Deepfake Voice or Video Used to Borrow Money in Your Name: What Both the Impersonated Person and the Family Should Do

If you are the one being impersonated: notify first, then lock down

The urgent task is not finding out who did it. It is reaching everyone who might be contacted before more of them send money. Fraudsters usually message several people at once, so each minute of delay can mean another victim.

1. Broadcast a correction. Using a channel you are sure you still control, such as a phone call, a second social account or the family group, send a short message: someone is using fake video and audio of me to borrow money; ignore any request in my name and ring me on this number if unsure. Start with parents, spouse, siblings and the few people you deal with financially, then post it publicly.
2. Work out whether your account was taken over. Impersonation comes in two forms: a fresh account with your name and photo, or a login to your real one. Check the list of logged-in devices, look for messages you did not send, and test whether your password still works. Recovery routes are in what to do when a social account is hacked or disabled.
3. Secure the accounts. Change passwords, remove unknown devices, turn on two-step verification, and enable login protection in messaging apps. If your phone suddenly has no signal, consider that the number has been moved; see what to do when your number is hijacked.
4. Report the fake account. Use the impersonation category and ask several friends to report it too, which tends to speed things up.
5. Ask recipients to keep evidence. They should save the account profile, chat history, any screen recording of the call and the payment details they were given before blocking anyone.

What not to do at this stage: do not contact the fraudster to confront them, and do not open links that claim to trace their location. Your job is notification and containment. Investigation belongs to the police.

If you receive the plea: hang up, call back, ask the private question

Seeing a face and hearing a voice no longer confirms identity. The only dependable check is to reach the person yourself through a different channel. This rule works without any skill at spotting synthetic media.

There are only three steps:

1. Hang up. However urgent it sounds, say that you will ring straight back and end the call. A real relative comes to no harm because you redialled.
2. Call back on details you already had. Use the number saved in your phone long before today, or contact someone physically near them: a spouse, colleague, flatmate or landlord. Do not use the number that just called or a new number that was just supplied. The line that the phone was lost and this one is borrowed is standard script.
3. Ask something only the two of you know. A pet's name, what you ate the last time you met, the street you lived on years ago. Avoid birthdays and schools, which are easy to find online.

Some tell-tale signs are worth knowing, but do not rely on them: a very brief video call cut short because of bad signal, lip movement slightly out of step with sound, reluctance to turn the head or pass a hand across the face, and refusal to answer when you start a video call yourself. The technology keeps improving and these flaws will become rarer, which is why the three steps matter more.

The storyline is usually a road accident needing a deposit, detention by police or immigration needing a fine, a stolen phone and wallet, or an urgent business shortfall. All of these do happen in the Philippines, so they sound reasonable. In a real emergency, though, the person or someone around them can wait ten minutes while you verify. Any urgency that forbids verification should be treated as fake. A call claiming that your relative is being held is a different scenario; see how families should respond to a ransom call.

Where the raw material comes from: a few seconds of audio and public photos

Producing a voice that sounds like you or a short clip of your face takes far less source material than most people assume, and most of it was published by you. Knowing the sources tells you what to tighten. It is not a reason for alarm.

Typical sources:

• Public short videos and livestreams. Clips where you speak to camera are the most direct source of both voice and face. People who sell through live video or post daily life are more exposed.
• Voice messages. A voice note sent to a large group can be saved by any member.
• Unknown callers. A call where the other side stays silent or asks a few pointless questions may be collecting a voice sample. There is no need to stop answering the phone, but no reason to chat at length with strangers either.
• Hijacked accounts. If a social account is accessed, the intruder gains your photos and videos and also your chat history: what you call your relatives, how you write, what you have been busy with. Impersonation becomes far more convincing.
• Leaked documents and details. Once a passport image, address or employer has been exposed, those details can be woven into the story for credibility; see what to do when your personal information is posted online.

The full sequence usually runs like this: map the relationships to learn who the parents are and who handles money, make contact from a new or hijacked account, send a clip of a few seconds as proof, switch to text because the signal is supposedly poor, and finally supply an unfamiliar payment account. What makes it work is urgency, not technology. The same structure is used to pose as a company owner instructing finance staff to pay; the business-side response is in what to do about fake boss or supplier payment requests.

If money has already gone: damage control measured in minutes

The first hours after a transfer matter most. Contact the sending bank or payment provider first, report to the police second, and deal with the platform account last. Nobody can promise recovery, but faster action improves the chance that funds are intercepted or frozen in the recipient account.

1. Contact the sending institution at once. Use the number on the back of the card or the support channel inside the official app. State that it was a fraudulent transfer, ask for the transaction to be held and the recipient frozen, and note the complaint reference. If the money left an account in your home country, relatives there should contact that bank and report to local police. For a Philippine bank or e-wallet, contact that provider; basic handling of mistaken or disputed wallet transfers is in GCash transfers and troubleshooting.
2. Keep all evidence. Transfer receipts, recipient name and account number, chat logs, the fake profile, and the video or audio files themselves. If the call was not recorded, write down what you remember straight away: time, length, what was said, what was on screen.
3. File a report. A victim in the Philippines reports to the police anti-cybercrime unit or the NBI cybercrime division, following how to report cybercrime in the Philippines. A victim abroad reports where they are. When there are victims in both places, file separately and exchange the acknowledgment slips.
4. Tell the impersonated person. They need to run the notification and lockdown steps above immediately so that nobody else is caught.
5. Watch for round two. Someone may soon appear as a cyber officer, a recovery lawyer or a hacker and offer to retrieve the funds for an advance fee. Genuine reporting is free, and this is a scam aimed squarely at recent victims. A calm sequence for the aftermath is in what to do after being scammed.

For older relatives, one message matters above all: being deceived is not a sign of foolishness. Blame teaches people to hide the next incident, and telling you quickly is what makes containment possible.

What investigators will ask for, and what a report can achieve

Investigators mainly need three things: which account received the money, which account made contact, and a clear timeline. The synthetic clip itself is rarely decisive, because it seldom points to an identifiable person.

Organise a single folder:

• Timeline. In order: when the message arrived, when the video call took place and how long it lasted, when the transfer was made, when the fraud was discovered, when the bank was contacted.
• Money trail. Sending account, recipient name and account number, the bank or wallet involved, transaction reference, and the bank's complaint reference.
• Account details. The fake profile link, username, profile image screenshots, and any visible phone number or email.
• Original files. Exported chat history and the audio or video files. Keep originals where possible, not forwarded copies.
• Identity documents. ID for both the victim and the impersonated person, plus something showing how they are related.

The impersonated person is also a victim and can report the misuse of their identity separately. If the impersonator also published material that harms your reputation, whether to pursue libel is a question for a lawyer; background is in libel and cyberlibel in the Philippines. If your documents were also used to open accounts or borrow, follow what to do when your ID is used for a loan or account.

Keep expectations realistic. Recipient accounts are often mule accounts passed through several layers, the people behind them may be outside the country, investigations take time and the share of money recovered is uncertain. A report still has value beyond recovery: it creates an official record. If anyone later claims that you borrowed from them, that record shows an impersonation incident was reported at the time. Which offences apply and what an office will accept depend on the authorities' current rules.

Long-term protection for the family, and what Yixing can do

The most effective defence against deepfakes is not software. It is two things agreed in advance: a family code word, and an unbreakable rule that any request for money gets a call back.

Family code word. Choose a word or a question and answer that appears nowhere online, share it verbally, and keep it out of chat logs. Any emergency plea is met with that question first, and a wrong answer ends the call. With older relatives, skip the technical explanation and say one thing: if I ever need money, I will say this word first.

Call-back rule. Any request to transfer funds, whatever the amount and however much it looks like the real person, is confirmed by hanging up and calling the existing number. The same goes at work: an owner on video demanding an urgent payment still goes through the normal approval steps.

Reduce exposure. Set social accounts to friends only and send fewer voice notes to large groups. People whose work depends on livestreams cannot avoid showing their face, which makes the first two rules more important for them.

Share backup contacts. If you live in the Philippines, give relatives the contact details of a colleague, flatmate or landlord, so they have a second number to try. Legitimate ways to get funds when something really has gone wrong are in how to get emergency money in the Philippines. Calls posing as enforcement agencies are a sibling of this scam; see what to do about a fake immigration or embassy call.

What Yixing can do. Yixing is a private consultancy registered with the Philippine SEC (Registration No. CS202009551), accredited by the Bureau of Immigration (Accreditation No. CA-202624381-1, valid to 30 June 2027), and by DOLE and the Philippine Retirement Authority. It is not part of any government body. When relatives abroad receive word that someone is in trouble in the Philippines and cannot reach them, we can act as a local third party and help confirm the person's actual situation through ordinary channels. After an incident we can help assemble the document list for a report and accompany you to the police. See our settling-in support. We cannot recover money, cannot influence an investigation, and do not give legal advice. Consult a licensed lawyer about your own case; this article is not legal advice.