What is a deepfake?
A deepfake is fake video, audio or image content created by artificial intelligence to convincingly imitate a real person. The technology clones a face and voice from public material, and it is being used in fraud: a scammer can appear on a video call with the face and voice of an executive to authorize a transfer that should never happen.
How a deepfake scam happens
The deepfake turned the old fake-boss fraud into an almost perfect staging. The scam usually follows four stages:
Collecting public material
The scammer gathers videos, photos and audio of the target, an executive, available in talks, interviews, social media and recorded meetings.
Creating the clone
With AI, they generate a face and a voice that imitate the person. Seconds of audio are enough to clone a voice with a high degree of resemblance.
The contact that looks legitimate
The victim gets a video call or a voice message from the boss demanding urgency and secrecy. Seeing and hearing the person breaks down suspicion.
The irreversible action
Under pressure, the employee transfers the money or hands over the data. By the time the fraud is discovered, the money is gone, often in several transactions.
Source: reported corporate cases (Fortune, CNN) and market research (Gartner, Deloitte).
Warning signs of a deepfake
- An urgent, secret request for money or data, made by video or voice, that departs from the company's normal process.
- Small flaws in the image: odd blinking, imperfect lip-sync, inconsistent lighting or face edges.
- The person avoids live actions a fake video struggles to reproduce, like turning the face sideways or answering an unexpected question.
- Pressure to skip verification: do not tell anyone, it has to be now, it is confidential.
- The channel changes suddenly: a serious matter always handled in person appears on an unexpected call.
The types of deepfake used in fraud
- Video A face swapped or recreated in real time, used on video calls to impersonate an executive or business partner.
- Voice (audio cloning) A call or voice message with the imitated voice of the boss. A short audio sample is enough to create a convincing clone.
- Image Fake photos of people, documents or situations, used to lend credibility to a scam or a fake profile.
- Combined with social engineering The deepfake rarely acts alone: it comes after a pretext email to reinforce the ruse and overcome the victim's last suspicion.
Why the deepfake is a real threat to business
The deepfake removed fraud's biggest obstacle: the suspicion of seeing and hearing. In a widely reported case, an employee at an engineering firm joined a video call with what appeared to be the chief financial officer and other colleagues, all fake, and transferred $ 25.6 million in fifteen transactions (Fortune, 2024). It was not isolated bad luck: a 2025 survey found that 62% of organizations suffered some deepfake attack in the prior year (Gartner). What makes the threat accessible is that the raw material is public, any executive who appears in talks and videos already has a face and voice available, and cloning a voice takes seconds of audio. Market projections estimate that fraud enabled by generative AI will jump from billions to tens of billions by the end of the decade (Deloitte). The antidote is not only technological: it is process. No important transfer should depend on seeing and hearing alone.
How to protect the company against deepfakes
Against the deepfake, process protects more than the eye. The defenses that work combine people and technology:
- Verification through a second channelNo request for a transfer or sensitive data is confirmed by video or voice alone. A callback through a known, independent channel breaks the scam.
- The passphrase ruleAgree on a verification phrase for urgent financial requests. The scammer does not know it, no matter how real they look.
- A process that removes the pressureSet that payments above a threshold require dual approval and never bypass the flow, even at the boss's request.
- Train the team for the new scamPeople need to know that a face and voice can be fake. Awareness is the first barrier, because the scam attacks trust, not the system.
- Reduce executive exposureAssessing how much public material about leaders is available helps size the risk and guide who is a preferred target.
In practice
Agree today, with your finance team, on a simple rule: no urgent transfer requested by video or voice goes out without confirmation through a second channel. That single rule would have prevented the biggest deepfake scams on record.
How Zamak helps against the deepfake
Zamak Technologies handles the deepfake as a social engineering threat supercharged by AI, within managed cybersecurity in the Zamak Method: it combines team awareness, second-channel verification processes and identity and email defense, alongside the internal team. A good starting point is understanding the company's AI and data exposure with the AI exposure diagnostic.