Key Takeaways
- Business email compromise cost Americans roughly $3 billion in reported losses in 2025, and AI is now a documented factor in a meaningful share of those cases.
- Deepfake video and voice remove the last layer of friction that used to catch impersonation attempts: the instinct to recognize a familiar face or voice.
- A real, well-documented case shows the pattern clearly: an employee at an engineering firm authorized a multi-million-dollar transfer after a video call with what appeared to be the company’s CFO and colleagues.
- The fix to defend against deepfakes isn’t better detection. It’s a mandatory out-of-band verification step before any payment or account change goes through, regardless of how convincing the request looked or sounded.
- Finance teams are the highest-value target for this fraud because they’re positioned to move money quickly, which is exactly the instinct attackers are exploiting.
The Call that Looked Completely Normal
Perhaps you heard the story: a finance employee at the Hong Kong office of a global engineering firm joined a video conference. On the call were people he recognized: the company’s CFO and several colleagues, faces and voices he’d worked with before. During the call, he was instructed to process a series of payments. He made fifteen separate transfers, totaling roughly $25 million, before a routine follow-up with headquarters revealed the truth. Everyone on that call was an AI-generated deepfake. The employee had done nothing carelessly. He’d simply trusted what he saw and heard, which was precisely the point.
Why This Works When Email Scams Don’t
Traditional business email compromise relies on a spoofed domain and a well-written message, and years of security awareness training have made many employees reasonably good at catching those. A slightly off email address or an unusual tone of request are cues people have learned to notice. Deepfake video and voice remove that friction. When the CFO’s actual face and actual voice are asking, the instinct that would normally prompt a second look doesn’t fire, because the verification a human brain relies on, recognizing someone, is the very thing being faked.
The Scale of the Problem
This isn’t a rare, headline-only phenomenon. The FBI’s 2025 Internet Crime Report recorded business email compromise as one of the costliest categories of cybercrime reported to the Bureau, with losses reported to the Internet Crime Complaint Center totaling roughly $3 billion for the year. AI-enabled fraud has also emerged as its own tracked category for the first time in the report’s history, reflecting how often synthetic voice and video are now showing up as a layer within these schemes rather than a novelty.
The pattern investigators increasingly describe combines channels. An AI-written email sets up the request, and a follow-up call using a cloned voice or a deepfake video confirms it, exploiting the fact that most fraud training still treats email and phone verification as separate, trustworthy checks.
The Fix is Process, Not Detection
So, how can you defend against deepfakes? It’s tempting to look for a technical answer, some tool that can reliably flag a deepfake in real time. That technology is improving, but it isn’t reliable enough yet to be the primary defense, and it likely won’t be for a while as generation quality keeps improving too. The defense that actually works is procedural, and it’s not complicated: any request to move money, change banking details, or grant access to sensitive systems requires a verification step through a separate, pre-established channel, regardless of how the original request arrived or how convincing it looked.
In practice, that means calling a known phone number, not one provided in the same message or call, to confirm before acting. It means treating urgency itself as a signal worth pausing on, since attackers lean on time pressure precisely because it discourages verification. And it means making clear to every employee with payment authority that pausing to confirm will never be held against them, even if the request turns out to be legitimate. The alternative, an unquestioned culture of moving fast for anyone who sounds like an executive, is exactly the vulnerability this fraud is built to exploit.
Building that verification step into your payment workflows, and training the people who’d be targeted, is straightforward work that pays for itself the first time it stops a request that looked completely real.