What is deepfake fraud? A protection guide for businesses

Your accountant's phone rings. The caller sounds exactly like you. There is an urgent supplier payment, it has to go out today, and for now it must stay confidential. A few minutes later, the money is sitting in someone else's account.

A few years ago this sounded like science fiction. Today it is a real risk. Artificial intelligence has made it far easier to imitate a person's voice or face. In this guide we explain what deepfake fraud is, what a real case can teach us, and the practical steps you can take today to protect your business.

What is deepfake fraud?

A deepfake is fake audio, an image or a video that has been created or altered with artificial intelligence. Fraudsters use this technology to impersonate someone you know and trust: your boss, your finance manager, a supplier or a family member.

According to a public warning issued in December 2024 by the FBI's Internet Crime Complaint Center, criminals use generative AI in four main ways:

• Text: Convincing fake emails and messages without the spelling or grammar mistakes that used to give scams away.
• Images: Fake profile photos and fake identity documents.
• Audio: Cloning a person's voice to ask for urgent money.
• Video: Live video calls with people who appear to be company executives.

The same warning stresses that these tools remove the classic warning signs of fraud. In other words, "if the writing is sloppy, it is fake" is no longer a rule you can rely on.

A real case: everyone on the video call was fake

The best-known example happened at the Hong Kong office of Arup, the global engineering and design firm. According to the South China Morning Post, an employee in the finance department received a message in mid-January that appeared to come from the company's chief financial officer in the United Kingdom, saying a secret transaction had to be carried out.

The employee then joined a video conference with several people. According to CNN, citing Hong Kong police, everyone the employee saw on that call was an AI-generated fake. The employee ended up transferring a total of HK$200 million, about US$25.6 million. In May 2024, Arup confirmed it was the company involved and that fake voices and images had been used.

The lesson is simple. The fraudsters did not hack a system or crack a password. They exploited the fact that an employee trusted their own eyes and ears. That is why the solution is not only technical. It is about process.

Which businesses are at risk?

The short answer: any business that makes payments, works with suppliers, and has managers whose voice or face can be found online. Pay special attention if:

• Payment instructions are often given by phone or message,
• Managers travel often and "remote instructions" feel normal,
• Supplier bank details are updated by email,
• Executives appear regularly in social media videos, interviews or webinars.

The FBI warning also notes that limiting how much of your image and voice is publicly available makes it harder for fraudsters to build convincing fakes.

How to spot a fake request

As the technology improves, spotting a fake by eye gets harder. Still, the signs the FBI lists are worth knowing:

• Distorted hands, unnatural teeth or eyes, inconsistent shadows,
• Lag or mismatch between the voice and lip movements,
• Word choices and tone that do not match how the person usually speaks.

The strongest warning sign, however, is behavioral rather than technical. Stop when these three show up together:

1. Urgency: "Today, right now, no delay."
2. Secrecy: "Do not tell anyone, keep it between us for now."
3. An unusual channel or account: A new bank account, an unfamiliar app, a different phone number.

Six steps you can take today

1. Make a call-back rule

The clearest FBI recommendation: to verify a caller, hang up, look up the known number of the person or organization yourself, and call them back. Make it company policy. Any request involving money or bank details is verified through a number already on file, never through the channel the request came from.

2. Agree on a verification phrase

The FBI suggests families create a secret word or phrase. The same idea works in a business. Agree on a verification phrase that is shared only in person among people with payment authority, and change it from time to time.

3. Require two approvals for payments

For payments above a set amount, and for any change to supplier bank details, require approval from two different people. A setup where one person can send a large payment after a single call is exactly the gap fraudsters look for.

4. Tell everyone there is no such thing as a "secret payment"

Say it clearly to your team: "I will never ask you for a secret, urgent payment. If such a request arrives, even if it seems to come from me, stop and verify." That one sentence gives your staff permission to say no without feeling awkward.

5. Run a short awareness session

Even a thirty-minute meeting with your accounting, purchasing and front office teams makes a difference. Walk through the Arup case, show the call-back rule, and make clear who to alert when something feels wrong.

6. Record and report suspicious contacts

When a suspicious call or message arrives, write down the number, the time, the amount requested and the account details. This helps both your bank and law enforcement. If a payment has already gone out, call your bank immediately.

How automation helps

At the heart of deepfake fraud is a single person making a decision alone, based on a spoken instruction. A well-designed approval flow closes that gap. For example, payment requests go into one system, anything above a set amount is automatically routed to a second approver, and changes to supplier bank details trigger a verification step through the number on file. Control then depends on the rule, not on the stress or urgency of the moment. The final decision stays with you; the system simply makes sure no step is skipped.

Conclusion

Deepfake fraud targets your trust in what you see and hear. The best defense is a culture that replaces "I saw it, I heard it, so it is real" with "I verified it, so it is real." A call-back rule, dual approval and a short team session are steps you can start today without a big budget.

If you would like an automation that puts your payment and approval processes on clear rules, the Atomaxis team is happy to plan the first step with you.