Deepfake Fraud

With voice cloning and generated video, attackers impersonate a CEO on a video call, a familiar voice on the phone, or a supplier, to trigger a wire transfer or some other action. Multi-million-dollar frauds have been documented. The defense is as much organizational as it is technical.

Scams that use a synthetic voice or face to impersonate an executive, a supplier, or a relative. See also: Content provenance · AI-boosted phishing · ElevenLabs.

01 — What we're talking about

Deepfake fraud, explained

With voice cloning and generated video, attackers impersonate a CEO on a video call, a familiar voice on the phone, or a supplier, to trigger a wire transfer or some other action. Multi-million-dollar frauds have been documented. The defense is as much organizational as it is technical.

02 — Why it is on the rise

What's driving the trend

• Voice- and video-cloning tools that are accessible and convincing.
• Highly targeted, high-payoff attacks (wire transfers, access, information).
• Instinctive trust in a familiar voice or face.

03 — What actually changes

The concrete effects

• "I recognize their voice" procedures are no longer reliable.
• Independent verification channels are needed for any sensitive request.
• Finance, HR, leadership and support teams should be trained first.

04 — Where to start

Getting started

• Set up an out-of-band double validation for any wire transfer or change of bank details.
• Define a verbal passphrase or a challenge question for urgent requests.
• Train on warning signs: urgency, secrecy, bypassing standard procedures.
• Limit the public exposure of executives' voices and faces when possible.

05 — Points to watch

What to keep in mind

• Detection technology still lags behind generation technology.
• Urgency and authority ("the CEO is asking") short-circuit vigilance.
• A successful incident can be repeated against the same targets.

06 — Frequently asked questions

Frequently Asked Questions

How do you spot a deepfake on a video call?

It's getting harder and harder. Don't rely on spotting it: require verification through an independent channel for any sensitive request.

What is the best protection?

Procedures: out-of-band double validation, a verbal passphrase, and refusing urgent, secretive requests.

Who should be trained first?

Finance, accounting, HR, executive assistants and support staff — the usual targets.

07 — Resources & links

Where to go, concretely