A finance manager in Hong Kong transferred $25 million after a video call with his CFO. The CFO’s face was on screen. His voice sounded right. Several other executives appeared to be on the call. The transfer went through. Days later, the company discovered that every person on that video call was AI-generated. The CFO had never logged in.

That case made headlines, but the technology behind it is no longer experimental or expensive. Anyone with an internet connection can now create a convincing voice clone from a few minutes of recorded audio. Video deepfakes require a bit more skill, but not much. The barrier to entry has collapsed, and attackers know it.

What changed

For years, we could trust that a voice on the phone or a face on a video call was probably legitimate. That assumption no longer holds for high-stakes decisions. An attacker with access to a YouTube video of your CEO speaking at a conference, or a voicemail recording, can generate a synthetic voice that will fool most listeners. The same goes for video: a handful of photos from LinkedIn is often enough.

The tells are getting harder to spot. You might notice a slight audio echo, mismatched lip sync, or an odd refusal to turn on the camera when asked. But these cues are subtle, and they are improving every month. Relying on your ability to detect a deepfake in real time is not a sustainable defense.

How attackers use it

Deepfakes rarely appear in isolation. They are paired with urgency and pressure. The fake CFO will ask for an immediate wire transfer to close a time-sensitive deal. The request will include instructions not to mention it to anyone else. The scenario is designed to discourage the one thing that would stop the attack: a second check.

We have seen variations of this in phishing emails for years, but voice and video add a layer of perceived authenticity that email cannot match. When someone who looks and sounds like your boss is asking you to act, the psychological pressure to comply is significant.

What works

The answer is not better detection software. It is better process. For any sensitive action—wire transfers, payroll changes, password resets, contract approvals—require verification through a second channel. That means a callback to a number you already have on file, a written confirmation from a known email address, or a pre-agreed verification phrase.

Train your team that asking “can I confirm this with you a different way?” is not an insult. It is policy. The organizations that will weather this shift are the ones that build verification into their workflows rather than relying on individual judgment under pressure.

What we are doing

We have updated our own internal procedures and are helping clients do the same. If you are responsible for approving financial transactions, HR changes, or access requests, it is worth reviewing your verification steps now. The technology is already here, and it is being used.

If you would like to talk through what sensible verification policies look like for your business, get in touch. We can walk through your current process and help you close the gaps before they become expensive lessons.