Deepfake scams: voice and video fraud aimed at businesses

The new frontier of corporate fraud: deepfake scams

Deepfake scams represent a significant evolution in social engineering. By using sophisticated artificial intelligence, attackers can now mimic the voice and appearance of a trusted individual with startling accuracy. This technology has moved out of the laboratory and into the hands of cybercriminals who target small and mid-sized businesses. The goal is almost always the same: to trick an employee into authorizing a large financial transfer or releasing sensitive data.

In a typical deepfake scam, an employee might receive a video call that appears to be from their CEO. The 'CEO' may be in a noisy environment or claim to have a poor connection to hide any small digital artifacts, but the voice and face look real enough to bypass a person's natural suspicion. Because we are wired to trust what we see and hear, these attacks are often much more successful than simple phishing emails. As the technology becomes cheaper and easier to use, the frequency of these attacks is expected to rise.

Deepfakes are not just for entertainment or politics anymore. They are a tool for sophisticated financial theft. Attackers can use them to bypass identity verification systems, fool customer support representatives, or manipulate internal teams into breaking company policy. Understanding the mechanics of these scams is the first step in building a defense.

How voice cloning fuels deepfake scams

Voice cloning is one of the most common components of deepfake scams. An attacker only needs a few minutes of audio from a public source—such as a keynote speech, a podcast, or a YouTube video—to create a digital model of an executive's voice. Once the model is created, the attacker can type any text, and the AI will 'speak' it in the cloned voice, including the specific cadence and accent of the original speaker.

These voice deepfakes are often used in 'vishing' (voice phishing) attacks. A financial officer might receive a call from what sounds exactly like their boss, asking for an immediate payment to a 'new vendor' to close a deal. The familiarity of the voice creates a sense of trust that overrides standard security protocols. The attacker may also use these voices in voicemail messages, adding another layer of perceived legitimacy to a fraudulent email follow-up.

Video deepfakes in the boardroom

Video deepfakes are more complex but increasingly common. In some reported cases, attackers have joined multi-person video conferences, appearing as the CFO or another high-ranking official. They use AI-generated avatars that mimic the person's movements and expressions in real-time. Even if the video looks slightly 'off,' employees often attribute the glitches to poor internet quality rather than a deliberate attack.

Modern video deepfakes can handle head movements, blinking, and complex facial expressions. While there are still 'telltale signs' of AI generation, they are becoming harder to spot with the naked eye. This is why technical controls must be paired with human skepticism.

The role of social engineering in deepfake scams

AI is the tool, but social engineering is the engine that drives deepfake scams. Attackers don't just use a fake voice; they use the right tone, the right context, and the right timing. They may mention a real project the company is working on or refer to specific employees by name. This information is often gathered from LinkedIn, company websites, and previous data breaches.

• Psychological Pressure: The deepfake persona will often sound stressed or rushed, discouraging the victim from asking too many questions or following standard procedures.
• Authority Lures: The attacker impersonates someone high up in the organization to ensure the employee feels they must comply with the request immediately.
• Confidentiality: The victim is told the request is 'secret' or 'highly sensitive,' preventing them from discussing it with colleagues who might spot the fraud.
• Visual Cues: Using a background that looks like the executive's real office or a familiar hotel room to enhance the illusion.

Establishing verification protocols to stop AI fraud

To protect your business from deepfake scams, you must move beyond 'seeing is believing.' You need clear, non-digital verification protocols for any request involving money or sensitive credentials. These protocols should be followed every time, regardless of how high-ranking the requester appears to be.

1. Use a 'Call-Back' Policy: If you receive an urgent request via video or voice, hang up and call the person back on their known, official phone number stored in your directory.
2. Implement Multi-Person Approval: Never allow a single person to authorize a large wire transfer, especially based on a single communication channel like a video call.
3. Create a Shared Secret: For high-stakes operations, use a pre-arranged 'safe word' or phrase that is never shared digitally and is only known to key staff.
4. Watch for Digital Artifacts: Look for unnatural blinking, mismatched lip-syncing, or strange lighting and shadows in video calls that don't match the background.
5. Verify the Platform: Be suspicious if an executive suddenly asks to move a conversation to a personal app like WhatsApp or Telegram.

Building a culture of AI awareness

The best defense is an informed workforce. Employees should be aware that deepfake technology exists and that it can be used against them. Regular training sessions that include examples of deepfake audio and video can help staff recognize the subtle signs of fraud. Encourage a culture where it is okay to 'challenge' a request from an executive if it seems out of character or violates standard policy.

As AI continues to improve, these scams will become even harder to spot. By implementing thorough procedural controls today, you can protect your business from the sophisticated attacks of tomorrow. Security is not just about technology; it is about the processes that govern how your business operates.