Deepfake fraud: the cheap defences that actually work
In early 2024, an employee at the engineering firm Arup joined a video call with what appeared to be the company's finance director and several colleagues. Every other face and voice on the call was fake. By the end of it, around HK$200 million — roughly US$25 million — had been sent to fraudsters. The same year, the chief executive of WPP was impersonated with a cloned voice and a fake meeting; that attempt failed because the staff involved were suspicious.
Those are large companies. The version that reaches small businesses is smaller and far more common, and the good news is that the defences cost almost nothing.
What has actually changed
Impersonation fraud is old. What is new is the cost. Cloning a voice convincingly now needs only a short sample — a voicemail greeting, a podcast clip, a video on your social pages. A realistic fake video call needs more effort, but less every year. The result is that “I recognised their voice” is no longer evidence of anything.
How it reaches a small business
- The supplier who changed banks. An email or call, apparently from a supplier you pay every month, saying their account details have changed. Now sometimes followed up by a phone call in a familiar voice.
- The boss in a hurry. A voice note on WhatsApp from the owner, travelling, needing a payment made before end of day.
- The customer refund. A caller who knows your order details and needs the refund sent to a different account.
Every one of these relies on two things: a believable identity, and urgency that stops you checking. Technology has made the first easier. It has done nothing to the second, which is where the defence belongs.
The defences that work
- Call back on a number you already hold. Never the number in the message. If “the supplier” rings about new bank details, hang up and call the number on last year's invoice. This single habit defeats almost all of it.
- Make bank-detail changes a slow process on purpose. A written rule: no change to payment details takes effect until it has been confirmed by callback, and never on the same day it was requested.
- Two people for payments above a threshold. Pick a number that matters to your business. Above it, a second person approves. Fraud relies on one person acting alone under pressure.
- Agree a code word with anyone who can authorise payments, for use when a request arrives by phone or voice note. Old-fashioned, and it works against any technology.
- Give everyone permission to slow down. Say it out loud to your team: nobody will ever be criticised for delaying a payment to check it. Urgency is the attacker's tool; remove it.
Help from your bank
In the UK, Confirmation of Payee checks the name on the account you are paying against the name you typed, and warns you if they do not match. Take the warning seriously; it is often the last moment to catch a fraud. Since October 2024, UK payment firms have also had to reimburse most victims of authorised push payment fraud up to £85,000 — but the protection covers consumers, micro-enterprises and charities, and it is not a reason to skip the checks above.
Reducing your exposure
You cannot remove your voice from the internet, and you should not stop posting videos because of this. But it is worth knowing that public audio of the person who approves payments is raw material, and that the more your processes rely on voice alone, the more that matters.
Deepfakes are a new costume on an old crime. The businesses that get caught are the ones whose processes trust a voice; the ones that do not are the ones that trust a callback. The broader picture is in the three attacks that actually hit small businesses, and passkeys close off the password-theft side of the same problem.
Sources
Researched, written and published by Aftab Ahmad, owner of Seven Layers.