Deepfake voice and video fraud

What has changed

Until recently, a phone call from your boss sounded like your boss because it was your boss. That assumption no longer holds. AI tools can clone a voice from a short recording, such as a podcast, a webinar or a voicemail greeting, and generate realistic video of a person speaking. These tools are cheap and widely available, and criminals have started using them in fraud against businesses.

Deepfake fraud is usually a new twist on old scams. The goal is still to get someone to send money, share credentials or change banking details. What is new is that a voice or video call, once considered good verification, can now be part of the deception. The defences are therefore familiar too.

How the attacks usually look

A common pattern starts with an email or text that sets up urgency, followed by a phone call or voice message that sounds like a senior leader confirming the request. In other cases, a video meeting is arranged where one or more participants are fake, and the employee is asked to process an urgent payment. Attackers may also impersonate IT staff to talk someone into approving MFA or installing remote access software.

These scams lean heavily on authority and time pressure. The caller may say they are about to board a flight, are in a confidential deal or cannot be reached afterward, which discourages the employee from checking. Recognizing these pressure tactics is the first step. Whenever a request combines authority, urgency and an unusual channel, staff should treat that combination itself as the signal to stop and verify, no matter how familiar the voice or face appears.

• Urgent payment requests from an executive
• Requests to change vendor or payroll banking details
• Calls from IT asking for MFA approval or remote access
• Secrecy, urgency or unusual channels

Verification beats detection

It is tempting to train staff to spot glitches in fake audio or video, such as odd pauses, unnatural blinking or lip movements out of sync. Those clues exist, but the technology is improving quickly, and relying on people to spot fakes is not dependable. A better approach is to make verification the rule, regardless of how real the request seems.

Any request involving money, credentials or sensitive data should be confirmed through a separate, trusted channel. Hang up and call back using a number from your own records. Message the person on a known internal chat account. If the request truly cannot wait for that check, it is most likely not genuine.

Practical safeguards for your business

Combine verification with process controls that do not depend on any single person. Require two approvers for large or unusual payments and any change to banking details. Some teams agree on a code word or challenge question for urgent requests, which a deepfake caller is unlikely to know. Make sure the help desk has a strict identity check before resetting passwords or MFA.

Consider how much voice and video of your leaders is publicly available, and remind executives that their profiles make them likely targets. You do not need to remove everything, but awareness helps leaders understand why staff will check their requests, and why they should welcome it. Small, sensible changes help.

Preparing your team

Include deepfake scenarios in security awareness training and tabletop exercises. Play a short example of a cloned voice so staff understand how convincing it can be. Most people are surprised, and that surprise makes the verification rule easier to accept and remember. Practise the callback step during exercises so it becomes automatic.

Make it clear that leaders will never be offended by a callback, and that anyone who checks is doing their job well. If a deepfake attempt occurs, report it to the Canadian Anti-Fraud Centre and your local police, and share the experience internally so others can learn from it. Fraud reports help track new methods.