Deepfake fraud protection: stop deepfake video call scams and wire fraud

What is deepfake payment fraud?

Deepfake payment fraud uses AI-generated video, audio or images to impersonate someone your team trusts, usually an owner, an executive, a client or a vendor, so that someone approves a payment. It's the newest version of an old crime: CEO fraud, also called business email compromise (BEC). The FBI's Internet Crime Complaint Center has listed business email compromise among the costliest kinds of cybercrime reported to it year after year.

AI makes the con more convincing. The "CFO" on the video call looks and sounds right, the follow-up email reads perfectly, and the invoice looks like the real one. In widely reported cases, employees have joined video meetings where the other participants were deepfakes and then sent large transfers. Smaller businesses see quieter versions every day: a "vendor" emailing new bank details, or "the owner" texting a manager to buy gift cards for a client.

Common deepfake and CEO fraud scenarios

• Deepfake video call scam: an urgent meeting, cameras on, and an executive asks for a confidential wire for a deal or an overdue payment.
• Vendor bank-change fraud: an email, sometimes from a real vendor account that was hacked, says "we've changed banks, please update your records."
• Fake invoice fraud: a near-perfect copy of a real invoice with different payment details.
• Payroll diversion: an "employee" asks HR or the owner to switch their direct deposit.
• Gift card requests: "the boss" needs gift cards for a client and asks you to send the codes.

Red flags of deepfake and business email compromise

• Urgency plus secrecy: "Do this today, and don't loop anyone else in."
• A request to skip the normal approval process "just this once."
• New or changed payment details, especially a new bank or an overseas account.
• A sender address or web domain that's one letter off, or a reply-to address that differs from the sender.
• On video: lighting on the face that doesn't match the room, lips slightly out of sync, a person who avoids turning their head, or a sudden "bad connection" when you ask a question.
• The person won't let you call back on a known number or confirm in person.

How to protect your business from deepfake fraud

1. Write a call-back rule. Any new payee, bank change or urgent payment request gets verified by calling a phone number already on file, never a number in the message.
2. Require two approvals for wires and payments over a set amount.
3. Use a verbal code word for payment requests between owners and whoever pays the bills.
4. Turn on multi-factor authentication on email, banking and accounting tools, so attackers can't take over a real account and send the request from it.
5. Ask your bank about payee confirmation, transfer alerts, and daily limits.
6. Train your team to pause. Make it clear that nobody gets in trouble for slowing a payment down to verify it.
7. Limit what's public. Org charts, long videos of leaders, and vendor names all help scammers build a believable story.

What to do if you sent money to a deepfake

1. Call your bank immediately and ask for a wire recall. The first hours matter most.
2. File a complaint with the FBI at ic3.gov. The FBI works with banks to try to freeze some fraudulent transfers, and a fast report improves the odds.
3. Secure the email account: reset passwords, check for forwarding rules you didn't set, and turn on MFA.
4. Tell your insurer or agent right away. Most policies require prompt notice of a loss.
5. Keep records: emails, call logs, invoices and bank confirmations.

Does insurance cover deepfake fraud and wire fraud?

Often not by default. A cyber policy may cover hacking and data breaches but treat a payment your employee "authorized" differently. That loss usually needs social-engineering fraud or funds-transfer fraud coverage, which is often an add-on with a lower sub-limit, and a commercial crime policy can also play a role. Ask by name: "Do we have social-engineering and funds-transfer fraud coverage, does it include impersonation or deepfake fraud, and what's the limit?" Some policies expect you to have followed a verification step such as a call-back, which is one more reason to write yours down. Read more about cyber insurance for AI scams. AI Shield Coverage doesn't sell insurance; we point you to licensed insurers' own quote pages.

Start with the habits in our free AI Scam Readiness Checklist. They take minutes and close the gaps deepfakes rely on.