Deepfake Fraud and Impersonation Laws (2027)

As of November 2026, using a fake voice, face or video to trick someone out of money can be charged as fraud whatever tool made it: the federal wire fraud statute, 18 U.S.C. 1343, carries up to 20 years (30 in some cases) and AI is not an element. No federal statute makes "AI fraud" a separate crime, but some states now name AI or digital forgery in the offense.

Status as of November 5, 2026: By our reading, at least seven states have a crime aimed at AI or forged-likeness impersonation: Arizona, Maryland, New Hampshire, New Jersey, Pennsylvania, Rhode Island and Washington. That is a floor, not a complete count. Maryland's took effect October 1, 2026. California's SB 1111 has been signed and, by the state's default rule, takes effect January 1, 2027. The federal AI fraud bills have not moved past referral to committee, and none is law.

This page covers deepfakes used for fraud, impersonation, blackmail and sextortion. Scam phone calls have their own page, are AI voice scam calls illegal. Sexual images are covered on AI-generated sexual images laws, and each state's full picture is on the deepfake laws by state hub.

Is It Illegal to Use a Deepfake to Scam or Impersonate Someone?

Using one to take money or property: yes, it can be charged under fraud law, and the tool does not matter. Using one to impersonate someone with no fraud, threat or other crime in view is less clear. The answer then depends on the state, the purpose and who was harmed.

The FBI drew this line in a December 2024 notice: "The creation or distribution of synthetic content is not inherently illegal; however, synthetic content can be used to facilitate crimes, such as fraud and extortion." That sentence is the FBI's description of the starting point. It does not mean every use is lawful.

Making a deepfake of an adult is not, by itself, a crime under the federal fraud and threat laws discussed here. Images of minors are different: 18 U.S.C. 1466A reaches producing an obscene image of a minor, and 18 U.S.C. 2252A(a)(7) reaches producing, with intent to distribute, child pornography that is an altered depiction of an identifiable minor.

Some states also reach the making itself. New Hampshire reaches someone who "knowingly creates" a deepfake for a listed harmful purpose, and New Jersey reaches someone who "generates or creates" deceptive media to further a crime. Other states reach the making of sexual deepfakes, which the hub covers state by state.

The FBI's notice describes two patterns this page keeps returning to: "short audio clips containing a loved one's voice to impersonate a close relative in a crisis situation," and "videos for real time video chats with alleged company executives."

Federal Deepfake Fraud Laws: Wire Fraud, Identity Theft, Extortion and Impersonation

No federal fraud statute below mentions AI. Each can be charged where its elements are met, however the deception was made. We are describing what the text reaches. We did not review a federal case testing these statutes against a deepfake.

Is a cloned voice a "means of identification"?

The definition in 18 U.S.C. 1028(d)(7)(B) includes "unique biometric data, such as fingerprint, voice print, retina or iris image." A scam that uses a person's real name can fit the identity statutes. Whether a synthetic imitation of a voice is a "voice print" is not settled by the text.

FCC rules on AI voices

The FCC's declaratory ruling, FCC 24-17, adopted February 2, 2024, confirmed that the Telephone Consumer Protection Act's limits on "artificial or prerecorded voice" calls "encompass current AI technologies that generate human voices." That is a consent rule: such calls need prior express consent, absent an emergency purpose or exemption, and telemarketing calls need prior express written consent. It is not a ban on voice cloning.

One enforcement record shows the limits. The FCC ordered a $6,000,000 forfeiture against Steve Kramer over AI Biden robocalls, on a Truth in Caller ID theory that it said is "not dependent on the content of the call," so this was not a fine for deepfaking as such. A New Hampshire jury then acquitted him of all state charges in June 2025, the Associated Press reported, and he told the AP he would not pay the fine. We did not find whether it has been collected. Carrier Lingo Telecom agreed to a $1,000,000 civil penalty in a consent decree. Our AI voice scam calls page covers call rules in full.

The FTC Impersonation Rule, 16 CFR Part 461

The FTC's rule took effect April 1, 2024. Section 461.2 bars materially and falsely posing as "a government entity or officer thereof," and section 461.3 does the same for "a business or officer thereof." The FTC says the rule allows civil penalties against violators.

The rule does not cover impersonating a private individual. In a notice published October 1, 2026, the FTC said of that provision that it "held an informal hearing in January 2025 and is still evaluating its options." In December 2024 it said it had "decided not to proceed with" its proposed means and instrumentalities provision "at this time." The new notice is limited to "ad-optimization practices by digital marketplace platforms," and comments close November 30, 2026.

The TAKE IT DOWN Act is not a fraud law

Federal law separately makes it a crime to knowingly publish certain intimate images of identifiable people, including AI forgeries indistinguishable from real images, when the elements of the TAKE IT DOWN Act, 47 U.S.C. 223(h), are met, and requires covered platforms to remove reported depictions within 48 hours of a valid request (47 U.S.C. 223a). It does not reach a scam that uses a fake voice or video for money unless the content is an intimate depiction. See our TAKE IT DOWN Act guide.

Federal AI Fraud Bills: H.R. 6306, S. 3495, S. 3982 (Not Law)

As of November 5, 2026, the only law we found from this Congress that makes publishing intimate deepfakes a crime is the TAKE IT DOWN Act. DEFIANCE passed the Senate but not the House, and NO FAKES has not had a floor vote in either chamber. The fraud bills below were each referred to committee with no further action, by the Congress.gov record read that day.

Our federal deepfake bills tracker follows each one.

State AI Fraud and Impersonation Crimes

By our reading of state statutes as of November 5, 2026, at least seven states have a crime aimed at AI or forged-likeness impersonation. We made one research pass across all 50 states and D.C., so another state may have one we missed. A state not listed can still reach a deepfake scam through its general fraud, theft and identity laws, which we did not survey here.

The verbs and intent matter, so read each row closely. None of these bans deepfakes as such.

Maryland SB 8: AI and deepfake identity fraud

Chapter 445 of 2026 added AI and deepfakes to Maryland's identity fraud statute, in force since October 1, 2026. A person may not "knowingly, willfully, and with fraudulent intent" use artificial intelligence or a deepfake representation to cause harm to another "by impersonating, falsely depicting, or claiming to represent that person or any other person."

The same paragraph bars using either to create or distribute false records with intent to cause harm, to induce someone to provide personal identifying information, or to obtain a benefit, credit, good, service or other thing of value. "Harm" means physical injury, serious emotional distress or economic damages.

The definition has limits. A "deepfake representation" must be "indistinguishable from an actual and identifiable human being," and drawings, cartoons, sculptures and paintings are excluded. The sentence may be consecutive to or concurrent with the sentence for another crime. A victim may bring a civil action, and a court may issue an injunction. See Maryland deepfake laws.

Rhode Island: digital forgery, P.L. 2026 ch. 412 and 413

Rhode Island's 2026 act, which took effect on passage (the public law is headed enacted June 23, 2026), added two items to the identity fraud chapter. One is knowingly impersonating "an entity or person, living or dead, with intent to defraud or injure." The other is knowingly engaging in digital forgery, meaning participating in "the generation, creation, or distribution of a forged digital likeness of a person or entity as genuine to facilitate fraud," while knowing or having reason to know it is forged.

A "forged digital likeness" covers an image or a voice recording of an actual, identifiable individual. It must closely resemble the genuine thing, be likely to deceive a reasonable person, be created and distributed without the depicted individual's consent, and not otherwise be protected by law. Constitutionally protected activity and technology providers and developers are excepted.

Penalties rise with each conviction: up to 3 years and $5,000 for the first, 3 to 5 years and up to $10,000 for the second, and 5 to 10 years and a fine of at least $15,000 after that (R.I.G.L. 11-49.1-4). We found no civil action in that chapter. See Rhode Island deepfake laws.

Pennsylvania: digital forgery, 18 Pa.C.S. 4101.1

Act 35 of 2025 reaches a person who, "with intent to defraud or injure anyone," or with knowledge and intent of facilitating a fraud or injury, "generates or creates and distributes a forged digital likeness as genuine" and knows or reasonably should know it is forged. Creating alone is not enough: the words are "creates and distributes."

A "forged digital likeness" is a computer-generated image of an actual, identifiable individual, or an audio recording of that person's voice, that meets all four of these elements:

1. It was created, adapted or modified to closely resemble a genuine image or audio record of the individual.
2. It materially misrepresents the person's appearance, speech or behavior so that the fundamental character is changed.
3. It is likely to deceive a reasonable person.
4. It was created and distributed without the individual's consent.

The base offense is a first-degree misdemeanor. It becomes a third-degree felony when done "through involvement in a scheme to defraud, coerce or commit theft of monetary assets or property." Technology providers and developers are exempt, and a defendant has an affirmative defense for taking reasonable action to put viewers or listeners on notice that the likeness was not genuine. The section has no civil action. See Pennsylvania deepfake laws.

New Jersey: a deepfake used to further another crime

N.J.S.A. 2C:21-17.8 is a predicate-crime statute. It is a third-degree crime to generate or create a work of deceptive audio or visual media "for the purpose of attempting or furthering the commission of any crime or offense," or knowing another will use it that way. Soliciting, disclosing or using one for that purpose is also third degree. Knowingly or recklessly disclosing a work created in violation of the statute is fourth degree, up to 18 months.

Without a criminal purpose, these subsections do not apply. The listed examples include chapters 20 and 21 of Title 2C, which cover theft and forgery offenses, so a cloned voice used to defraud fits the list. The definition reaches a sound recording that "appears to a reasonable person to realistically depict" speech that never happened.

The conviction does not merge with the underlying offense, and "the court shall impose consecutive sentences." A victim, meaning someone injured or who lost property through the conduct, may sue for actual damages but not less than $1,000 for each knowing or reckless violation, and a conviction is not required. The law excepts content a reasonable viewer or listener would understand as criticism, comment, satire, parody or news reporting. See New Jersey deepfake laws.

New Hampshire: harm to the person depicted

RSA 638:26-a makes it a class B felony to knowingly create, distribute or present a deepfake of an identifiable individual "for the purpose of embarrassing, harassing, entrapping, defaming, extorting, or otherwise causing any financial or reputational harm to the identifiable person." A deepfake leading to that person's arrest is a separate class B felony. The maximum is 7 years under RSA 651:2.

The listed purpose points at the person depicted. A clone that fools a grandparent into paying harms the grandparent, so it fits less cleanly than a fake used to extort the person shown. RSA 507:8-j gives the person depicted a civil action for damages, but only against someone who knowingly uses their likeness to create a deepfake for one of the same listed purposes. Its words do not reach someone who only distributes or presents one. See New Hampshire deepfake laws.

Arizona: criminal impersonation with computer-generated media

A.R.S. 13-2006(A)(4) covers "Using a computer-generated voice recording, image or video of another person with the intent to defraud other persons." For this paragraph, defraud means "to make a false representation or material omission to deceive another person to gain a benefit." The statute does not use the word AI.

Comedy, parody, artistic expression, criticism, and circumstances "where it is clear to a reasonable listener or viewer that the recording, image or video has been digitally manipulated" are not fraudulent. This paragraph is a class 5 felony, while the older forms of criminal impersonation are class 6.

Separately, A.R.S. 16-1023 lets a candidate or "any citizen of this state" sue over a "digital impersonation" of themselves. The default remedy there is declaratory relief only. See Arizona deepfake laws.

Washington: distributing a forged digital likeness

RCW 9A.60.045(1)(b) makes it criminal impersonation in the second degree to knowingly distribute a forged digital likeness of another person "as a genuine visual representation or audio recording with intent to defraud, harass, threaten, or intimidate another or for any other unlawful purpose," knowing or having reason to know it is not genuine. A 2026 act moved this prong from (1)(c) to (1)(b).

A forged digital likeness must be indistinguishable from a genuine one, misrepresent the person's appearance, speech or conduct, and be likely to deceive a reasonable person. The statute carves out matters of public interest, including art, commentary, satire and parody, and shields platforms and carriers from liability solely for content provided by another person. Our Washington forged digital likeness explainer covers a separate state law. See Washington deepfake laws.

Texas: financial abuse through artificially generated media

Texas Penal Code 32.56, in the version added by SB 2373 effective September 1, 2025, makes it an offense to knowingly engage in financial abuse through "artificially generated media" disseminated to another person. Penalties run by property value from a Class B misdemeanor to a first-degree felony. The same act adds a civil claim and an Attorney General civil penalty. Texas has more than one Section 32.56, so look for the SB 2373 version. It targets financial abuse rather than impersonation, so it is not in our count of seven. See Texas deepfake laws.

States That Reach Impersonation Without a New AI Crime

These laws are often listed with the seven above. They work differently.

California SB 1111 and Penal Code 540. Stats. 2026, ch. 862, approved September 30, 2026, adds Penal Code 540: for any provision where false impersonation is a required element, "including, without limitation, Sections 528.5, 529, and 530, false impersonation includes the use of a digital replica with the intent to impersonate another." It defines an element of existing crimes. It is not a new crime. The bill is not an urgency statute, so by the state's default rule it takes effect January 1, 2027. See California deepfake laws.

Utah. Utah Code 76-2-107 says an actor may be found guilty of an offense if the actor commits it "with the aid of a generative artificial intelligence," or intentionally prompts or causes one to commit it. It is a liability rule, not a fraud crime, and carries no penalty of its own. Section 76-12-304 separately makes it a class B misdemeanor to knowingly or intentionally cause publication of an advertisement that uses a person's identity to imply endorsement without consent. Utah's civil Abuse of Personal Identity Act defines personal identity, in the version in force since May 6, 2026 and in the prior 2025 version, to include "any simulation, reproduction, or artificial recreation" of a picture, likeness or voice. See Utah deepfake laws.

Virginia HB 2124 and SB 1053. HB 2124 (ch. 398) was approved March 24, 2025, and the state's bill summary calls it identical to SB 1053. As passed, the state's summary says, the bill "makes it a Class 1 misdemeanor for any person to use any synthetic digital content for the purpose of committing any criminal offense involving fraud." It was signed in 2025, but conditioned on reenactment by the 2026 session, and it does not appear in the Code: no section 18.2-213.3 displays in the Code of Virginia as of November 5, 2026, and we found no 2026 act reenacting it. Our search covered the Code and the bill's summary, not every 2026 bill. The Attorney General's January 2026 work group report calls the offense "newly enacted," but that report does not change what the Code shows. See Virginia deepfake laws.

Oklahoma. HB 3244, effective November 1, 2026, names "artificial intelligence (AI) technology" among the means of committing identity theft in 21 O.S. 1533.1(D). It does not create a separate impersonation crime, so it is not in our count.

Nebraska. Nebraska aims at platforms, not scammers. See the 2027 section below.

Older online impersonation laws

Several states have older, technology-neutral impersonation laws. None of the following mentions synthetic media. By the state's default rule, California's SB 1111 reads a digital replica into Section 528.5 from January 1, 2027. For the others we found no official source applying them to deepfakes, so whether each reaches one depends on its words and the facts.

• California, Penal Code 528.5: knowingly and without consent credibly impersonating another actual person online or by other electronic means to harm, intimidate, threaten or defraud. Up to one year in county jail, a fine up to $1,000, or both.
• Texas, Penal Code 33.07: using another person's name or persona, without consent and with intent to harm, defraud, intimidate or threaten, to create a web page or post messages. Third-degree felony, 2 to 10 years. See Texas deepfake laws.
• Louisiana, R.S. 14:73.10: intentionally impersonating an actual person online with intent to harm, intimidate, threaten or defraud. $250 to $1,000, 10 days to 6 months, or both.
• Rhode Island, R.I.G.L. 11-52-7.1: using another person's name or persona on a commercial social networking site, or in an email, text or similar message, with intent to harm, defraud, intimidate or threaten.
• Oklahoma, 12 O.S. 1450: a civil claim, not a crime, for using another's name, voice, signature, photograph or likeness through social media to create a false identity, for the purpose of harming, intimidating, threatening or defrauding that person.

Deepfake Sextortion and Blackmail Laws

Threatening to release a fake sexual image unless someone pays can be charged under several laws. Some statutes now name fake images. Others were written with real images in mind, and the fit depends on their words. The FBI reported in June 2023 "an uptick in sextortion victims reporting the use of fake images or videos."

Federal law

The most direct federal law is the TAKE IT DOWN Act's threat provision, 47 U.S.C. 223(h)(6). It covers intentionally threatening to commit an offense under the Act "for the purpose of intimidation, coercion, extortion, or to create mental distress." For a digital forgery, the maximum is 18 months where the person shown is an adult and 30 months for a minor. A forgery must be an intimate depiction that a reasonable person, viewing it as a whole, would find "indistinguishable from an authentic visual depiction of the individual."

Two general statutes can also be charged. 18 U.S.C. 875(d) covers an interstate threat to injure reputation with intent to extort, up to 2 years. A demand for payment backed by a threat to release a fabricated video fits those plain words, but we found no case testing it on a fabricated image. 18 U.S.C. 2261A(2) covers a course of harassing conduct online.

When the target is a minor

Federal law reaches AI-made sexual images of children, but the rule depends on the image. Altering a real, identifiable child's image into sexual conduct falls under the federal child pornography statutes, with no defense that no real child was used. Separately, 18 U.S.C. 1466A covers obscene images of a minor even if no real child exists. In August 2026 a federal appeals court held the possession part of Section 1466A unconstitutional as applied to one man's possession at home of obscene images the government agreed showed no real child; his production and distribution charges remain.

Never copy, screenshot or forward such an image, including as evidence. Note where you saw it and report it (see below). Details are on our AI-generated sexual images laws page.

State sextortion and blackmail statutes

These are examples from our state research, not a survey. Where a statute's definition names computer-generated or AI-altered images, the table says so. Maximums shown are for the tier described.

Wisconsin also gives a civil action for conduct prohibited by that section, including punitive damages and attorney fees, in Wis. Stat. 895.439. West Virginia's civil chapter on intimate images names sextortion victims since a 2026 amendment, though whether it reaches fabricated images is not settled by the text.

Deepfake Business Fraud: Arup, FinCEN and the IC3 Numbers

Corporate deepfake fraud can be charged under the same statutes. We found no separate federal law on it.

One example comes from the company itself. Engineering firm Arup said in its 2024 financial statement that "in January 2024 one of these attempts was successful, with criminals using fake voice, signatures and images." Arup's own statement gives no amount or place.

In November 2024 the Treasury's Financial Crimes Enforcement Network issued alert FIN-2024-Alert004, saying it "has observed an increase in suspicious activity reporting by financial institutions describing the suspected use of deepfake media in fraud schemes." The alert is addressed to financial institutions. It is not a law on the public.

The FBI's 2025 IC3 report counted 22,364 complaints that referenced AI, with $893,346,472 in reported losses, out of 1,008,597 complaints and $20.877 billion overall. These are self-reported complaints containing a reference to AI, not proven AI crimes. For family-emergency scams using cloned voices, the report says "Victims claimed losses over $5 million in 2025."

What Changes in Deepfake Fraud and Impersonation Law in 2027

These are the dated events we found. Each is a date on the calendar, not a prediction.

• January 1, 2027, California. SB 1111 takes effect by the state's default rule for a non-urgency statute: false impersonation under the Penal Code will include use of a digital replica with intent to impersonate another. That date is our reading; the chaptered text does not state one.
• January 1, 2027, Nebraska. Neb. Rev. Stat. 87-302(a)(26), from LB838, becomes operative. A social media platform that accepts payment for ads must have "Identity verification for advertisers," "An unlawful impersonation detection and mitigation program" and "Automated and manual fraud detection systems," and must investigate a reported fraudulent ad within five business days, then remove it within five business days of finding it fraudulent. This is a deceptive trade practice rule for platforms, not scammers. Under Neb. Rev. Stat. 87-303.08, a violation of the Uniform Deceptive Trade Practices Act is a Class II misdemeanor "except as otherwise provided in the act."
• January 3, 2027, Congress. A bill that is not enacted before the 119th Congress ends on January 3, 2027 does not carry over. It would have to be introduced again in the next Congress. That covers H.R. 6306, S. 3495, S. 3982 and the other bills above. Congress could still act before then.
• July 1, 2027, Kansas. The Attorney General's first report under HB 2537, the state's sexual extortion act, is due, and then annually.

As of November 5, 2026, we found no other deepfake fraud or impersonation law scheduled to take effect in 2027. We searched legislature and code sources state by state for the 2025 and 2026 sessions, a partial sweep in some states, and congress.gov records for federal bills. New sessions open in January, so this list can change. The FTC's comment period on its platform notice closes November 30, 2026, and we found no date for action on impersonating individuals.

What to Do If a Deepfake Was Used Against You

If you sent or lost money. Contact your bank or payment service right away. If a scammer uses a stolen login or code to move money, federal rules generally treat that as unauthorized, and your liability is limited if you report quickly: under Regulation E, generally up to $50 with notice within two business days of learning of the loss or theft of your card, code or login, and up to $500 after that. Report any unauthorized transfer within 60 days after your statement is sent, because after that you can be liable for later transfers a timely report would have stopped, and the $500 limit does not cap that amount.

The rule does not clearly cover a payment you sent yourself, even if you were deceived. It also excludes transfers through Fedwire or a similar wire system used primarily between financial institutions or businesses (12 CFR 1005.3(c)(3)), so a bank wire may fall outside it. We did not research other wire rules or card chargebacks for this page; our guide to getting money back after a scam goes through each payment method.

Report it. File with the FBI's Internet Crime Complaint Center, the FTC at ReportFraud.ftc.gov, and your state attorney general or local police. Keep messages, recordings, numbers, account names and payment records, unless the material may show a minor.

If someone threatens to release a fake sexual image. Report the threats to police and the IC3, and keep them unless they contain an image that may show a minor. If the image has been published, a covered platform must remove it within 48 hours of a valid request, which must be written and signed, identify the image, and state a good-faith belief that it is not consensual. Adults can use StopNCII.org, whose FAQ says that if a deepfake "is of you, you have access to the image and it is nude/semi nude, then you can hash it." It works only on participating platforms.

If the image may show someone under 18. Do not copy, screenshot or forward it. Report it to the NCMEC CyberTipline, at 1-800-843-5678, or to the police. NCMEC's Take It Down service works on participating platforms for images taken of you when you were under 18. Its FAQ warns, "Do not download or share any nude, partially nude or sexually explicit image or video in order to submit."

If someone faked your likeness to scam others. A civil claim depends on the state and on whom the scheme harmed. New Jersey's civil action belongs to a victim, defined as someone injured or who lost property through the conduct, and that can include a person who was deceived. Maryland also gives a victim a civil action. New Hampshire's and Oklahoma's claims turn on harm aimed at the person depicted or impersonated, so they fit a scam aimed only at others poorly. Right-of-publicity claims are covered on AI voice cloning laws and right of publicity laws by state.

There is no private lawsuit in the federal fraud, extortion or stalking statutes above, and we found none in the TAKE IT DOWN Act. For advice on your situation, contact your state bar's lawyer referral service or a legal aid office.

Disclaimer: This page is general legal information about federal law and selected state statutes. It is not a survey of every state and is not legal advice.

Frequently Asked Questions

Is it illegal to impersonate someone with AI?

It depends on the purpose. Using AI to impersonate someone to trick a person out of money can be charged as fraud. Impersonating a government agency or business can violate the FTC Impersonation Rule, and pretending to be a federal officer and acting as one, or demanding or obtaining a thing of value, can violate 18 U.S.C. 912. Impersonating a private individual with no fraud, threat or harm is not covered by those federal laws. By our reading as of November 5, 2026, at least seven states have crimes aimed at AI or forged-likeness impersonation, each requiring a particular intent.

Is deepfake fraud a federal crime?

There is no federal crime called deepfake fraud. As of November 5, 2026, a deepfake scheme can be charged under general laws such as wire fraud, 18 U.S.C. 1343, which carries up to 20 years (30 in some cases). Bills aimed at AI fraud, including H.R. 6306, S. 3495 and S. 3982, have been referred to committee and are not law.

Is it illegal to make a deepfake of someone?

For a deepfake of an adult, not by itself under the federal fraud and threat laws discussed here. Images of minors are different: federal law reaches producing an obscene image of a minor (18 U.S.C. 1466A) and producing, with intent to distribute, child pornography that is an altered depiction of an identifiable minor (18 U.S.C. 2252A(a)(7)). The FBI says creating or distributing synthetic content is not inherently illegal. Some states go further. New Hampshire reaches knowingly creating a deepfake for a listed harmful purpose, New Jersey reaches generating deceptive media to further a crime, and other states reach making sexual deepfakes.

Is deepfake blackmail illegal?

Yes, a threat to release a fake image to get money can be charged. Federal extortion law, 18 U.S.C. 875(d), covers an interstate threat to injure reputation with intent to extort, up to 2 years, though we found no case testing it on a fabricated image. Kansas amended its blackmail statute in 2026 to name nude or sexual images altered by artificial intelligence.

Is deepfake sextortion a crime?

It can be. The TAKE IT DOWN Act makes it a crime to intentionally threaten to publish an intimate digital forgery of an identifiable person for the purpose of intimidation, coercion, extortion or to create mental distress, with up to 18 months for an adult victim and 30 months for a minor. Kansas, Utah, Vermont, West Virginia, South Carolina and Texas have statutes whose text reaches or reads as reaching fake images. Wisconsin's sexual extortion statute does not say.

What states have deepfake fraud laws?

By our reading of state statutes as of November 5, 2026, at least seven: Arizona, Maryland, New Hampshire, New Jersey, Pennsylvania, Rhode Island and Washington. This is a floor from one research pass. California's SB 1111 adds digital replicas to false impersonation from January 1, 2027 by the state's default rule, and Utah has a liability rule for crimes committed with generative AI.

Does the FTC Impersonation Rule cover a deepfake of a private person?

No. The rule, effective April 1, 2024, covers impersonating government and businesses and their officers. In a notice published October 1, 2026, the FTC said it is still evaluating its options on impersonation of individuals.

Will my bank refund money I lost to a deepfake scam?

It depends how the money moved. If a scammer uses a stolen login or code to move money, federal rules generally treat that as unauthorized, and your liability is limited if you report quickly. The rule does not clearly cover a payment you sent yourself, even if you were deceived. Report an unauthorized transfer within 60 days after a statement is sent to avoid liability for later transfers. The rule also excludes Fedwire and similar wire systems used primarily between financial institutions or businesses.

Is California's SB 1111 law?

Yes, it was chaptered as Stats. 2026, ch. 862, approved September 30, 2026. By the state's default rule it takes effect January 1, 2027. It says false impersonation in the Penal Code includes using a digital replica with the intent to impersonate another. It defines an element of existing crimes and is not a new crime.

Is Virginia's deepfake fraud law in force?

It does not appear to be. HB 2124 was signed in 2025 but conditioned on reenactment by the 2026 session, and the section it would have added does not appear in the Code of Virginia as of November 5, 2026.

Can I sue someone who used a deepfake of me to scam other people?

In some states, depending on whom the scheme harmed. New Jersey and Maryland give victims a civil action. New Hampshire and Oklahoma tie their claims to harm aimed at the person depicted or impersonated. Finding and collecting from a scammer is often the practical obstacle.