In 2024, a deepfake scam struck Equifax. An employee received what appeared to be a legitimate video message from the CEO. The face looked real, and the voice matched up. But it was all a scam, an elaborate deepfake created using generative AI. Luckily, the employee paused, did a little digging, and discovered it was a hoax before any damage could be done.

You’d think it would take cool Hollywood-type technology to pull this off, but today’s deepfakes can be created with inexpensive consumer AI tools in minutes. Fraudsters are using these tools to trick employees into transferring money, revealing credentials, exposing sensitive data, or bypassing security controls.

Deepfake videos, cloned voices, and AI-generated impersonations are among the fastest-growing cybersecurity threats facing businesses today.

And the threat is accelerating.

According to cybersecurity experts at Program.com, 10% of organizations have dealt with attempted deepfake fraud, and the number of deepfake attacks doubles every month. The average American encounters 2.6 deepfakes daily, and Accenture reports that 52% of people have experienced deepfake attacks aimed at stealing personal information or money. 

For businesses, the loss of trust driven by deepfakes can hurt both security and customer experience. You now have to assume that audio and video can no longer be treated as a valid proof of identity.

A deepfake is an AI-generated image (or video, essentially a series of images) designed to convincingly imitate a real person — how they look, how they speak, how they act — and often works in conjunction with deepfake voice cloning.

The deep in deepfake comes from deep learning, a special kind of machine learning. Basically, if you feed enough examples to a deep learning algorithm, it will produce output that closely resembles those examples. Using publicly available photos, videos, and audio clips, AI models can recreate someone’s facial expressions, speech patterns, and tone to an amazing extent.

For example, scammers can create:

• Video messages that seem to come from a CEO

• Voice calls that sound exactly like a finance executive

• Fake customer-support interactions

• Fraudulent Zoom meeting invitations

• Convincing social media videos promoting scam investments

Just a few years ago, you needed special skills to create deepfakes. And the results were often blurry, glitchy internet oddities that anyone could spot as phony. Today, generative AI makes creating deepfakes so much easier and effective. Criminals can now produce realistic impersonations fast, cheap, and at scale, dramatically changing the fraud landscape.

There’s nothing phony about the damage done by deepfakes

The danger for businesses is especially troubling because deepfakes target human trust rather than just technical vulnerabilities. Employees tend to react quickly to leadership requests, especially when they’re urgent. A fake video from a senior executive requesting a wire transfer or password reset can outweigh employee skepticism.

Cybercriminals are also merging deepfakes with social engineering tactics. They may research executives on LinkedIn, check out company announcements, or scrape social media videos to build highly personalized attacks.

The result is a new category of fraud that appears authentic and feels emotionally persuasive.

Ultimately, as with many crimes, the answer is money.

Deepfake scams can deliver big financial rewards with a relatively small effort. Criminals can use AI impersonations to convince employees to send wire transfers, approve invoices, disclose login credentials, or provide confidential business information.

In some cases, attackers impersonate executives to pressure employees into ignoring or bypassing established procedures. In others, they target customers directly with fake support calls or investment promotions.

The result? Enterprises reportedly lose an average of $680,000 per voice fraud attack.

Your business can face several types of risks from deepfake attacks:

• A cloned executive voice requesting an urgent payment can trigger costly wire fraud schemes. Finance departments or employees with payment authority are typical targets.

• Deepfake videos or calls can be used to trick your employees into revealing passwords, multifactor authentication codes, or sensitive company information.

• A fake executive video posted online can spread misinformation, manipulate stock prices, or damage public trust in a company.

• Customers who struggle to distinguish between real and fake communications may stop answering calls or engaging with you through digital channels altogether.

• Deepfake incidents can trigger internal investigations, legal exposure, compliance challenges, and costly remediation efforts.

Beyond the impact on you and your employees, deepfake scams can also hurt your customers (and indirectly damage you as well). For example, a fraudster might use deepfakes to impersonate bank employees and trick customers into disclosing account information. The potential result is financial losses for customers and a major hit to your reputation.

But scammers are increasingly targeting businesses because that’s where the money is. Corporate environments offer higher-value opportunities than a scam targeting a lone consumer, and one successful attack can lead to millions of dollars in losses.

There’s no single solution to the deepfake problem. You need an array of deepfake detection tools, a layered defense strategy that combines employee awareness, verification procedures, clear policies, and advanced fraud detection technologies. Here are some things you can do:

Train employees to verify, not assume

Maybe the most important shift organizations must make is cultural.

You know the old saying, “When you assume …” Well, employees need to know they can no longer assume that seeing or hearing someone is enough to be sure of their identity. Train your staff to independently verify unusual requests, especially if they involve money transfers, credentials, or sensitive information.

That might include:

• Secondary approval requirements

• Callback verification procedures

• Internal authentication codes

• Multichannel confirmation workflows

• Escalation processes for urgent executive requests

Your training should also include actual examples of AI-generated fraud tactics, so employees get an idea of how convincing modern deepfakes can be.

Strengthen your authentication and access controls

Organizations should go beyond reliance on voice or visual recognition alone.

Multifactor authentication, device verification, behavioral analytics, and Zero Trust security frameworks can help prevent attackers from exploiting impersonation attempts. 

Network-level risk signals that come directly from mobile carriers (not from the device or browser) can provide good protection, because they can’t be easily manipulated by AI. The data lives at the infrastructure level and reflects what is actually happening to a user’s phone number in real time.

Additionally, security teams should review how executives are communicating sensitive requests internally. Informal text messages or video instructions may need stronger verification controls.

Use AI to fight AI

Attackers are increasingly adopting AI-powered fraud techniques. It only makes sense that businesses should fight back with AI-powered defenses.

Solutions like Vonage Protection Suite use API-powered monitoring, fraud detection, and network intelligence to help organizations identify suspicious activity in real time. Features like Silent Authentication, SIM swap detection, and real-time risk analysis are designed to identify emerging fraud tactics before they escalate.

It’s not enough to block fraud after it occurs. Businesses need to proactively identify unusual behavior patterns that indicate some kind of impersonation or account compromise is happening.

Monitor legislative developments

Governments are beginning to respond to the rise of AI-generated fraud.

Last year, New Jersey led the way, enacting legislation making the creation and distribution of deceptive deepfake media a criminal offense punishable by prison time and civil liability.

An additional 47 states have since ratified laws addressing deepfakes in some form, including:

• California: Enacted 18 deepfake-related laws, including disclosure requirements for AI-generated election content and civil remedies for unauthorized use of voice or likeness

• Texas: Enacted one of the earliest laws in 2019 criminalizing political deepfakes, and has since passed 10 deepfake-related laws

• Tennessee: Enacted the Ensuring Likeness, Voice, and Image Security Act (ELVIS) Act in 2024 to establish civil remedies for the unauthorized AI replication of a person's voice or likeness

• Georgia: Passed comprehensive deepfake protections in 2025

• Pennsylvania and Washington: Enacted criminal penalties for creating or disseminating deepfakes with fraudulent intent in 2025

There is currently no unified deepfake law at the federal level. However, the:

• Disrupt Explicit Forged Images and Non-Consensual Edits Act (DEFIANCE) Act has been reintroduced for civil remedies

• No AI FRAUD Act has been proposed for unified personality rights

There are also a host of global activities:

• European Union: The EU Artificial Intelligence Act requires transparency and labeling requirements for AI-generated or manipulated media. Those who deploy deepfakes must indicate that the content is synthetic. And AI systems used for fraud prevention must adhere to GDPR privacy guidelines.

• China: The Provisions on the Administration of Deep Synthesis Internet Information Services require the labeling of AI-generated content, mandate digital watermarks for traceability, and enforce identity verification to prevent anonymous deception.

• International police organizations: Interpol leads cross-border crackdowns with multinational coalitions — such as the UK, France, Germany, and Italy — to thwart organized AI-fraud rings.

Businesses should stay on top of these evolving compliance requirements and legal obligations tied to AI-generated media.

Deepfake technology is forcing businesses to rethink basic assumptions. 

Organizations no longer can rely on information provided by users or devices (document photos, voice, videos, device fingerprints, etc.) because they’re easy to manipulate with AI. As generative AI tools continue improving, fake video and audio impersonations will become more common, more realistic, and harder to detect. Organizations that rely solely on employee intuition or outdated verification processes will face increasing risk.

The companies that stay ahead of this threat will be the ones that are layering AI-powered detection with strong authentication and a culture of verification, combining employee education, modern authentication practices, AI-powered fraud prevention, and clear internal security protocols.

Because in the age of deepfakes, that urgent video message from your boss may not actually be your boss — or even a human — at all.