Enterprise Deepfake Defense Checklist

Deepfakes are synthetic audio, video, or images that impersonate real people: executives, vendors, colleagues, or job candidates. The most damaging attacks target business processes, such as an urgent payment request, a password reset through the help desk, or a remote hire. The FBI's Internet Crime Complaint Center has warned that criminals use generative AI, including cloned voices and video, to commit fraud.

This checklist is for security, finance, HR, IT service desk, and executive support teams. Because detection tools are imperfect and the fakes keep improving, the strongest defenses are process controls that work even when nobody spots the fake.

How to use this checklist

1. Work through it with finance, HR, the service desk, and communications, not security alone.
2. Implement process controls first, then technical controls.
3. Test the result with a tabletop exercise and repeat it annually.

Policy and process

• □ Define high-risk requests: payments, changes to supplier bank details, gift cards, credential or MFA resets, bulk data exports, and confidential deal information.
• □ Require out-of-band verification for every high-risk request. Call back on a number from a trusted directory, never one supplied in the message.
• □ Enforce dual authorization for payments above a threshold and for any bank detail change.
• □ Set up verification phrases or challenge questions between executives and the people who act on their requests.
• □ Give everyone explicit permission to pause. No one is penalized for delaying a request to verify it, even one that appears to come from the CEO.
• □ Document an escalation path for suspected deepfake contact.

Help desk and hiring

• □ Verify identity for password and MFA resets with methods a voice clone cannot pass, such as manager approval, a registered device, or in-person checks.
• □ Strengthen remote hiring: verify identity documents, hold live video interviews, and confirm the person who starts is the person you interviewed.

Technical controls

• □ Deploy phishing-resistant MFA (FIDO2 security keys or passkeys) so a deceived employee cannot hand over a working code.
• □ Use deepfake or liveness detection on high-risk channels where available, and treat the result as a signal, not proof.
• □ Adopt content provenance for official media. C2PA Content Credentials let partners verify where your images and video came from.
• □ Monitor for impersonation of executives and your brand on social media and lookalike domains.

Training and testing

• □ Show real examples of synthetic voice and video to finance, HR, executive assistants, and the service desk.
• □ Run a tabletop exercise simulating a cloned executive voice requesting an urgent transfer.

Response

• □ Contact your bank immediately to attempt a payment recall, and report to law enforcement (in the US, through IC3).
• □ Preserve evidence: recordings, call logs, messages, and meeting invitations.
• □ Notify the impersonated person and your communications team.

Common pitfalls

• Relying on people to spot visual or audio glitches. Quality improves faster than training can keep up.
• Verifying on the same channel the request arrived on.
• Executive exceptions. Senior leaders are the most impersonated, so the process must apply to them too.