A finance employee joins a routine video call with the CFO and several colleagues. Everyone looks right. Everyone sounds right. The CFO asks for a series of confidential transfers. The employee sends roughly $25 million. Every other person on that call was AI-generated.

Deepfake fraud is the use of AI-generated audio, video, or images to impersonate a real person, usually an executive, vendor, or colleague, in order to trick an employee into sending money or sensitive data. It requires no hacking, no malware, and no network breach. The attack targets your approval process, not your systems, which is why firewalls and spam filters do nothing to stop it.

Key Takeaways
  • The FBI logged 22,364 AI-related fraud complaints in 2025, with $893 million in losses, the first year it tracked AI as its own category.
  • A convincing voice clone can be built from a few seconds of public audio, so anyone who has appeared in a video, podcast, or voicemail greeting is source material.
  • Three process controls stop most deepfake fraud cold: an out-of-band callback rule, a shared code word, and dual approval on every payment or banking change.
  • Speed decides recovery. The FBI's Financial Fraud Kill Chain froze 58 percent of flagged transfer amounts in 2025, but only when victims reported fast.

The year deepfake fraud got its own line in the FBI’s books

The FBI’s Internet Crime Complaint Center (IC3) released its 2025 Internet Crime Report in April 2026, and for the first time it broke out AI-enabled crime as a dedicated category: 22,364 complaints and $893 million in losses. That sits inside a record year overall, with total reported cybercrime losses passing $20.8 billion, up 26 percent from 2024.

The category most relevant to a small business is the one deepfakes supercharge: business email compromise, which the FBI now describes as increasingly voice and video driven. BEC produced $3.04 billion in losses across 24,768 complaints in 2025, second only to investment fraud. And 86 percent of those losses moved over wire transfer or ACH, which means the money is usually gone within hours if nobody catches it.

The reference case is still the one that made headlines in early 2024. A finance employee at the Hong Kong office of engineering firm Arup was invited to a video conference with what appeared to be the company’s CFO and other colleagues. Every participant except the victim was a deepfake. The employee authorized transfers totaling roughly $25 million, as first reported by CNN in February 2024. Nothing was hacked. The attackers built the entire scheme from publicly available video and audio.

That case involved a large firm, but the economics have since inverted. The tooling that produced that call is now cheap and commodity. A 15-person contractor, clinic, or agency is a softer target than Arup ever was, because small firms rarely have a payment approval process that survives a convincing voice.

The three attack patterns hitting small firms

Deepfake fraud against a small business almost always takes one of three shapes.

The urgent executive call. An employee in finance or bookkeeping gets a call, voicemail, or video call from the owner or a senior manager. The voice is right. The request is urgent, confidential, and slightly irregular: wire a deposit to close a deal, pay a vendor before a deadline, buy gift cards for a client. Urgency plus secrecy is the tell. The voice is no longer one.

The vendor banking change. A known supplier calls or emails to say their bank details changed. Sometimes the email thread is real and hijacked; increasingly the follow-up call confirming the change is a cloned voice of a real contact at that vendor. The next legitimate invoice gets paid into the attacker’s account.

The multi-person video call. The Arup pattern. Live deepfake video is now good enough to survive a short meeting, especially on a compressed, slightly laggy connection where artifacts read as bandwidth problems. If your firm approves anything based on “I saw them on the call,” this pattern applies to you.

All three exploit the same gap: the human voice and face used to be proof of identity, and your payment process still treats them that way.

The 3 controls that stop deepfake fraud: callback rule, code word, dual approval

Why your existing security stack does not cover this

Most small firms that have invested anything in security have email filtering, MFA, and maybe endpoint protection. All three are worth having. None of them touch deepfake fraud, because the attack never enters a system you control. A phone call is not an email. A video meeting invite from a hijacked vendor thread passes every filter. MFA protects logins, not judgment.

Detection tools for synthetic audio and video exist, and enterprise vendors sell them. They are built for banks and call centers, priced accordingly, and they degrade badly on compressed phone-quality audio, which is exactly what the attacker uses. A small business should not build its defense on detection. It should build on verification, which costs nothing and does not care how good the fake is.

If your team already works under an AI use policy, this is the natural next section of it. We covered building that policy in our AI acceptable use policy guide, and the same logic applies here: write the rule down, make it apply to everyone including the owner, and remove the judgment call from the employee under pressure.

The protection playbook: three controls, one afternoon

1. The callback rule. No payment, banking change, or credential request gets acted on from an inbound call, video call, voicemail, or message. The employee hangs up and calls the person back on the number already in the company directory or the vendor record on file. Not the number from the email signature, not the number the caller provides. This single rule defeats voice cloning entirely, because the attacker does not control the real phone number.

2. The code word. Agree on a short phrase known only to the people authorized to request money movement. It never appears in email, chat, or any document. Any urgent or irregular request over voice or video must include it. An AI model can clone a voice from scraped audio; it cannot know a phrase that has never touched the internet. Banks now recommend exactly this to consumers, and it works just as well inside a 12-person firm.

3. Dual approval. No single person, and no single communication channel, can move money above a threshold you set. One person initiates, a second person approves through a different channel. In practice this turns a successful deepfake call into a failed one, because the attacker has to fool two people through two channels, and the second approver is following the callback rule.

These are process controls, not products. Rolling them out is a one-page policy and a 20-minute team meeting. The rule that matters most in that meeting: the controls apply even when the request comes from the owner, especially when it comes from the owner, because the owner is exactly who the attacker will impersonate.

FBI IC3 2025 AI fraud numbers: $893M AI losses, $3.04B BEC, 58% of flagged transfers frozen

Red flags your team should treat as stop signs

What happens on the call What your team does
Urgency plus secrecy ("do this now, tell no one")Stop. Urgent and confidential is the attacker's signature, not the owner's.
Any change to payment details or wire instructionsCallback rule, using the number on file, every time, no exceptions.
Pressure to skip the normal approval stepThe skip request is itself the red flag. Dual approval stands.
Caller refuses or dodges the code wordEnd the call. Report it internally the same hour.
Video call participant with odd lighting, lag, or flat affectAsk them to turn their head or answer something only they would know. Verify out of band before acting.

One more exposure worth reducing: the raw material. McAfee’s research on voice cloning documented that a workable clone needs only a few seconds of clean audio. You cannot remove the owner’s conference talks or the firm’s marketing videos from the internet, and you should not try. What you can do is stop treating voice as identity, which is what the three controls above accomplish.

If your firm is also rolling out AI tools internally, the impersonation risk connects directly to the agent and automation risks we broke down in our AI agent security guide. The same attackers use both doors.

If money already moved: the first two hours

Recovery is a race. In 2025 the FBI’s Recovery Asset Team ran its Financial Fraud Kill Chain on 3,900 incidents and froze $679 million of $1.16 billion in attempted thefts, a 58 percent success rate. That rate exists because those victims moved fast.

The sequence: call your bank’s fraud department immediately and request a recall and a freeze on the receiving account. File at ic3.gov with the complete wire details in the same sitting, because the FBI’s kill chain process starts from that complaint. Then notify your insurer if you carry cyber or crime coverage. Hours matter more than anything else on this list.

The bottom line

Deepfake fraud is the first attack category where the fake is, for practical purposes, perfect. Training people to “spot the deepfake” is a losing bet, and buying enterprise detection is the wrong spend for a small firm. The winning move is boring: make your payment process assume every voice could be fake, and verify through a channel the attacker cannot reach. Callback rule, code word, dual approval. One afternoon to set up. It would have stopped a $25 million loss at a global engineering firm, and it will stop the $40,000 version aimed at you.

For the voice channel specifically, the Voice Cloning & Deepfake Audio Defense: Protection Plan ($47) packages the callback scripts, code word setup, and finance team training into ready-to-use documents. If you want the wider picture across video and synthetic media, the Deepfake Detection & Defense for Business: 2026 Guide ($47) covers it.

Sources