How should companies defend against deepfake fraud?

Companies defend against deepfake fraud by making sure that no payment, credential reset or data release depends on how convincing a voice or face seems: unusual requests are confirmed through a separately sourced contact, high-value transfers need more than one approver, and staff are trained to expect synthetic media. That approach reflects warnings from the FBI and from FinCEN, which on November 13, 2024 alerted financial institutions to fraud schemes built on deepfake media made with generative AI.

The FBI says AI-generated content is now often difficult to identify, which is why the controls that work are procedural rather than perceptual.

What does deepfake fraud against a company look like?

It usually looks like a trusted person asking for money, access or data over a call, video meeting or message. The FBI's Internet Crime Complaint Center (IC3) says criminals generate video for real-time chats with supposed company executives, use cloned audio to impersonate public figures or personal contacts to extract payments, and have used AI-generated audio clips to get into bank accounts.

One publicly confirmed corporate case involved Arup. In May 2024 the London-based engineering firm confirmed to CNN that it had been the target of a deepfake scam in which a Hong Kong employee paid out money to fraudsters. Hong Kong police said the finance worker joined a video call with people he took to be the chief financial officer and other colleagues, all of them deepfake re-creations, and then agreed to send a total of 200 million Hong Kong dollars.

The request began with an email the worker first suspected was phishing because it asked for a secret transaction. Arup told CNN that its financial stability and business operations were not affected and that none of its internal systems were compromised.

Hiring is another entry point. IC3 has reported more complaints about deepfakes and stolen personal data being used to apply for remote jobs, and FinCEN has seen more suspicious activity reports describing fake identity documents used to get past verification checks.

Can employees reliably spot a deepfake?

Not reliably, so detection training should support verification procedures rather than replace them. IC3 still lists tells worth checking, such as distorted hands or feet and unrealistic facial features, and in remote job interviews it has seen lip movements that did not match the audio.

A joint information sheet from the NSA, FBI and CISA, released on September 12, 2023, went further. It advised organisations to consider real-time verification, passive detection and protection for high-priority officers and their communications.

What controls stop a deepfake from turning into a loss?

Controls that force a second, independent check before money or access moves. In a 2025 warning about impersonation of senior US officials, the FBI advises people to research the number or organisation contacting you, then find the person's number independently and call back; if a known contact appears on a new platform or number, confirm it through a channel you already trust.

In a finance team, that translates into callback rules for any change to payment details, dual approval above a set threshold, and a standing rule that urgency or secrecy in a request is a reason to slow down. The FBI also tells people to turn on multi-factor authentication everywhere it is offered and never switch it off, since attackers use social engineering to obtain codes.

Preparation matters as much as controls. The 2023 information sheet recommends information sharing, planning and rehearsing responses to exploitation attempts, and personnel training. IC3 also suggests limiting how much of a person's image and voice is available online, which is worth applying to executives most likely to be impersonated.

Where should companies report deepfake fraud?

In the United States, fraud victims are asked to report to the FBI through IC3, with as much transaction detail as possible, including dates, amounts, account numbers and the receiving institution. Financial institutions also have Bank Secrecy Act reporting duties, which FinCEN's alert reminded them of.

Incident response plans should name who calls the bank, who contacts law enforcement and who decides what to tell staff, so that a suspected deepfake payment is escalated within minutes of discovery rather than at the next month-end reconciliation.