The Voice on the Call Might Not Be Real: Deepfakes Are Now an Enterprise Fraud Problem

The person whose voice you hear on a call, or whose face you see on a video, might not be real. AI deepfakes have moved from novelty to a mainstream enterprise fraud tool, used to impersonate executives and colleagues convincingly enough to authorise payments, approve access, or extract sensitive information. For CISOs and finance leaders, this breaks a deep assumption that has underpinned business for decades: that recognising someone’s voice or face is proof of who they are. That assumption no longer holds, and the controls built on it need rethinking.

This is already happening at scale

The data makes clear this is not a future threat. According to Gartner’s 2026 CISO survey, 41 percent of organisations experienced a deepfake combined with social engineering on an audio call, and around a third on a video call, in the preceding year (reported analysis). Broader figures suggest a majority of organisations faced at least one deepfake attack over twelve months, and that AI-generated voice, video or text now features in roughly 40 percent of business email compromise attempts, up from under 5 percent a few years earlier (deepfake statistics 2026).

The losses are real and large. The widely reported case of engineering firm Arup, where staff were deceived by deepfake executives on a video call into transferring around 25 million US dollars, showed exactly how this plays out: a finance employee, following what appeared to be instructions from senior leaders they could see and hear, authorised a fraudulent transfer (reporting). No malware, no breached system. Just a convincing fake and a process that trusted a face on a screen.

What makes this so dangerous is how little the attacker needs. Cloning a usable voice can take only seconds of audio, which is trivially available from a webinar, an earnings call or a social video. The barrier to impersonating your executives has collapsed.

Why detection alone will not save you

The instinctive response is to buy deepfake detection technology, and detection has a role. But relying on it as the primary defence is a mistake, because it puts you in an arms race you are structurally likely to lose. Generative models producing fakes are improving at least as fast as the detectors trying to catch them, and the detector is always reacting to the last generation of fakes, not the next one.

You cannot reliably win by trying to spot the fake. You win by building processes where spotting the fake is not what stands between an attacker and your money.

This is the key shift in mindset. The durable defence is not better eyes or better software. It is process: ensuring that no high risk action can be authorised on the strength of a voice or a face alone, no matter how convincing.

Verification is the real control

The organisations handling this well have made a simple principle non-negotiable: sensitive actions require out-of-band verification. If a request arrives to move money, change payment details, or grant access, it must be confirmed through a separate, trusted channel before it proceeds, regardless of how authoritative the person making it appears.

In practice that means a few concrete things:

• Out-of-band confirmation for high risk requests. A payment or access change requested on a call is verified via a known, independent channel, a callback to a verified number or an internal system, not by trusting the call itself.
• Authorisation procedures that do not rest on identity recognition. Approvals for sensitive actions follow a defined process with independent checks, so no single convincing request can complete them.
• Clear, rehearsed escalation. Staff know exactly what to do when a request feels urgent and senior, including that urgency and seniority are themselves common pressure tactics.
• Training for the new reality. People are taught, directly, that a familiar voice or face is no longer proof of identity, which is counterintuitive and needs reinforcing.

None of this is exotic technology. It is disciplined process design, and it is far more reliable than hoping to detect every fake.

What leaders should do now

1. Identify your high risk actions, the payments, transfers, credential and access changes an attacker would target, and map how they are currently authorised.
2. Mandate out-of-band verification for all of them, so none can be completed on the basis of a voice or video alone.
3. Train staff on deepfake social engineering specifically, including that pressure and seniority are red flags, not reasons to comply.
4. Use detection as a supporting layer, not the primary control, and never as a reason to relax verification.
5. Rehearse it. Run a realistic scenario of a deepfake executive request and see whether your process actually stops it.

The goal is an organisation where even a perfect deepfake fails, because the fraudulent request runs into a verification step it cannot pass.

Where Jaykan fits

Jaykan helps enterprises and government organisations defend against AI-enabled social engineering, combining the right detection tooling with the far more important work of designing verification and authorisation processes that deepfakes cannot bypass, as part of our cyber security practice. We help clients make their people and processes resilient to attacks that target judgement rather than systems.

If you are not confident a convincing deepfake of one of your executives would be stopped before money moved, a complimentary, senior led assessment will test your exposure and give you a practical plan to close it.

Frequently asked questions

What is a deepfake social engineering attack?

It is an attack that uses AI-generated audio or video to impersonate a real person, such as a CEO or a colleague, to trick staff into authorising a payment, sharing credentials or granting access. The attacker clones a voice or face and uses it on a call or message to make a fraudulent request seem legitimate.

How common are deepfake attacks on businesses now?

They have become mainstream. Surveys in 2026 indicate a majority of organisations experienced at least one deepfake attack in the preceding year, and AI-generated voice, video or text now features in a substantial share of business email compromise attempts, up sharply from just a few years ago.

Can deepfake detection software stop these attacks?

Detection helps but is not sufficient on its own. The quality of fakes is improving rapidly, and detectors are in a constant race to keep up. The more reliable defence is procedural: verifying high risk requests through a separate, trusted channel so that a convincing voice or face alone cannot authorise anything.

How should an enterprise defend against deepfake fraud?

Put out-of-band verification in place for sensitive actions like payments and access changes, so they require confirmation through a separate trusted channel. Define clear authorisation procedures that do not depend on voice or video identity alone, and train staff that a convincing call is no longer proof of who is on it.