What Are Deepfakes and How to Protect Your Business

What a deepfake is

A deepfake is a photo, video or audio clip created or altered by a neural network to look and sound like a real person. The name combines "deep learning" and "fake".

The main types:

For a business, a deepfake is dangerous not as internet entertainment but as a tool for social engineering and bypassing identity checks.

Real attack scenarios

The fake CEO call. Someone in finance gets a call from the "CEO" in the CEO's voice, or the CEO's face joins a video meeting, asking for an urgent payment. This is often paired with a spoofed email so the request looks approved.

Forged KYC selfies. During remote account opening, loan applications or platform sign-up, a fraudster uploads a generated face or feeds a stream from a "virtual camera" instead of a real image.

Fake candidates. In remote interviews, a person uses someone else's face or voice to get hired and gain access to internal systems.

Brand impersonation. A video of the "founder" promoting a dubious investment, or a fake support message that misleads customers.

Blackmail and reputation attacks. Fabricated recordings presented as leaks.

Why spotting them "by eye" no longer works

Early deepfakes gave themselves away with blurry face edges, odd blinking and lip-sync lag. Modern models have removed many of these artifacts, and the compression of video calls and phone lines hides the rest. So protection must rely on procedures, not on an employee's ability to notice a fake.

Verification procedures inside the company

• Independent confirmation channel. Any request for payments, bank detail changes or access grants is confirmed through a known contact: a call to the number in the directory, a message in the corporate messenger.
• Two approvals for critical operations. No one makes a large payment alone, even at the CEO's request.
• Code words and challenge questions for unusual situations, never discussed in open channels.
• The right to say "stop". Staff must not fear double-checking an executive's request — put this in your policies.
• Training with examples. Show the team what modern deepfakes look and sound like, and walk through typical pressure scenarios.
• An incident plan. Who to report a suspicious call to, how to freeze a payment, how to warn customers about brand impersonation.

Liveness checks in remote identity verification

Liveness detection verifies that a live person is in front of the camera — not a photo, a recording, a mask or a generated image.

• Active checks: the user is asked to turn their head, blink or say a random phrase. Randomness prevents preparing a response in advance.
• Passive checks: the system analyzes a single frame or short video for signs of spoofing with no user action. More convenient, but it depends on a strong vendor.
• Injection attack protection: checking that video comes from the device's real camera and not from an emulator or virtual camera. This is a separate layer that teams often forget.
• Document matching: the face is compared with the ID photo, and the document itself is checked for signs of forgery.

When choosing a solution, check whether the vendor has passed independent presentation attack testing (for example, against ISO/IEC 30107-3), and plan for manual review of borderline cases.

Common mistakes

• Relying on a deepfake detector alone, without procedures.
• Checking selfies but not defending against virtual cameras.
• Treating a video call as sufficient proof of identity.
• Making "exceptions for the CEO" — exactly what fraudsters exploit.