Parimatch Owner Loses Money on a Fake AI Startup: Duped by a Deepfake of an Acquaintance

Stories about deepfakes in business are usually told as cautionary tales about other companies. Now the owner of the betting company Parimatch, Sergey Portnov, has found himself in such a situation. He was tricked into investing in an AI startup that did not actually exist. It was not the startup itself that convinced him, but a deepfake of a person he trusted.

What is known

Details are scarce. Portnov spoke about it in a LinkedIn post and did not name the amount, writing only that he lost "very expensive." Who exactly was impersonated and how the communication unfolded is not in the public record. So the technique of the attack cannot be analyzed here, but his conclusion deserves attention.

According to Portnov, fraud has long gone beyond calls from "bank employees." Now a friend or relative may get in touch: a familiar voice, knowledge of personal details, yet in reality it is not them. "Even a video call is no longer proof," he writes. His recipe: before transferring money, call the person back on a number you already had. Five minutes of "paranoia," in his words, will cost far less than his losses.

This is not the first case

Such stories have been piling up since 2024, and they show different sides of the same problem.

That same year, a finance department employee at the engineering company Arup in Hong Kong joined a video conference with the chief financial officer and colleagues. All the participants turned out to be deepfakes. The employee made fifteen payments totaling 200 million Hong Kong dollars, about $25.6 million. The call looked like an ordinary work meeting, yet every participant was a fake.

Another example is entirely harmless but telling. An X user with the handle facelessboy00 said he helped a friend pass an interview at a tech company. He is an experienced developer himself, so he joined the call and demonstrated the skills while swapping his face in real time for his friend's. On the second attempt this produced an offer of $4K. If face swapping works in an interview, it will work in a conversation about money too.

What to do in practice

The main idea of all three stories: do not count on spotting a fake by the picture. Quality is rising, while people's attentiveness in work routine is limited. What needs protecting is the process, not the employee's eyes.

For developers and technical leaders:

• Do not treat video and voice as an authentication factor. If your product has "confirm identity by call" scenarios, rethink them.
• When hiring remote specialists, add checks outside the main video call: documents, references, a repeat meeting via an independent channel.

For product managers and founders:

• For transfers and investments, introduce a second-channel rule. Confirm any request for money that arrives via call or messenger through a previously known contact.
• Large sums need dual approval, so that one convinced person cannot push a payment through alone. In the Arup case there were fifteen payments, and they could have been stopped at any step.
• Agree on a code word with loved ones and your team for urgent financial requests. It is cheap and works as long as the fake does not know your secret.
• Check "hot" investment offers separately. AI is currently attracting money, so scammers happily use it as bait.

Limitations

The whole story is based on the victim's personal post; there are no independent confirmations or technical details in the material. We do not know which tools the attackers used, whether it was a video call or only a voice, or exactly how the startup looked to the investor. So it is too early to draw specific conclusions about the technology.

But the practical takeaway does not depend on these details. If even the owner of a large business made a mistake, the issue is not the victim's naivety but outdated habits. Verification through an independent channel takes minutes, while a mistake can cost millions. For any company where someone has the authority to transfer money, such a rule should be written into the regulations right now.