Definition: Deepfake threats to businesses means using voices, videos and images made or changed by AI to trick staff. The goal is usually to get payments, logins or secret information. At its core, this is social engineering. The attacker poses as a trusted person, which makes the trick far more convincing.
How deepfake attacks on companies work
Deepfakes take well-known scams such as CEO fraud (business email compromise) one step further. In the past, a fake email from the managing director was enough. Today, attackers can also copy the voice or face of the supposed sender. A convincing voice clone often needs only a few minutes of audio. That audio is easy to find in interviews, webinars, podcasts or social media videos.
Typical scenarios include:
- A call from "the CEO": Accounting gets a call in a cloned voice. It orders an urgent, secret transfer, for example for an alleged takeover.
- Fake video conference: Several people in a video call are fake. In early 2024 it came out that an employee of the engineering firm Arup in Hong Kong had made transfers worth around USD 25 million after such a meeting.
- Attacks on the IT help desk: A caller uses an employee's voice to get a password or multi-factor authentication reset.
- Supplier and bank detail fraud: A supposed contact at a supplier confirms a "changed bank account" by phone.
- Hiring fraud: People with false identities join remote job interviews to gain access to systems.
- Attacks on your reputation: Fake statements by executives are spread to sway customers, partners or share prices.
Why technical detection is not enough
Some tools try to detect deepfakes by finding flaws in images or audio. How well they work depends a lot on how the fake was made. New methods often get ahead of the detectors. Signs such as odd blinking or lip movements are not reliable either. Phone and video calls distort the picture and sound anyway. So the best defense is a set of processes that work whether or not anyone spots the fake.
Safeguards: processes before technology
- Callback check: Never confirm payment orders, bank detail changes or access resets on the channel they came in on. Instead, call the person back on a number already in your internal directory. Never use the number given in the request.
- Dual approval (four-eyes principle): Transfers above a set amount and any unplanned payments need approval from a second person who acts on their own. This applies even when the order seems to come from senior management.
- No exceptions for urgency: State in writing that time pressure and requests for secrecy are never a reason to skip approval steps. Management should follow this rule openly and talk about it.
- Code words or challenge questions: For very sensitive deals, agreed code words can help. So can questions about internal facts that an attacker cannot find in public sources.
- Identity checks at the help desk: Reset passwords and MFA only after a set identity check. This could be a callback, approval by the line manager or a visit in person.
- Awareness training with real examples: Staff in finance, purchasing, HR and IT support should know that voices and videos can be faked. They should know the warning signs: unusual channels, time pressure and demands for secrecy.
- Think about what is public: You cannot fully avoid public audio and video of your executives. But it is worth knowing what is out there.
- Incident plan: Decide what to do after a suspicious or completed payment. Call the bank at once to recall the transfer, report the case to the police and tell internal IT security.
Legal context
Under Article 50 of the EU AI Act, deployers who create deepfakes must, since 2 August 2026, generally disclose that the content is artificially generated. For machine-readable marking by existing systems, a transition period runs until 2 December 2026.
Criminal attackers ignore this, of course. The duty mainly matters for companies that use synthetic media themselves, for example in marketing. For organizations covered by NIS2, social engineering risks and staff training are already part of mandatory risk management. Germany has put NIS2 into law through the amended BSI Act (BSIG).
Conclusion
The best protection against deepfake fraud is one principle: check critical orders through a second, independent channel and have a second person approve them. SecTepe helps you review your approval processes. We also design awareness measures that reflect real deepfake scenarios.
Frequently asked questions
Does this affect smaller companies too?
Yes. Voice cloning tools are easy to get. In mid-sized firms, management and accounting often know each other well. That makes a familiar voice all the more convincing.
Should we buy deepfake detection software?
It can be a useful extra, but it does not replace checks and approvals. Invest in clear approval rules and training first.