Deepfakes and corporate fraud raise the bar for verification

News summary

The ability to generate increasingly convincing synthetic voice, images and video is changing a principle that many companies took for granted: recognising a person is no longer enough to validate an instruction.

The risk is particularly relevant in social engineering fraud. An attacker may attempt to simulate a director’s voice, recreate a video call or combine generated material with public information to lend credibility to an urgent request. The objective is usually to obtain a payment, modify a bank account or acquire internal data.

The response does not have to be technologically complicated. In fact, some of the most effective measures are process-based. Verifying bank account changes via a different channel, requiring dual approval for sensitive operations or using verification words in exceptional situations reduces reliance on appearance or voice.

It is also advisable to train teams to be wary of urgency. Frauds typically apply pressure to bypass controls using arguments such as a confidential operation, an imminent closing or the impossibility of following the usual procedure.

Detection tools can help, but they should not become the sole barrier. The quality of generated content evolves rapidly, and any automated system can be mistaken.

The conclusion is clear: the authentication of important decisions must rely on verifiable processes, not just human signals.

Companies can incorporate these threats into their regular drills. A call apparently originating from management requesting an urgent payment is a simple scenario to check if controls work under pressure. The goal is not to catch anyone out, but to validate that the process helps in making a secure decision even when the request seems convincing.