AI-Driven Fraud and Deepfake Scams: The Next Frontier of Financial Crime in the KSA

7 min 27 sec October 15, 2026 (Edited)

Written by

Ahmed Amonette

Senior Associate

a.amonette@tamimi.com

Fraud is, at its core, a crime against trust. In financial markets, that trust depends on genuine payment instructions, reliable electronic records, and systems that verify identity and authority. Saudi law already recognises those trust points: electronic records and signatures are given legal effect under the Electronic Transactions Law, and digital evidence is recognised under the Law of Evidence.

AI tests that trust. Deepfake audio, synthetic video, and AI-generated messages can make false identities and payment instructions appear credible. The objective remains familiar — deception and the unlawful taking of money — but AI allows fraudsters to scale deception and manufacture apparent authority.

For individuals, businesses, and financial institutions in the Kingdom of Saudi Arabia, this is a contentious and criminal litigation issue as much as a technology risk. The immediate challenges are how quickly a victim can identify the offence, preserve prosecution-ready evidence, engage the authorities, support an investigation, and protect any privacy rights arising from the fraud.

This article considers how Saudi financial fraud, cybercrime, electronic transactions, evidence, and criminal procedure laws apply when AI-enabled fraud moves from risk management into criminal complaint and prosecution.

AI-driven fraud: Familiar crimes, more convincing tools

AI-driven fraud should be understood as the use of artificial intelligence to commit, accelerate or conceal established fraud typologies. The most relevant examples include executive impersonation, voice cloning, synthetic identity creation, AI-generated phishing, manipulated payment instructions, forged digital authorisations, and false use of trusted institutional names.

Deepfakes matter because they attack the evidentiary assumptions on which victims may rely. A voice message may appear to come from a senior officer, a video call may appear to show a known counterparty, and a digital document may appear to bear a valid signature. The litigation risk lies in proving authenticity and attribution.

Public enforcement in Saudi Arabia shows a continuing pattern of action against digital deception, impersonation, and online fraud.

• In February 2026, a Saudi individual was reportedly sentenced to five years’ imprisonment for fraudulent online sales activity targeting 41 victims.
• In May 2026, authorities reported separate arrests relating to fraudulent Hajj-service promotions on social media. These included a case in Qassim involving fake and misleading advertisements, and a case in Makkah involving fraudulent promotions and possession of forged Hajj cards.
• Earlier enforcement involving fake links impersonating a government agency further illustrates the same pattern.

These examples did not involve prosecution for the use of deepfakes, but they do reflect the mechanics that AI can make more convincing: false authority, digital impersonation, and financial harm.

The Saudi Data & AI Authority’s May 2025 Deepfakes Guidelines add a further regulatory signal by recognising the risks of synthetic media and malicious deepfake use. They reinforce that deepfake-enabled deception is now part of the Kingdom’s broader enforcement and governance landscape, even where criminal liability will generally be pursued through existing fraud, cybercrime, electronic transactions, and evidence frameworks.

Criminal liability and enforcement risk

When assessing criminal liability for AI-driven fraud, the starting point is the Anti-Financial Fraud and Breach of Trust Law. Its core fraud offence captures the unlawful taking of another’s money through fraudulent methods, including lying, deception, or illusion. AI-generated emails, deepfake calls, fabricated documents, and synthetic identities are new tools, but they remain directed at a familiar criminal objective: obtaining money or value through deception.

The Anti-Cyber Crime Law is equally significant where the fraud involves impersonation, unlawful access, or digital interference. Key provisions address the use of fraud, false names, or impersonation to obtain property or signatures, as well as unauthorised access to bank, credit, or securities data to obtain information, funds, or services.

The Electronic Transactions Law adds a further enforcement route where fraud involves forged digital authorisations. It addresses fraudulent use of digital certificates or electronic signatures, forged electronic records, and unauthorised access to another person’s electronic signature system. In practice, this can be relevant where AI-generated documents or communications are used to support false approvals or payment instructions.

Taken together, these laws can expose perpetrators to criminal prosecution, asset confiscation, and trial proceedings where fraud involves impersonation, unlawful access, forged electronic records, or manipulation of payment instructions.

For victims, the importance of the legal framework is not only the available penalties, but the ability to frame the conduct as a criminal matter capable of investigation and prosecution. The criminal framing matters because it can move the matter beyond loss reporting and into a process directed at accountability, confiscation of proceeds, and deterrence.

A fraud complaint that properly identifies deception, impersonation, and financial harm may assist the authorities in treating the conduct as prosecutable criminality rather than as a private commercial dispute. That distinction can be important where victims seek not only recovery, but also confiscation of criminal tools or proceeds and a formal enforcement response.

Evidence and complaint strategy

An early complaint strategy can shape the course of the investigation. In AI-enabled fraud matters, a complaint should do more than narrate events. It should present the suspected offence clearly, identify the harm, preserve the private-right position, and point investigators to the digital and financial evidence that may support attribution.

Under Saudi criminal procedure, complaints may trigger evidence collection, investigation and referral to the Public Prosecution. For individual complainants, businesses and financial institutions, this makes the initial presentation of the matter important. Unclear facts, incomplete records, or unsupported allegations can slow the investigation, while a focused complaint may assist the authorities in identifying suspects, tracing funds, and assessing the relevant offences.

The private-right dimension should also be considered early. A criminal complaint may sit alongside the victim’s private rights, and those rights should not be lost or weakened through poor framing, delay, or incomplete evidence preservation.

There is an important difference between reporting a fraud and presenting a complaint in a manner that advances the investigation. A report may alert the authorities to the incident, but a well-framed complaint helps to organise the facts, identify the suspected offences, preserve the private-right position, and connect the available evidence to attribution and loss. That is where criminal litigation input can add value: not by overcomplicating the narrative, but by ensuring that the first submission supports both investigation and eventual trial readiness.

Contested digital evidence

AI-driven fraud cases are likely to turn on authenticity and attribution. The key question is whether the victim can prove the source, integrity, timing, and manipulation of digital materials such as messages, recordings, payment instructions, electronic signatures, platform identifiers, device logs, bank transfer records, and digital payment extracts.

The Law of Evidence is helpful because it expressly recognises digital evidence, including digital records, digital documents, digital signatures, communications, and digital media. The key point is practical: digital material should be preserved in a form that allows its integrity and origin to be assessed if the matter becomes contested.

The Electronic Transactions Law and its Implementing Regulations also matter at the evidence stage because they address the reliability of electronic records and signatures. In deepfake and AI-generated document cases, the legal dispute may focus less on whether a communication exists and more on whether it is authentic, attributable, and unaltered.

Where forgery is alleged, the dispute may become a technical and procedural battle requiring careful handling. That is where forensic support, preservation of original records, and trial-ready presentation become critical.

Practical response considerations

When funds have been moved due to fraud, speed is often critical. A criminal complaint may support investigative steps aimed at identifying unknown perpetrators, preserving evidence, and tracing funds, but the window for effective action may be short.

Individuals and institutions affected by AI-enabled fraud may also need to coordinate with banks, payment providers, or other financial-sector stakeholders where the fraud involves accounts, transfers, customer data, or institutional impersonation. The point is not simply regulatory reporting, but ensuring that the contentious response is aligned with the evidence, flow of funds, and authority engagement strategy.

Individuals, businesses, and financial institutions will often have different immediate priorities. An individual victim may need urgent guidance on reporting, preserving messages, and avoiding further transfers. A business may need to secure internal approvals, protect systems, and manage counterparties. A financial institution may need to coordinate quickly around accounts, transfers, and customer data. In each case, the response should be tailored, but the litigation objective is consistent: preserve proof, protect rights, and keep options open.

The practical response should therefore be disciplined and litigation-focused: preserve the evidence, build a complaint-ready file, escalate promptly, and use forensic support where authenticity or attribution is likely to be contested.

Conclusion

AI-driven fraud is not simply a technology risk. It is a criminal litigation risk that can result in police reports, Public Prosecution investigation, technical examination, asset-related inquiries, contested digital evidence, trial proceedings, penalties, asset confiscation, and private-right claims.

Saudi law provides a strong framework for addressing this risk, but the outcome of any matter will often turn on early decisions: how the complaint is framed, how evidence is preserved, how quickly funds are traced, and how effectively the matter is positioned for investigation and trial.