When a fake bank call costs you money, who keeps the receipt?

The scam

Someone calls your phone. The voice message sounds exactly like your bank, telling you there's a problem with your account and asking you to call a number. You call. The person on the other end sounds professional, asks for your details and walks you through 'fixing' the issue. Days later, money is gone.

That happened in the Netherlands in early 2026. Fraudsters used AI to generate voice messages impersonating well-known banks, directing victims to call numbers staffed by scammers posing as bank employees ^[1]. The voice clones were convincing enough that people handed over login credentials and authorised transfers.

The incident shows two things. First, AI-generated audio can sound real enough to fool someone who is already on alert for scams. Second, when a victim says 'the bank told me to do it', the bank needs to be able to show what it actually said.

What Article 50 says

Since 2 August 2026, the AI Act's transparency rules have applied ^[2]. Article 50.1 says providers must design AI systems so that people are informed when they are interacting with an AI, unless it is obvious from the context ^[2]. That includes voice calls and messages.

Article 50.2 says AI-generated content must carry a machine-readable marking ^[2]. For audio, that means a technical mark in the file itself, readable by software but not necessarily noticeable to the listener. Think of it less as a 'contains nuts' sticker and more as a barcode: machines read it, people barely notice it.

Article 50.4 adds a deployer duty: anyone using AI to create or manipulate audio that constitutes a deepfake must disclose that the content is artificially generated or manipulated ^[3]. A deepfake, under the regulation, is content that appears to be a real person, object or event but isn't, and would falsely be perceived as authentic ^[3].

The marking in Article 50.2 is the provider's job. The disclosure in Article 50.4 is the deployer's, which in a scam means the criminal. Enforcement against criminals is a separate matter, but the rules give legitimate organisations a baseline: you tell people it's AI, you mark it and you keep a record.

The gap

Marks can be stripped. A recording can be re-encoded, compressed or edited in ways that remove the machine-readable watermark. That is a known problem, and the Commission is working on standards for robust marking ^[2]. Until those arrive, a mark is better than nothing but not guaranteed to survive the journey.

The real gap is this: when a victim says they got a call from the bank, and the bank says it didn't make that call, who has the receipt?

In the Dutch case, the fraudsters left no authenticated trail. The victims had their memory of the call and perhaps a phone log showing an incoming number. The banks had their outbound call records, which showed no such calls. The scam worked because the criminals created something that sounded real, and the victims had no way to check.

For a bank, the question becomes: if you send an AI-generated message, can you later prove it was yours, that it said what you say it said, and that it went out on the day in question? A call log shows a number was dialled. It doesn't show what was said, or prove the audio file hasn't been edited since.

What this means for you

If your organisation uses AI to communicate with customers, here are three questions worth asking now:

1. When you send an AI-generated voice message, email or chat response, do you keep a sealed copy of what was sent, so you can show it unchanged if someone questions it?
2. Are your AI-generated audio files machine-readably marked, and does the marking survive compression and re-encoding?
3. If a customer claims you told them something you didn't, can you show what you actually sent, and when?

The first is about having your own evidence. The second is compliance with Article 50.2. The third is the everyday version of both.

Sealing what you send

Here, the thing to seal is each outbound AI-generated communication as it is sent: the audio file, the message text or the email, along with a timestamp and the recipient reference.

Sealing takes a fingerprint of the content, not the content itself, so the message never leaves your systems. The fingerprint is posted to WitniumChain, which records it on a chain where any later change would show, even one made by us. You get a witness ID back.

Months later, if someone questions what you sent, you calculate the fingerprint again from the file you kept and compare it with the sealed one. If it matches, the file is exactly what was sent that day. Change a single character and it won't match.

Anyone you share the record with can check it the same way. You send them the file and the witness ID; they check the fingerprint themselves. No need to trust your word, or ours.

What it doesn't do: it doesn't prove the content was lawful, that the message was actually delivered or that the recipient understood it. It shows that the file you kept is the one you sealed, unchanged.

You can seal communications through the REST API, the SDK or the MCP server. The content stays with you, the fingerprint goes to the chain and the first 2,000 witnesses a month are free. Read the docs or get access now.

How it would work

1. Your system generates an AI voice message for a customer and sends it.
2. Before or as it is sent, you seal a fingerprint of the audio file and a record of the recipient and time.
3. If the customer later claims the message said something it didn't, you calculate the fingerprint again from the file you kept and show that it matches the sealed one, proving the file hasn't changed.

What to watch

The Commission is developing technical standards for machine-readable marking under Article 50.2, expected in 2027 ^[2]. Those standards will say what a robust mark looks like and how it should survive editing and compression.

For now, the transparency duty applies: people must be told they are talking to an AI, and AI-generated audio must be marked in a way machines can read. Keep an eye on the standards as they arrive, and decide early how you will show what your AI actually said.

The Dutch incident is a reminder that criminals move faster than regulations. The tools that make a legitimate voice assistant possible also make scams easier. The defence is the same as it has always been: keep a record, seal it and be ready to show it.