How to spot a deepfake scam before your business pays

You cannot rely on spotting a good deepfake by eye or ear, so do not make that your defence. Watch for the warning signs that come with every scam (urgency, secrecy, a new bank account, a request to skip the usual process), then verify on a channel the caller did not choose: call back on a number you already hold, ask a question only the real person can answer, and run payments through rules that no single call can override. CERT-In, the FBI and FinCEN all point the same way.

What do deepfake scams against businesses look like?

Three patterns show up in official reports.

• The fake executive on a video call. In January 2024 an employee of a multinational's Hong Kong office joined a video conference with what looked like the UK head office's chief financial officer. Police believe the conference was pre-recorded and generated from public video clips of the officer. The employee authorised transfers of about HK$200 million to five local bank accounts. A second Hong Kong case in May 2024 cost nearly HK$4 million after a call of nearly 30 minutes, according to the Hong Kong government's reply to the Legislative Council.
• The cloned voice. The FBI's Internet Crime Complaint Center warned in December 2024 that criminals use AI audio to impersonate people and to get into bank accounts, and AI video in live chats to pose as company executives or police.
• Fake identities at onboarding. FinCEN, the US financial intelligence unit, reported a rise in bank reports of deepfake identity documents used to open accounts and pass verification since 2023.

CERT-In's advisory of 27 November 2024 lists the same financial fraud: scammers posing as company executives or family members to request money or financial details.

Which warning signs should staff look for?

The signs in the request are more reliable than the signs in the picture.

In the request:

• Urgency and secrecy: "the deal closes today", "do not tell anyone yet".
• A new or changed bank account, or a first payment to someone you have not paid before.
• A senior person asking you to step outside the normal approval path.
• Pressure to move to a personal number, a new WhatsApp account or another app.
• Excuses that stop you checking: camera off, a bad line, repeated "technical glitches".

In the media: CERT-In lists unnatural blinking, awkward facial expressions, lip-sync problems, odd skin colour, inconsistent lighting and robotic-sounding voices. The FBI adds lag and voices that do not quite match. Both warn that the tools keep improving, so a clean-looking call proves nothing.

Verification steps that work

1. Call back on a number you already hold. Hang up and ring the person on the number in your contacts or company directory, never the one in the message. This is the FBI's advice, and CERT-In asks organisations to build callback procedures into sensitive transactions.
2. Use a code word. The FBI suggests a secret word or phrase for families. A finance team can do the same: a phrase agreed in person, never sent in writing, and changed when someone leaves.
3. Test with the conversation. Hong Kong police suggest asking about something only the real person would know, or asking them to make certain movements in front of the camera. Treat these as extra checks, not proof.
4. Slow down. Any request that cannot wait ten minutes for a call back is a red flag on its own.

Payment controls that no call can override

Verification depends on people under pressure. Controls in your bank portal and accounting process do not.

• Two people for any new payee or changed bank details. One raises it, another approves it after a call back. If your bank's corporate portal has maker and checker roles, turn them on.
• A waiting period for first payments to a new account.
• Limits per person and per day, with anything above the limit needing a second approver.
• A written rule that no one, including the managing director, can ask staff to bypass the process. Tell staff that a request to skip it is itself the warning sign.

This is the same principle we use for AI agents that touch money: a person approves anything irreversible, and the check sits outside the channel the request came through.

What if you onboard customers remotely?

Fintechs, NBFCs, brokers and insurers face deepfakes at KYC. FinCEN's alert on deepfake media lists red flags worth copying into your checks: a third-party webcam plugin during a live check, a request to switch channel because of glitches, identity documents that disagree with each other, a photo that does not match the stated age, a refusal to use multi-factor authentication, and a photo that a reverse image search finds in a gallery of generated faces. Its suggested practices are multi-factor authentication and live audio or video verification.

Write it down and rehearse it

CERT-In's deepfake advisory also asks organisations to monitor public channels for fake content about them and to keep a crisis plan for deepfake incidents. Put the call back rule, the code word and the payment limits into your AI governance policy, and walk the finance team through one test scenario a year.

If money has already gone in India, report it at once on helpline 1930 or at cybercrime.gov.in; the government says prompt reporting can allow fraudulent transactions to be frozen. Then call your bank.

Training your team

Our AI training workshops cover what AI tools can and cannot do today, including the data risks, and our AI strategy consulting maps how work and data flow through your business. If you want help writing verification and payment rules that hold up against a convincing fake, book a consultation.