Deepfake fraud: voice and video synthesis is becoming accessible, and fake calls from executives are becoming widespread
Only a few years ago, a convincing fake voice or face required a studio, time and expertise. Today a few minutes of public video and an affordable online service are enough. For businesses this means that "I heard his voice" is no longer an argument.
How the technology went mainstream
Modern speech synthesis models reproduce a person's timbre, intonation and speaking style from very short audio samples. Real-time video models overlay someone else's face on a video-call participant. What used to be an experiment in research labs is now available as a subscription service.
There is more than enough raw material for such fakes: interviews, conference talks, webinars, social media videos. The more public an executive is, the easier it is to collect samples of their voice and face.
One of the first widely known cases dates back to 2019: the head of a UK energy company transferred about €220,000 after a phone conversation with the "chief executive of the parent company", whose voice had been synthesised. In 2024 an employee of a multinational engineering firm in Hong Kong made payments of roughly $25 million after a video meeting in which every "colleague" turned out to be fake.
Typical attack scenarios
- "A call from the director". A voice clone of an executive calls an accountant or treasurer and asks for an urgent, confidential payment.
- A fake video meeting. Several "participants" with synthesised faces create the effect of group approval.
- Supplier bank-detail change. An email about a "new account" is backed up by a call in the familiar voice of the counterparty's manager.
- Bypassing voice biometrics. A synthesised voice is used to pass automated identification in contact centres.
- Voice notes in messengers. Short "audio from the boss" asking to move the conversation to another app or to pay an invoice.
Why people believe
Deepfake attacks rarely rely on the quality of the fake alone. They combine it with the classic levers of social engineering: authority ("this is the CFO's decision"), urgency ("the deal closes today"), confidentiality ("don't tell anyone, not even your manager") and social proof ("everyone on the call has already agreed").
In such a situation, an employee who has doubts risks looking incompetent or disloyal. That is why the verification rule must be mandatory and impersonal: no one should have to decide whether it is "appropriate" to double-check with an executive.
Signs of a fake — and why you shouldn't rely on them
Sometimes a deepfake gives itself away: unnatural blinking, blurred facial contours when the head turns, audio lagging behind lip movement, "metallic" artefacts, odd pauses when answering unexpected questions. These signs are worth knowing, but you cannot build your defence on them.
- Synthesis quality is improving fast, and visible artefacts disappear with every new generation of models;
- A poor connection or a switched-off camera easily explains away any defect;
- Under stress and time pressure people notice far less than they do in training examples.
Defence: process, not detection
Effective protection against deepfake fraud does not try to tell a real voice from a fake one. It makes that question irrelevant.
- Out-of-band confirmation. Any non-standard request is confirmed via a different, pre-registered channel.
- Callback verification. The employee calls back a number from the internal directory, not a contact from the email or the call.
- Maker-checker without exceptions. No "secret deal" overrides segregation of duties.
- Code phrases and refusal scripts. Pre-agreed procedures that let anyone stop an operation without consequences for themselves.
- Training on realistic scenarios. Regular exercises with fake calls for finance and treasury teams.
A voice and a face have become data that can be copied. Trust only the verification that cannot be faked with a single call. — Sentinel Ledger Editorial
