Deepfakes, Corporate Fraud, and What Uruguayan Law Allows You to Do

A Risk That Has Already Reached the Region In January 2024, a finance employee at the multinational firm Arup transferred $25.6 million to scammers. He believed he was on a video call with his chief financial officer and colleagues; all were AI-generated deepfakes.

This case was not isolated: global figures show that scams surged by 700% in 2025, the average loss per incident exceeds USD 280,000, and over 55% of companies reported financial losses attributable to AI voice or video fraud in the past 12 months. Mid-sized companies are the preferred target: flatter hierarchical structures, fewer controls, and faster decision-making.

The outcome is not always grim. In July 2024, a Ferrari executive received a series of WhatsApp messages from an unknown number purporting to be from his CEO. The messages mentioned an ongoing confidential acquisition, urged him to sign a non-disclosure agreement immediately, and assured him that the regulator and the Italian stock exchange had already been informed. The messages were followed by a phone call featuring the CEO’s cloned voice, which accurately replicated even his southern Italian accent. However, the executive noticed subtle irregularities in intonation and, to verify the caller's identity, asked for the title of a book Vigna had recommended to him a few days prior. Unable to answer, the fraudster hung up. A simple question prevented a multi-million-dollar fraud: the exact inverse of the Arup case, and the best illustration that independent verification works.

How the Attack Works The most frequent scheme is known as CEO fraud: someone pretending to be the company's top executive instructs a subordinate (usually in finance or administration) to make an urgent and confidential transfer. In its traditional version, it was an email with a spoofed sender. In 2026, it is a phone call using a synthetic voice indistinguishable from the original, or a real-time avatar video call.

Attackers do not improvise. They pre-collect recordings of the executive from LinkedIn, conference appearances, podcast interviews, or corporate videos. That is enough to clone a voice using publicly available tools. The employee receives an instruction from someone whose voice they recognize, in a context of urgency that deters verification. The result is predictable. The Ferrari case itself illustrates the full pattern: an unusual channel, a secret transaction, and time pressure designed to prevent anyone from stopping to confirm.

Uruguayan Law: Existing Tools Today Cybercrime Law No. 20,327 incorporated computer fraud (Article 347 BIS) into the Penal Code, targeting both those who use artifices or deceit to induce error and obtain information, and those who manipulate computer systems to execute unauthorized transfers or payments to the detriment of another. The same law criminalized identity theft and unauthorized access to computer systems, enabling criminal prosecution of those responsible. Additionally, Personal Data Protection Law No. 18,331 imposes obligations on those who process biometric data (including voice patterns) without the consent of the data subject.

In terms of civil liability, Article 1319 of the Civil Code and consolidated tort law doctrine allow claims for financial damages when the unlawful act, damage, and causal link are established. The challenge lies not in the law, but in evidence, the speed of post-incident action, and proper identification of the perpetrator—who, in most cases, is outside Uruguayan territory.

Subsequent legal action against fraudsters (who often operate from foreign jurisdictions) faces evidentiary and jurisdictional obstacles that make immediate action imperative.

Prevention Measures at the Corporate Level Post-fraud litigation is possible and often successful. However, the cost—financial, reputational, and operational—of reaching that stage is always higher than that of prevention. From a legal standpoint, there are three concrete measures every company should implement:

• Out-of-band verification protocol. No payment instruction above a set threshold (established in writing) should be executed without independent verification via the original channel—such as a call back to the executive's known phone number. This is what saved Ferrari.

• Cyberfraud contractual clauses. Contracts with suppliers, clients, and financial institutions must explicitly define liability for fraudulent payment instructions, including notification timeframes and channels following an incident. A well-drafted contract can mean the difference between recovering funds and losing them permanently.

• Immediate incident documentation. If fraud occurs, the company must immediately preserve all digital evidence: call logs, metadata, emails, and screenshots. The chain of custody for this evidence will either support or ruin the legal case.

Closing: Law Does Not Wait, Nor Does It Improvise Corporate deepfakes are a present risk, with documented cases both regionally and globally, and Uruguayan law provides tools to confront them. The question is not whether your company could fall victim, but whether, when it happens, you will be prepared to act quickly, with sufficient evidence, and with legal counsel knowledgeable in both technology and applicable law.

Litigating these cases requires simultaneous mastery of computer crime law, civil liability, digital evidence, and international cooperation mechanisms. The difference between recovering damages and writing them off as a loss depends largely on the decisions made in the first few hours.