In early 2024, a finance worker in the Hong Kong office of engineering firm Arup transferred HK$200 million (about US$25 million) to fraudsters after a video call with what appeared to be the company's CFO and several colleagues. Everyone else on the call was a deepfake. The worker had initially suspected a phishing email, but put those doubts aside because the people on the call looked and sounded like colleagues he recognized.
Key Takeaway
A face and a voice are no longer proof of identity; high-risk requests need verification through a channel an attacker can't fake.
I've watched deepfake defense evolve from novelty to necessity. The attacks aren't coming from Hollywood—they're coming from credential-stuffing scripts and social engineering kits.
The incident made headlines, but it was just an early example. By 2026, deepfake attacks on enterprises have moved beyond novelty. They're a standard social engineering vector, and many organizations are still unprepared.
What are enterprise deepfake attacks?
Enterprise deepfake attacks use AI-generated audio, video, or both to impersonate executives, colleagues, or vendors and trick employees into transferring money, revealing credentials, or taking actions that compromise security.
The attack surface is broader than most security teams assume. Deepfakes can target:
Finance and procurement teams. Impersonate a CFO or vendor to authorize urgent wire transfers. The Arup case is the template.
HR departments. Impersonate an executive to request employee data changes — bank account updates, emergency contact modifications, or PII access.
Engineering teams. Impersonate a CTO or senior architect to request code repository access, cloud credential rotation, or emergency infrastructure changes.
Customer support. Impersonate a customer using synthetic video to bypass identity verification and access account data.
Why are deepfakes so effective?
Because they exploit the most human weakness: trust in visual and auditory evidence. For decades, seeing someone's face and hearing their voice was sufficient verification. Deepfakes break that assumption.
The technology has improved dramatically. Early deepfake videos had visible artifacts — unnatural blinking, inconsistent lighting, audio glitches. Today's real-time tools can produce convincing video and cloned voices from small amounts of publicly available footage and audio, and the barrier to entry has dropped from "nation-state actor" to anyone with commodity tools.
U.S. agencies have been warning about this for years. Joint NSA, FBI, and CISA guidance, Contextualizing Deepfake Threats to Organizations, flags the impersonation of leaders and financial officers as one of the most substantial synthetic media threats. Since April 2025, the FBI has also warned of campaigns that use text messages and AI-generated voice messages to impersonate senior U.S. officials. The combination of AI-generated content and traditional phishing tactics creates attacks that are nearly indistinguishable from legitimate requests.
What are the defense layers?
Verification protocols for financial transactions. Any wire transfer above a threshold should require out-of-band verification: a phone call to a known number, a Slack message to the executive's actual account, not a video call. In the Arup case, a face on a screen was enough to override an employee's initial suspicion.
Watermarking and provenance. For internal communications, adopt systems that cryptographically sign video calls and document sharing. Open standards such as C2PA Content Credentials attach signed provenance data to media. If a recording or file lacks a valid provenance signature, treat it as suspicious.
Deepfake detection tools. Several vendors now offer real-time deepfake detection for video calls and audio. These tools analyze micro-expressions, voice consistency, and background artifacts that human observers miss.
Employee training that addresses the new threat. Traditional security awareness training covers phishing emails. Deepfake awareness training needs to cover video call verification, voice authentication limits, and the reality that "seeing is no longer believing." It works best as part of a broader security behavior and culture program, not a once-a-year slide deck.
Deepfake attack vectors comparison
| Attack Vector | Detection Difficulty | Primary Target | Effective Defense |
|---|---|---|---|
| Video call impersonation | High | Finance, leadership | Out-of-band verification |
| Voice clone phishing | Medium | HR, IT help desk | Callback to known number |
| Synthetic video for identity bypass | Medium | Customer support | Liveness detection, multi-factor |
| Deepfake CEO fraud (email + voice) | High | Executives, board | Mandatory dual approval |
The table shows a pattern: the most convincing deepfakes target the people with the most authority and the least suspicion. Your CFO doesn't expect to be defrauded by their own face.
How do you build a deepfake defense program?
Start with the highest-value targets. Map which roles can authorize financial transactions, access sensitive data, or make infrastructure changes. Those are your deepfake targets.
Establish verification protocols for each role. The protocol should require something the attacker can't fake: a physical object, a shared secret, or a communication channel they can't intercept. A video call isn't verification. A callback to a pre-established number is — the same never-trust, always-verify logic behind zero trust, applied to human requests.
Deploy detection tools where they matter most: video conferencing platforms, phone systems, and identity verification workflows. The tools are improving quickly. The gap is often that organizations haven't turned them on.
FAQ
How common are deepfake attacks in 2026?
Common enough that the FBI has publicly warned about AI-generated voice messages impersonating senior U.S. officials. Deepfakes are now a standard vector for high-value fraud, not just a novelty.
Can I detect a deepfake in real time?
Yes. Detection tools analyze micro-expressions, voice consistency, and background artifacts. They're not perfect, but they raise the cost of the attack significantly.
What's the best defense against deepfake fraud?
Out-of-band verification. Never authorize a financial transaction based solely on a video call or voice message. Always verify through a separate, trusted channel.
Are deepfakes illegal?
In most jurisdictions, using deepfakes for fraud is illegal. But attribution is hard: the attackers in the Arup case hid behind synthetic faces and voices.
Should I tell employees about deepfake risks?
Yes. Awareness is a critical control. Employees who understand the threat are less likely to comply with suspicious video requests.