Editor’s Note: Deepfakes have moved from novelty to operational threat, and a standing-room session at the Dublin Tech Summit on Thursday made the stakes plain: the forensic test that has governed digital evidence for 30 years no longer settles the question. HaystackID’s John Wilson and Jeff Shapiro walked a packed room through the 2024 Arup fraud (about $25.6 million gone after a video call with AI-generated executives) and argued that proving integrity is no longer enough. Examiners now have to prove authenticity.

For cybersecurity, data privacy, compliance and eDiscovery professionals, the timing is hard to ignore. The EU AI Act’s Article 50 transparency rules land Aug. 2, 2026; NIS2, DORA and the U.K.’s failure-to-prevent-fraud offense already carry extraterritorial reach; and the proposed U.S. Federal Rule of Evidence 707 would put AI-generated evidence under Daubert-style scrutiny.

Watch the next 90 days. Teams that audit AI content against emerging evidence standards, map their chain of custody against the five-framework matrix, and rehearse a deepfake incident now will be the ones able to answer the only question that matters when the evidence itself is suspect: can you prove what was real?


Content Assessment: When you can’t trust the evidence: deepfakes force a forensic reckoning in Dublin

Information - 94%
Insight - 95%
Relevance - 93%
Objectivity - 93%
Authority - 94%

94%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "When you can’t trust the evidence: deepfakes force a forensic reckoning in Dublin."


Industry News – Artificial Intelligence Beat

When you can’t trust the evidence: deepfakes force a forensic reckoning in Dublin

ComplexDiscovery Staff

A finance worker joined a routine video call with his chief financial officer and several colleagues. Every face on the screen was a forgery. By the time he called head office to check, the equivalent of about $25.6 million had left the company.

The unsettling part, two HaystackID executives told a packed room at the Dublin Tech Summit on Thursday, was not that the video had been faked. It was that the recording of the call was, in a forensic sense, genuine, and that the question forensics has asked for 30 years no longer fits the evidence in front of it.

John Wilson, chief information security officer and president of forensics at HaystackID, and Jeff Shapiro, the firm’s managing director for Europe, took the Workshop Stage at the RDS from 11:15 to 11:40 a.m. for a talk billed as “When You Can’t Trust the Evidence: Deepfakes, AI Fraud, and the Collapse of Digital Trust.” Both work for HaystackID, which was demonstrating privacy and investigation tools at booth C7, and both leaned on a single, well-documented fraud to make a technical case rather than a sales one.



When the recording is real but the meeting never happened

The case was the 2024 theft from the Hong Kong office of Arup, the British engineering firm behind the Sydney Opera House. A finance employee received what looked like a phishing email from the company’s U.K.-based CFO seeking a confidential transaction, doubted it, then joined a video call to confirm. The CFO and other familiar executives were on the call. He authorized 15 transfers worth about $25.6 million, or roughly 200 million Hong Kong dollars, before learning that none of the people he had seen were real, according to reporting by CNN and others.

Wilson’s account pushed past the headline. The attackers, he said, had spent months inside Arup’s network learning how its executives discussed and approved transactions, then staged the call live, with AI generating the faces and voices in real time. His point was a careful one: because the synthetic media was generated during the call rather than edited in afterward, the recording could be authentic as a record of what happened on the platform, even though the people appearing in it were synthetic. “However, how do you prove what else wasn’t real that same day?” Wilson said.

What unsettled the room was the speed. The reconnaissance behind Arup took months in 2024. Wilson estimated that similar reconnaissance can now be compressed to about two weeks, and that an interactive deepfake avatar able to hold a conversation can be built in about 24 hours. He was clear this was an expert estimate, not a measured figure.



Two glasses of water and the wrong question

Wilson’s framing device was two identical glasses of water, one clean and one carrying something colorless and odorless. The instinct is to ask which glass is contaminated. Wrong question, he said. “The real question is, how do I prove that the clean one is safe?”

For three decades, he argued, digital forensics answered a question of integrity: the file is what it claims to be, the hash matches, the method is repeatable and survives a Daubert challenge. Synthetic media breaks that. Integrity is table stakes; examiners now have to establish authenticity: proof that the artifact is real, not generated or altered. Even an everyday act, like pushing a phone video into a messaging app, applies compression and AI filters that change the file on their own. The practical takeaway for any investigations team: assume the content needs an authenticity test, not only an integrity check.

Hashes still matter, Wilson said, but they have to sit inside an immutable chain that can be validated from the moment of creation forward. “These hashes are cryptographic fingerprints,” Shapiro added, cutting off the obvious joke. Wilson extended the point to the training data behind any AI system offered as evidence, a provenance problem he said almost no one is preparing for.



Five frameworks, one chain of custody

Shapiro turned the forensic problem into a compliance clock. The EU AI Act’s Article 50 transparency obligations take effect Aug. 2, 2026, about two months out. Providers of generative systems will have to mark AI output in a machine-readable format; deployers will have to disclose when content is a deepfake (or, as Shapiro preferred to call it, synthetic media). Penalties run to 15 million euros or 3 percent of global annual turnover, a tier he compared to GDPR.

The reach is what European startups tend to miss. Article 50, NIS2 and DORA all carry extraterritorial effect, as does the U.K.’s “failure to prevent fraud” offense under the Economic Crime and Corporate Transparency Act, which took effect Sept. 1, 2025. Serve customers in those jurisdictions, Shapiro said, and the rules reach you wherever the company sits.

His shorthand for the matrix: NIS2 covers cybersecurity and requires a 24-hour early warning when an incident hits; DORA covers financial services and the technology providers that feed them; the fraud offense asks whether an organization took reasonable steps to stop fraud by the people associated with it. Stack Article 50 and the proposed U.S. Federal Rule of Evidence 707 on top (the latter would hold AI-generated evidence to the same reliability test as expert testimony and is now expected to take effect no earlier than December 2027), and five regimes end up reading the same chain of custody five different ways.

Shapiro offered one trap worth keeping in mind. A company builds an innocent chatbot to answer questions about an e-book. If that book carries special-category data (on sexual orientation or political affiliation, say), the deployer can become a GDPR controller of sensitive data the instant a user starts asking. The lesson he drew: map the downstream data effects of an AI feature before shipping it, not after.



A 90-day plan and five questions

The session closed on a checklist. Over the next quarter, Shapiro said, organizations should do three things: audit their AI-generated content against the Rule 707 forensic standard, inventory their chain-of-custody methods against the five-framework matrix to find exposures, and run a deepfake tabletop exercise with people who understand how the attacks are actually built.

Wilson added the five questions a team should be able to answer in the first 48 hours of an incident: Is the media authentic? Were any identities compromised? What data was accessed? What is the regulatory exposure? And can the timeline be proved from the start, with provenance intact? Most companies, he said, can answer one, maybe two.



Compliance as a growth story

Shapiro’s last turn reframed the whole pitch. Treated as cost centers, these frameworks read as a tax on building. Built in by design, he argued, they become a selling point: walk into a bank for funding able to show DORA-grade operational resilience already wired into the business, and the capital comes easier.

The line both men kept returning to was the one HaystackID has been sharing as part of its European launch: pairing AI-driven investigation with disciplined information governance lets organizations move faster and defend the result when the evidence can’t be taken at face value. That leaves every security and legal leader who filled the room with a single, uncomfortable question. If a convincing forgery can be built in a day, and the recording of the fraud is itself genuine, how will your organization prove what was real?

News sources



Assisted by GAI and LLM Technologies

Additional Reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).

ComplexDiscovery also provides a ChatGPT-powered AI article assistant for its users. This feature leverages LLM capabilities to generate relevant and valuable insights related to specific page and post content published on ComplexDiscovery.com. By offering this AI-driven service, ComplexDiscovery OÜ aims to create a more interactive and engaging experience for its users, while highlighting the importance of responsible and ethical use of GAI and LLM technologies.