within scope.

PDPA section 26D, the breach-notification duty. Where a deepfake-enabled takeover exposes personal data, Part 6A of the PDPA applies. (PDPA 2012, Part 6A Notification of Data Breaches.) Section 26D requires notification to the Commission as soon as practicable, and in any case within 3 calendar days, once you assess a breach as notifiable, with affected individuals notified where the breach is likely to cause significant harm. (PDPA 2012, section 26D.) A notifiable breach is one likely to cause significant harm, or one of significant scale, which the PDPA (Notification of Data Breaches) Regulations set at a prescribed number of affected individuals (currently 500). The financial penalty for breach of the protection or notification obligations sits in the enforcement provisions in Part 9C, at section 48J; confirm the current ceiling against that section and the dated explainer before relying on a figure. (PDPA 2012, Part 9C enforcement, section 48J.)

The order of these matters. An account-takeover breach can trigger the CMA (the attacker's offence), section 24 (your protection duty), and section 26D (your notification clock) at once, on different timelines and to different bodies.

Singapore Insurance Market Context

This is where SMEs are most often surprised after a loss. Three product families touch authentication-defeat losses: Cyber, Crime/Fidelity, and the Social Engineering Fraud (SEF) extensions that bridge them. None automatically pays, and the trigger that fits authentication defeat is different from the one that fits CEO wire fraud.

Cyber Insurance. A typical Singapore SME cyber policy covers breach response, network security failure, third-party privacy liability, and business interruption. Account takeover via defeated authentication is closest to a network security failure and a privacy liability event: an unauthorised party reached systems and personal data. The breach-response and section 26D notification costs generally sit here. Note that notification cost is often a separate sub-limit rather than part of the main aggregate, which we cover in Cyber Notification Cost: In-Limit vs Separate Sub-Limit. The gap appears when the takeover leads to a funds-transfer loss: that pivots to the Funds Transfer Fraud or Social Engineering agreements, which are usually capped well below the main limit.

The authorised-versus-unauthorised distinction. This is the single most important wording issue, and it cuts the opposite way from CEO wire fraud. A traditional Computer Fraud or Computer Crime agreement responds when funds or data are taken without the insured's authorisation, for example when an attacker who has defeated authentication moves money directly from a customer's account. That is closer to a covered "unauthorised access" loss than a Social Engineering Fraud loss, where an employee was tricked into authorising a transfer. The classification turns entirely on whether a person inside your business made a voluntary decision. Where a deepfake fooled a machine, not a person, the unauthorised-access agreements are more likely the right home, and the Social Engineering verification conditions may not even apply. Map this carefully with your adviser, because insurers will scrutinise it at claim time.

Crime / Fidelity Insurance. A standalone Commercial Crime policy covers employee dishonesty, computer fraud, forgery, and funds-transfer fraud. For authentication defeat, the Computer Fraud agreement, covering loss from unauthorised manipulation of systems, is the natural fit when an external party clears your gate and extracts value. The line to watch is the boundary between an external attacker (Computer Fraud territory) and an insider misusing legitimate access (employee dishonesty territory). The market view is that social engineering and deepfake technology are enabling more convincing impersonation, and that businesses often assume they are covered only to find gaps after a loss.

Third-party liability when your gate fails. If a synthetic identity passes your onboarding and then defrauds your real customers, your exposure is third-party. Cyber privacy and network liability, and in some cases Professional Indemnity or Tech E&O, are the relevant agreements. The first question your adviser should ask is whether your policy responds to harm suffered by a third party because of a security failure on your side, not only to your own first-party loss.

The sub-limit and silent-cover problem. As with wire fraud, fraud-related agreements often carry sub-limits far below the main aggregate, and some defence and forensic costs erode that same sub-limit before any indemnity is paid. Singapore-distributed insurers have not, to public knowledge as of May 2026, launched authentication-specific or affirmative deepfake endorsements branded as such. Coverage for authentication-defeat losses rests on existing unauthorised-access, computer-fraud, and privacy-liability agreements, read against their conditions and caps. Insurers may also cap limits or narrow terms as impersonation fraud grows more sophisticated.

Common Mistakes

  1. Treating biometrics as a silver bullet. Adding face or voice login feels like an upgrade. Against a cloned voice or a real-time face-swap, a single biometric factor can be a weaker gate than a hardware security key, not a stronger one.
  2. Assuming "unauthorised access" is automatically covered. Cyber and Crime agreements respond to unauthorised access only on specific terms. Read whether deepfake-enabled access counts, and whether the loss is first-party, third-party, or both.
  3. Confusing this with CEO wire fraud. The two have different triggers. A policy tuned only for Social Engineering Fraud verification (the wire-fraud control) may not be the agreement that responds when a machine, not an employee, was fooled.
  4. Forgetting the section 26D clock. An account takeover that exposes personal data starts a 3-day notification clock to the PDPC the moment you assess it as notifiable. (PDPA 2012, section 26D.)
  5. Ignoring liability to onboarded customers. If a synthetic identity cleared your KYC and then harmed your customers, your exposure is third-party liability, a different agreement from your own first-party fraud loss.
  6. Relying on "spot the deepfake" training. Detecting artefacts by eye no longer works reliably. The control is procedural and technical, not perceptual. (CSA Advisory AD-2024-006.)

What This Means for Your Business

A deepfake that defeats authentication is a controls problem with insurance as the backstop, not the other way round.

Step 1 - Do not rely on a single biometric factor. Pair any voice or face check with a possession factor such as a hardware security key or an authenticator app. Biometrics are a convenience layer, not a sole gate for high-value actions.

Step 2 - Harden onboarding and account recovery. Treat liveness checks as defeatable. Add document-authenticity checks, cross-reference against authoritative records where lawful, and apply step-up verification on high-risk actions. Account recovery is the gate attackers probe first; make it the hardest, not the easiest.

Step 3 - Map your authentication estate. List every gate that uses voice or face: staff login, customer portal, payment authorisation, account recovery. For each, record what a successful deepfake would unlock and whether a second non-biometric factor stands behind it.

Step 4 - Pre-wire the section 26D response. Know who assesses a breach, who notifies the PDPC, and where the 3-day clock starts. Build the notification path before you need it. (PDPA 2012, Part 6A.)

Step 5 - Run an insurance gap audit. Establish, in writing, whether account takeover via defeated authentication is covered as a network-security or privacy event, whether a downstream funds-transfer loss falls under an unauthorised-access agreement or a Social Engineering sub-limit, and whether third-party liability to defrauded customers responds.

Questions to Ask Your Adviser

  1. If an attacker defeats our biometric login or KYC and takes over an account, does my Cyber policy treat that as a covered network security failure and privacy event, or is it excluded as "impersonation"?
  2. Is the resulting loss classified as unauthorised access / computer fraud (no employee authorised it) rather than Social Engineering Fraud, and does the right agreement carry an adequate limit, not just a small SEF sub-limit?
  3. Does the policy respond to third-party liability when a synthetic identity passes our onboarding and then defrauds our own customers?
  4. Are section 26D breach-notification costs covered, and do they sit inside the main limit or a separate sub-limit?
  5. Do defence and forensic costs erode the same sub-limit as the indemnity?
  6. What authentication conditions or warranties does the policy impose, for example a requirement for multi-factor authentication, and would a single-biometric gate breach them?
  7. How does this Cyber wording dovetail with my Crime/Fidelity policy so an account-takeover loss does not fall between the two?

COVA is a Singapore B2B insurance management platform registered as an introducer under MAS Notice FAA-N02. We do not advise on, recommend, or arrange policies. We provide factual information sourced from primary regulators and route Singapore SMEs to licensed Independent Financial Advisers and brokers who can compare actual wordings, sub-limits, and conditions against your specific exposure.

Related Information

Published 31 May 2026. Source verified 31 May 2026. COVA is an introducer under MAS Notice FAA-N02. We do not recommend insurance products. We provide factual information sourced from primary regulators and route you to a licensed IFA who can match a policy to your specific situation.