When the Investor on the Screen Isn’t Real

Artificial intelligence has created a new problem for startups raising money: How do you know the person investing in your company is actually the person they claim to be?

That question used to have a relatively straightforward answer. It doesn’t anymore.

In January 2024, criminals used AI-generated images, voices and other deception to convince an employee of engineering firm Arup to authorize transfers totaling approximately $25 million. The employee believed he was participating in a video conference with the company’s chief financial officer and other colleagues. The people he saw and heard were deepfakes.

The lesson for startups isn’t simply to be more careful about wire transfers. It’s that one of the basic assumptions underlying business transactions is becoming unreliable: the belief that seeing and hearing someone is a meaningful way to establish their identity.

That matters when a startup is raising capital.

The Accredited Investor Problem

Under SEC Rule 506(c), a company can publicly solicit investors for a private securities offering, provided it meets the exemption’s requirements. Among other things, every purchaser must be an accredited investor, and the company must take reasonable steps to verify that status.

The SEC’s guidance on accredited-investor verification explains that verification depends on the circumstances. Available financial information, the nature of the investor and the terms of the offering can all matter.

In March 2025, the SEC’s Division of Corporation Finance issued a no-action letter concerning Rule 506(c) offerings. Under the circumstances described in the letter, specified written representations combined with minimum investments of at least $200,000 for an individual or $1 million for an entity could support an issuer’s conclusion that it had taken reasonable steps to verify accredited status, subject to the letter’s conditions.

The relief can make fundraising easier for legitimate startups. A company raising a few million dollars doesn’t necessarily want to collect tax returns, brokerage statements and other sensitive financial information from every investor.

But there is a technology problem hiding underneath the legal one.

What happens when the investor isn’t who they claim to be?

The Deepfake Has Entered the Deal Room

Imagine a startup conducting a Rule 506(c) offering.

A prospective investor appears on Zoom, provides the required representations and commits an amount sufficient to meet the SEC letter’s investment threshold. The money arrives from what appears to be the investor’s account.

The founder has spoken to the investor. The lawyer has reviewed the documents. Everyone believes the necessary boxes have been checked.

Except the person on the screen is an AI-generated impersonation. The voice has been cloned. The identification documents may be fabricated. The entity sending the money may not be what the startup believes it is.

This isn’t a hypothetical technology risk. In November 2024, the Financial Crimes Enforcement Network (FinCEN) warned financial institutions that criminals were using generative AI to create deepfake media and fraudulent identity documents to defeat identity verification and authentication systems.

The warning matters to startups because the bank processing an investment has its own legal obligations. An issuer’s conclusion that it has satisfied the SEC’s accredited-investor verification requirement does not eliminate a financial institution’s separate obligations concerning suspicious transactions and identity fraud.

A transaction can therefore pass one regulatory checkpoint while raising questions at another.

Verification Is No Longer Just About Money

There is nothing wrong with requiring startups to verify their investors. The problem is that verifying financial eligibility and verifying identity are two different tasks.

A person may genuinely have sufficient wealth to qualify as an accredited investor, yet be impersonated by someone else. Conversely, a convincing digital identity may be attached to fabricated financial information.

A signed representation establishes that a representation was made. It doesn’t necessarily establish that the person signing it is who they claim to be.

Even authentic financial documents may not resolve the problem. If someone has obtained another person’s account information or is impersonating an authorized representative of an entity, verifying the documents alone may not establish who is actually participating in the transaction.

AI makes these distinctions harder to ignore. A convincing face, voice or video can now be generated without the cooperation of the person being impersonated.

What Should a Startup Do?

The answer isn’t to turn every seed financing into an FBI investigation. It’s to recognize that AI has changed the risk calculation.

For a substantial investment, a startup and its counsel should consider whether the identity-verification process is appropriate to the transaction. Depending on the circumstances, that may include independently confirming contact information, verifying the investor through an established relationship or trusted professional, confirming the authority of an entity’s signatory and examining whether the source of funds raises concerns.

Technology can help, too. Identity-verification systems that incorporate liveness detection may provide an additional layer of protection, although no single tool should be treated as foolproof.

The company’s documents deserve attention as well. Representations and warranties concerning identity, authority, source of funds and fraud should be reviewed with AI-enabled impersonation in mind. Closing procedures should specify who is responsible for verification and what happens if information later proves fraudulent.

The appropriate measures will depend on the offering, the investor and the risk involved. A startup should not assume that the SEC’s no-action letter eliminates the need to investigate warning signs or that a minimum investment amount establishes an investor’s identity.

And founders and their advisers should stop treating a successful video call as proof that the person on the other side of the screen is real.

It proves that a video call happened.

That’s all.

The Bigger AI Lesson

AI is often discussed as a tool for generating contracts, writing code and creating marketing materials. Its more consequential effect may be less visible: AI is changing the reliability of evidence.

A photograph can be fake. A voice can be fake. A video can be fake. An identity document can be fake. A person on a video call can be an impersonation convincing enough to fool experienced professionals.

The legal system and the business community must adapt their assumptions about what constitutes reliable evidence in a commercial transaction.

For startups, that adaptation cannot wait for regulators to rewrite every rule. Founders, lawyers and investors need to consider how identity is established, what evidence supports that conclusion and whether the process is appropriate to the transaction.

When you’re deciding whether to accept someone’s money, how do you know there is actually a someone on the other side of the deal?

That is becoming an AI governance question as much as a securities-law question.

If your startup is raising capital or revising its AI-related risk controls, contact me to discuss the legal and contractual issues before they become business problems.