Aipedia: Charities and trustees

Deepfake and AI impersonation fraud on charities

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Charities face AI impersonation fraud, such as a cloned chief executive's voice demanding an urgent payment, and trustees must protect the charity's assets with sensible controls. Insurance can help, but crime, cyber and D&O each respond to a different part of the loss.

Part of: AI in Charities and trustees

In short

Fraudsters use AI to clone voices, fake video calls and write convincing phishing emails and invoices. Charity finance teams, often small and reliant on trust, are attractive targets. CC3 s.7 requires trustees to manage resources responsibly, and the Charity Commission's AI blog flags deepfakes as a reputational risk. Trustees acting honestly are rarely personally liable, but CC3 says there is no legal protection for negligence. The lost money is usually a crime insurance question; the breach and response costs are often cyber; and a claim that trustees failed to put controls in place may engage D&O or trustee indemnity, subject to the terms.

How AI is used against charities

Payment fraud is not new, but AI makes it cheaper and more convincing. Common attack types include:

a phone call or voice note in the cloned voice of the chief executive or chair asking for an urgent transfer;
a video call where a senior person's face and voice are faked;
supplier emails, written by AI in the right tone, asking to change bank details;
phishing aimed at finance staff or trustees to capture banking or email log-ins;
fake appeals that copy a charity's branding and imagery to divert donations.

Charities can be especially exposed: finance roles are often part-time, trustees are volunteers, and a culture of trust makes challenging a senior colleague feel awkward.

The duties that apply

CC3 s.7, manage resources responsibly, which includes protecting the charity's assets.
CC3 s.9.3: trustees remain collectively responsible for delegated work, including the finance team's payment processes.
CC3 s.10: liability for honest mistakes is "extremely rare" for unpaid trustees, but there is "no legal protection for trustees who have acted dishonestly, negligently or recklessly". In an incorporated charity the charity itself will usually be liable for a third-party claim.
The Commission's AI blog flags reputational risk from fake news and deepfakes.
CC49 says trustees may become personally liable if they unreasonably fail to insure or insure inadequately.
The Fundraising Regulator's AI guidance warns bad actors may misuse a charity's content and suggests content credentials where proportionate.

What can go wrong

Illustrative scenario: late on a Friday, a charity's finance officer receives a voice message that sounds exactly like the chief executive, saying a property deposit must be paid before the weekend and asking for discretion. An email follows from a lookalike address with the bank details. The officer pays. By Monday the money has moved on. The board asks whether the charity had a call-back rule for new payees, and finds it was never written down.

Afterwards the charity may face lost funds, investigation costs, questions from funders and the Commission, and press interest. See CEO fraud and deepfake payment scams for how these attacks typically unfold.

How crime, cyber and D&O respond

Crime insurance is usually the policy for money the charity was tricked into paying. Many wordings treat social engineering or payment diversion as a separate section with its own lower limit and conditions, such as a call-back check.
Cyber insurance commonly covers incident response, forensic costs and data breach handling if systems or email accounts were compromised, and some include limited cyber crime cover. See cyber insurance and AI risks.
Charity D&O or trustee indemnity may respond if the charity, a co-trustee or another party claims the trustees breached their duty by failing to put reasonable controls in place, subject to the terms. It does not usually reimburse the stolen money itself.

Gaps commonly arise where a crime policy requires a verification step that was not followed, or where no policy includes social engineering cover at all.

Practical controls

Require a call-back to a known number before any new payee or bank detail change is paid.
Use dual authorisation for payments above a set amount.
Agree a code word or second channel for urgent requests from senior staff.
Train finance staff and trustees to treat urgency and secrecy as warning signs.
Write the payment controls down and have the board approve them.

How Apex helps

Apex arranges D&O and trustee indemnity for charities, and a broker can review how crime and cyber cover sit alongside them, including any social engineering conditions. See the AI in charities hub.

Sources

Frequently asked

Are trustees personally liable if the charity is defrauded?

Rarely. CC3 says liability for honest mistakes is extremely rare for unpaid trustees, but there is no protection for negligence or recklessness. Having written, board-approved payment controls is the best evidence that trustees acted with reasonable care.

Which policy pays back money lost to a deepfake call?

Usually crime insurance, often under a social engineering section with its own limit and conditions. Cyber may cover response costs if systems were compromised. D&O does not usually reimburse stolen money.

Can fraudsters misuse our fundraising content?

Yes. The Fundraising Regulator's AI guidance warns that bad actors may misuse a charity's content and suggests content credentials where proportionate. Monitoring for fake appeals and telling supporters how to give safely also help.

Do small charities need crime cover?

There is no legal requirement, but CC49 warns trustees may become personally liable if they unreasonably fail to insure or insure inadequately. Trustees should weigh the charity's exposure to payment fraud, including AI impersonation, when deciding what cover is in its best interests.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.