Deepfake

What it means

A deepfake is a fake image, video or audio created by artificial intelligence to look and sound like a real person. A few minutes of voice or video recording, often publicly available from interviews, presentations or social media, is enough. Quality is improving fast, and spotting a fake with the naked eye is getting harder.

For companies the most dangerous use is in CEO fraud, a form of business email compromise. The attacker calls an accountant in the director’s voice or joins a video call wearing the finance director’s fake face and demands an urgent, confidential payment, for example for a supposed acquisition.

A deepfake is a new tool for an old method: social engineering. It relies not on a technical flaw in a system but on trust, authority and time pressure. That is why antivirus does not help against it; rules and people’s habits do.

How it works in practice

The most effective defence is a rule that no payment and no change to a supplier’s bank account is made solely on the basis of a call, video or email, however credible it looks. It is verified by calling back on a known number, in person or through another pre-agreed channel. The rule applies to the director and management too.

Segregation of duties also helps: payments above a set amount need two approvers, and nobody can both change a supplier’s master data and send a payment alone. The attacker then has to fool two people at once, which is much harder.

In training we recommend showing staff real deepfake examples and practising how to react. The key is that nobody is afraid to double-check an instruction from a superior and that management welcomes such checks rather than punishing the delay.

What to watch out for

The biggest mistake is relying on being able to spot a deepfake. Fraudsters call at stressful times, on Friday afternoons or before holidays, and push for speed and secrecy. The warning sign is not the quality of the voice but the unusual request and the urgency.

Mind the insurance as well. Many cyber policies cover fraudulent payments only if the company followed its own control procedures, such as verifying payments by call-back. If it skipped them, the insurer may refuse to pay and the loss stays with the company.