Deepfake fraud: How AI voices and videos cost firms millions

A familiar voice on the phone or a familiar face on a video call is not enough to confirm a payment request. Criminals can use AI-generated content to impersonate executives and persuade employees to make transfers. The FBI’s 2025 annual report devotes a separate section to AI-enabled fraud for the first time. Independent callbacks and mandatory approvals make such attacks harder.

How deepfake fraud works

A deepfake artificially reproduces a person’s voice or appearance, for example. In an attempted fraud, a fake message sent in an executive’s name may request a transfer. A subsequent call using an imitated voice can make the instruction appear more credible.

Such methods can form part of business email compromise. Criminals use deceptive business communications to try to trigger money transfers. The FBI’s IC3 annual report for 2025 includes a separate section on AI-enabled fraud for the first time. Its figures are based on complaints filed with the FBI and capture only part of the actual losses.

Verify payments independently

Companies should define who is authorised to instruct payments and who may approve them. A second authorised person checks the recipient, amount and purpose against the available documentation. This also applies to requests described as confidential or particularly urgent. The company sets approval limits and delegation rules according to its risk profile.

Changes to bank details and unusual payment requests are confirmed through an independently verified contact. One option is to initiate a callback using a number already on file. A number supplied in the suspicious email or call is insufficient. The FBI recommends using a second channel to verify changes to account details.

Employees in finance, procurement and administrative support should know how to report a suspicious instruction and suspend approval until it has been clarified. Exercises help test these procedures.

Detection and response to suspected fraud

Unusual time pressure, demands for secrecy or a departure from the usual payment process are reasons to check. A familiar-sounding voice does not prove authenticity. Technical detection can provide indications; payment approval should remain subject to independent checks.

If fraud is suspected, the requested payment should be stopped and the internal security or reporting channel notified. If money has already left the account, the company must contact its bank immediately and ask it to investigate a possible recovery. Messages, payment details and call information should be preserved for the investigation.

Frequently asked questions

Each question is closed. Tap to reveal the answer.

How can a suspicious call be checked?

End the call and call the supposed contact back using an independently verified number already known to you. Payment instructions remain on hold until they receive the usual approval.

Is a video conference sufficient for approval?

A video conference should not replace the established payment checks. The recipient, amount and purpose should be checked through the designated approval process.

Is deepfake fraud a criminal offence?

In Germany, such an attack can meet the elements of fraud under § 263 StGB of the German Criminal Code. Attempted fraud is also punishable. The offences involved depend on the individual case.

Editor’s Picks

Editor’s PickSecurity Awareness 2025: Why Training Alone Won’t Solve Cyber RisksEditor’s PickZero Trust for SMEs: Getting Started in 5 Steps

More from the MBF Media Network

Digital ChiefsGeopolitics Meets the Data Center Roadmap: What CIOs Must Secure NowcloudmagazinFinOps: How Companies Finally Gain Control Over Cloud Costs

More from the MBF Media network

• Geopolitics meets the data centre roadmap: What CIOs need to secure now
• FinOps: How companies can get cloud costs under control

Image source: AI-generated (November 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.