When a deepfake call costs €380,000, who proves what the AI said?

The fraud

Between June and August 2024, criminals used AI-generated voice calls to impersonate staff at ING and Rabobank and defraud Dutch customers of €380,000 ^[1]. The calls sounded real enough to convince people to hand over money or account details. By the time the banks caught on, the damage was done.

The method wasn't new, but the scale was. Voice cloning tools have been around for a few years, and they keep getting better. What makes this case interesting is the question nobody in the reports seems to ask: when a customer says they were told one thing and the bank's records say another, who has the evidence?

Think of it like this. If someone sends you a text message promising a refund, you keep the message. If they call you and say the same thing, you have nothing but your memory. Now imagine the caller is an AI, and the person running it can't show you a recording because they don't keep one. That's the problem.

What the AI Act says

Since 2 August 2026, Article 50 of the AI Act has required people to be told when they're interacting with an AI system, unless it's obvious from the circumstances ^[2]. The rule applies to AI that talks to people, whether by text, voice or video.

For the Dutch fraud, that date came too late. Even if it had applied, the criminals wouldn't have cared. The rule is aimed at legitimate deployers: banks, insurers, customer service teams and anyone else who uses AI to talk to customers. It says you have to tell people they're talking to a machine.

Article 50 also covers deepfakes. If you use AI to create or manipulate images, audio or video that look or sound like real people or events, you have to say so ^[3]. The idea is that people shouldn't be tricked into thinking something is real when it isn't.

The penalties for breaking Article 50 can go up to €15 million or 3 per cent of global annual turnover, whichever is higher ^[3]. For most organisations, that's enough to make disclosure a priority.

The missing record

Here's where it gets tricky. The law says you have to tell people they're talking to an AI. It doesn't say you have to keep a record of what the AI said.

In the Dutch case, the criminals used AI to impersonate bank staff. If a customer later disputes what they were told, the bank would want to show what its own systems said at the time, both to defend itself and to help investigators. But unless the bank recorded the conversation, or sealed a log of what the AI generated, it has nothing.

The customer might have a recording, if they thought to make one. They might remember the conversation. But memory isn't evidence, and a recording made by one side can always be questioned by the other. The same goes for screenshots of chatbot conversations: they're easy to make, easy to edit and hard to verify.

The gap is this: when AI talks to people, someone needs to prove what it said. The person it talked to can keep a record, but so can the person running the AI. Right now, most don't.

What banks need to show

The Dutch case puts two questions to banks and anyone else using AI in customer contact. First, can you detect when someone is using AI to impersonate you? Second, if your own AI talks to customers, can you show what it said?

On detection, the answer varies. Some voice systems can spot deepfakes, and the technology is improving. But it's a race: as detection gets better, so do the fakes. Banks are also starting to use additional checks, like asking customers to confirm requests through a separate channel.

On logging, the answer is often no. Many customer service systems log that a conversation happened, but not what was said. Chatbots might keep transcripts, but voice systems often don't. Even when they do, the logs are kept by the same people who run the system, and an opponent in a dispute can argue they've been edited.

Under DORA, which has applied to financial firms since January 2025, logs must be protected against tampering, deletion and unauthorised access ^[4]. That's a start, but it doesn't solve the proof problem on its own. Access controls stop unauthorised changes; they don't give you a way to show a supervisor or a court that nothing changed.

What a digital witness does here

This is a case where a digital witness fits well. The thing to seal is each AI-generated message or conversation as it happens: what was said, when and by which system.

Say a bank's AI calls a customer about a suspicious transaction. The system logs the call, including the script, the customer's responses and the outcome. At the same time, it sends a fingerprint of that log to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. The content stays with the bank.

Months later, the customer disputes what they were told. The bank shares the log, the witness ID and the verification link. The customer, or their lawyer, calculates the fingerprint again and checks it against the sealed one. If it matches, the log hasn't changed since the call. Change a single character and it won't match.

What the witness doesn't do is show that the log is complete, that the AI said the right thing, or that the bank handled the call properly. It shows that this is the record the bank made at the time, unchanged. That's often enough to settle the question of what was said, so the argument can move on to what should have been said.

The first 2,000 witnesses a month are free, so there's no reason not to start.

How it would work

1. Your customer service system generates a message or finishes a call.
2. A fingerprint of the log is sealed through the API, SDK or MCP server.
3. Months later, when the conversation is questioned, anyone you share the log with can check that it matches the sealed fingerprint.

What this means for you

If you run AI systems that talk to customers, ask these questions now:

• Do we log what our AI systems say, or just that a conversation happened?
• Can we show a customer, a supervisor or a court that the log hasn't been edited?
• If a customer turns up with a screenshot or a recording, do we have our own record to compare it with?
• When we tell people they're talking to an AI, is that notice itself logged and sealed?

For banks specifically, the Dutch fraud is a test case for disclosure and detection. If you're already logging conversations, sealing them as they happen is a small change that answers a big question.

What to watch

The Article 50 disclosure rules have applied since 2 August 2026 ^[2]. Supervisors haven't yet published detailed guidance on what counts as adequate disclosure for voice AI, so expect that in the coming months.

The AI Office is also working on technical standards for watermarking AI-generated content, due by 2 August 2027 ^[2]. Those standards will cover images, audio and video, and they'll set out how the machine-readable marking required under Article 50 should work in practice.

For voice deepfakes used in fraud, the question isn't just whether the victim was warned. It's whether anyone can prove what was said.