When Seeing Is No Longer Believing
In early 2024, an employee at the engineering firm Arup joined what looked like a completely normal video call with the company’s CFO and several colleagues. It wasn’t normal. Every face on that call except the employee’s was an AI-generated deepfake, convincing enough that the employee authorized transfers totaling roughly $25 million before anyone realized what had happened. The case became one of the most cited examples of deepfake fraud precisely because it showed how far the technology had already come, not a shaky voicemail, a live video call that fooled a trained employee in real time.
That case is no longer the outlier it once looked like. Industry tracking puts global deepfake related fraud losses at over $1.5 billion for just the first nine months of 2025, with businesses specifically losing an average of roughly $450,000 per incident, and financial services firms averaging even higher at around $603,000. One in ten organizations hit reported losses exceeding a million dollars. These aren’t high volume spam style attacks, they’re small in number and large in size, exactly the profile of an attack built to bypass normal fraud detection.
Why This Beats Traditional Fraud Training
Most fraud awareness training still centers on suspicious emails: check the sender address, watch for urgency, verify before wiring funds. That training doesn’t fully prepare anyone for a phone call in a familiar voice or a video call with a familiar face. Research on human detection ability backs this up starkly, one study found people perform barely better than a coin flip at spotting a deepfake, and roughly 70% of respondents mistook fake video for real. Confidence in “I’d know it if I heard it” is, at this point, misplaced.
The tools to create a convincing voice clone now need only a short audio sample, often pulled from a public earnings call, a conference talk, or even a company’s own marketing video. That’s the part that should reframe how a business thinks about its public facing executive content.
What Actually Reduces the Risk
You can’t train employees to reliably spot a well made deepfake, so the fix has to sit in process, not perception:
- Require out of band verification for financial requests. Any wire transfer or payment change requested by phone or video should get confirmed through a separate, pre established channel, a callback to a known number, not one provided on the call itself.
- Set a verbal code word for high value transactions. Simple, low tech, and something a deepfake can’t fabricate because it isn’t public information.
- Build a dual approval step for wire transfers above a set threshold. No single employee, however senior the request appears to come from, should be able to authorize a large transfer alone.
These controls cost effectively nothing to implement and don’t depend on anyone getting better at detecting fakes in the moment, which the research suggests isn’t a realistic expectation anyway.
Financial and Investment Firms Carry Extra Exposure
Businesses handling client funds or investment transactions are disproportionately targeted here, the payoff for an attacker is simply larger. It’s part of why the work we do with finance and investment firms across Massachusetts always includes this kind of process level protection alongside the technical security stack, because the strongest firewall doesn’t help if a convincing voice on the phone can talk someone into skipping the verification step entirely.
This threat is moving fast, and the businesses that get ahead of it aren’t the ones with the most sophisticated detection tools, they’re the ones with a verification process simple enough that employees actually follow it under pressure.
Build That Process Before You Need It
Schedule a free security assessment with Cloud9 and we’ll help you put practical, low cost verification controls in place so a convincing call or video is never enough on its own to move money out of your business.