To prevent deepfake fraud, take the face and voice out of the decision. Money and access only move after someone rings back a saved number and a second person signs off. A flawless fake still can’t get past that.
Training people to spot fakes is a race you lose slowly; the tools get better every few months. “Callback first, then pay” never needs anyone to spot anything.
| Where the scam needs you | Control that breaks it | Case that shows why |
|---|---|---|
| Trusting a face on a video call | Video and voice are never authorisation on their own | Arup (2024) |
| Trusting a familiar voice | Call back on a stored number before acting | UK energy firm (2019) |
| Acting on an unusual channel | Staff know executives don’t instruct payments by WhatsApp | LastPass (2024) |
| One person moving money | Two approvers that seniority can’t override | Arup (2024) |
| Trusting an ad or official-looking call | Check the firm or official with the regulator or a known number | Singapore (2026) |
Key takeaways
Put it in writing. Seeing the boss on Teams isn’t approval for anything, whether that’s a wire, a new supplier or a password reset. Arup is why: 15 transfers, HK$200 million, all after a meeting police say was entirely fake apart from the victim.
In 2019, a UK energy firm’s boss wired €220,000 after a call that used AI-cloned audio of his parent company’s chief executive. A callback to that executive’s known number would have broken the story. A fake can’t answer a call you place.
Ever notice the fake is always the boss? Rank makes people cut corners. So the second sign-off can’t be waived by anyone, the CEO included. Especially the CEO.
LastPass’s employee ignored a cloned CEO voice partly because the CEO doesn’t message staff on WhatsApp. If executives say clearly “I will never ask for money this way”, staff have a simple test.
Teams that approve things by phone can agree a phrase face to face and never type it anywhere. Old-fashioned. Works.
Tip: get the CEO to tell all staff, in their own words, “I will never ring you for an urgent payment. If I do, it isn’t me.” Now saying no feels allowed.
At home, the usual bait is a famous face selling an investment. A Bengaluru retiree sent Rs 6.88 lakh after a faked Facebook video showed India’s finance minister backing a scheme. See the Bengaluru case. Before paying anyone, look the firm up on the regulator’s register. If it’s not there, walk away.
A bit. It tells you “probably fake” or “probably real”, and next year’s fakes will fool this year’s tool. A callback doesn’t care how good the fake is.
Where practical, limit unnecessary public audio and video of people who can approve payments. But assume a fake is possible anyway and build the process around that.
Report it internally even if nothing was lost, tell staff what happened, and check that the callback and approval rules were followed. LastPass and WPP both talked publicly about their failed attempts.
Big enough that the FBI now counts it separately: 22,364 AI-related complaints and roughly $893 million lost, per its 2025 report. See the FBI IC3 data.
Reviewed by SEE Team. Last reviewed 24 Oct 2026. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples