One in eleven German internet users surveyed said they had been deceived by AI-generated or altered media in the past year. The findings offer a national snapshot, not an EMEA-wide measure, but point to challenges familiar to organisations across the region: attacks that exploit trust, and victims unsure where to turn.

A call appears to come from a daughter in danger. A video seems to show a senior executive making an urgent request. A familiar voice asks for money, credentials or immediate action. As generative AI makes convincing audio and video easier to produce, the central risk is not only whether a deepfake can fool its audience. It is whether people have time and a trusted way to verify what they are seeing or hearing.

In Germany, 9 per cent of internet users surveyed said they had been deceived in the previous 12 months by a realistic photo, video or voice recording created or altered with artificial intelligence. One year earlier, 3 per cent reported such an experience. The results come from a representative survey commissioned by the German digital association Bitkom and conducted by Bitkom Research ahead of the it-sa cybersecurity trade fair in Nuremberg.

The wider figures show that deepfakes sit within a much larger pattern of online crime. Sixty-four per cent of German internet users surveyed reported at least one experience of cybercrime in the past year, up from 61 per cent in the previous survey. The data should be read as a picture of Germany alone; they do not establish prevalence across Europe, the Middle East or Africa. For EMEA security teams, however, they offer a useful national case study in how familiar attack methods are being joined by more convincing forms of impersonation.

“Cybercriminals use every technical option available to them. Artificial intelligence makes fraud easier and more credible,” said Susanne Dehmel, a member of Bitkom’s executive management. A familiar voice or realistic video can initially override suspicion, she said. Her advice is straightforward: verify shocking or unusual calls and urgent payment requests through a second channel before acting.

Familiar attacks remain more common

Despite the rise in reported deepfake deception, traditional methods affected more people. Malware, including viruses, was the most frequently reported attack: 32 per cent of German respondents said their computer or smartphone had been infected. Online shopping fraud affected 29 per cent, while 21 per cent reported phishing by email, text message or telephone. Both figures were lower than a year earlier.

Credential theft also featured prominently. Fourteen per cent said login details for online services such as social networks or shopping sites had been stolen. Nine per cent reported that someone had impersonated them online, and 6 per cent said bank or credit-card details had been stolen and misused.

That combination matters for organisations because the impact of an attack can extend beyond the initial point of compromise. As Dehmel noted, access to an email account can provide a route to other accounts, fraudulent purchases or messages sent to the victim’s contacts. The survey does not measure how these incidents spread, but the results underscore why strong, unique passwords and multi-factor authentication remain important alongside newer options such as passkeys.

Other reported methods included deceptive QR codes, which had led 5 per cent of respondents to fraudulent websites. Four per cent reported fraud when selling goods online; 3 per cent had experienced ransomware, and 1 per cent reported unauthorised use of their online banking access. The survey also recorded personal harms: 6 per cent said they had been sexually harassed online and 4 per cent threatened.

Losses are tangible; routes to help are not

For many victims, the consequences were financial. Among those who had experienced cybercrime, 58 per cent said they had suffered a personal financial loss. In a further 5 per cent of cases, a retailer, bank or insurer had covered the loss. The average reported damage was €233.

After an incident, victims most often took individual action: 45 per cent changed a password or other security information, and 17 per cent deleted or closed the affected account. Forty-two per cent spoke to friends or family. Thirty-six per cent contacted the company whose platform had been used, while 13 per cent approached a public authority, including Germany’s Federal Office for Information Security (BSI). Eight per cent sought legal advice.

Only 19 per cent of those affected said they had filed a police report, down from 26 per cent in the previous survey. Eighteen per cent said they had taken no action. The figures reveal a gap between the scale of reported victimisation and formal reporting—though the survey does not establish why people chose not to report.

Among those who did file a report, experiences were often unsatisfactory. Twenty-two per cent said proceedings had been discontinued; 27 per cent felt their report had achieved nothing. A further 22 per cent said the case was still ongoing, and 15 per cent had received no response at the time of the survey. Nineteen per cent said they had received useful information or support, while 13 per cent felt their case had been taken seriously. Six per cent had recovered money or data, and 2 per cent said the case had been solved.

The reporting figures matter beyond individual cases. As Dehmel argued, unreported offences are absent from the overall picture, while offenders who are not pursued may continue. For security teams, this points to an operational challenge as well as a public-sector one: organisations need clear, accessible routes for customers and employees to report suspected impersonation, payment fraud and account compromise, and processes that preserve evidence and direct victims to appropriate support.

The survey suggests that many people lack even a basic point of contact. In Germany, 54 per cent of internet users surveyed said they did not know whom to approach after a cyberattack. Eighty-seven per cent wanted a stronger police presence in digital spaces, and 86 per cent supported tougher penalties for cybercrime.

For EMEA readers, the German results should not be treated as a regional prevalence estimate. They do, however, make a useful distinction: deepfakes are gaining ground, while malware, phishing and online fraud remain the more frequently reported threats. Effective defences therefore need to address both sides of the problem—technical safeguards that limit account compromise, and verification habits and response channels that help people challenge convincing but unexpected requests.

Data note: All statistics in this article refer to Germany. They are from a representative telephone survey conducted by Bitkom Research on behalf of Bitkom. Between calendar weeks 33 and 37 of 2026, researchers surveyed 1,126 people aged 16 and over, including 1,031 internet users. Comparison figures are from a survey of 1,115 people aged 16 and over, including 1,021 internet users, conducted between calendar week 49 of 2024 and calendar week 2 of 2025.