How to Respond to a Deepfake-Enabled Fraud Attempt

Deepfake-enabled fraud is moving from a theoretical concern to an operational one. We are seeing cases in Australia where AI-generated audio and video have been used to impersonate executives, instruct finance staff to make transfers, and authorise actions that the real executive never approved. The attacks are sophisticated enough that staff who were well-trained against traditional phishing have been deceived. The reason is that the attack does not rely on the technical indicators that training has conditioned people to look for.

Traditional business email compromise investigations start with email headers, sender domains, and the digital artefacts of an account compromise or spoofing attempt. Deepfake-enabled fraud may arrive through a video call, a voice message, or an audio clip that appears to come from a known and trusted individual. The digital artefacts are different, and in some cases they are minimal. Responding to these incidents requires understanding what evidence does exist and what investigative approach is appropriate.

What a Deepfake-Enabled Fraud Investigation Involves

The starting point is the same as any fraud investigation: establish what happened, when, and what was authorised or transferred as a result. The financial transaction or action that resulted from the fraud is typically well-documented through payment systems, authorisation records, and communications logs. Reconstructing the approval chain and identifying where the fraudulent instruction entered that chain is achievable from internal records in most cases.

The forensic challenge is in attributing the fraudulent communication itself. Where the deepfake was delivered via a technology platform, such as a video conferencing application, there may be session metadata, IP addresses, and account identifiers associated with the call. These may be fake, proxied, or associated with throwaway accounts, but they are worth collecting and preserving. Where the delivery was via a voice message or audio file, metadata attached to the file, the platform it was delivered through, and any device identifiers associated with the sender account are all relevant.

Technical Indicators in the Fraudulent Content

AI-generated audio and video, while increasingly convincing to human observers, may contain detectable artefacts. Forensic analysis of the content itself, using tools designed to detect AI generation signatures, is a standard step in deepfake investigation. These tools analyse patterns in the audio or video that are characteristic of synthetic generation, including inconsistencies in lighting, eye movement, lip synchronisation, and audio frequency patterns that differ from natural speech.

The utility of this analysis depends on the quality of the deepfake and the format in which it was preserved. High-quality deepfakes designed specifically for fraud are becoming harder to detect through automated means. Where the content has been compressed, transcoded, or captured via screen recording, the detectability is further reduced. This means deepfake detection analysis provides useful corroborating evidence where it finds positive indicators, but a negative result does not rule out AI generation. The investigation must not depend solely on technical detection.

Prevention: Making Deepfake Fraud Harder to Execute

The most effective prevention for deepfake-enabled fraud is procedural rather than technical. Verification processes that cannot be satisfied by a convincing audio or video are the primary defence:

• Out-of-band verification for any instruction that involves a financial transfer or sensitive authorisation, using a pre-established contact method that is not the channel the instruction arrived through
• Callback procedures to a known number from a verified contact list, not a number provided in the instruction
• Multi-person authorisation requirements for transfers above defined thresholds
• Predefined code words or challenge questions agreed with executives in advance, used to verify identity in video or voice communications
• Policies that explicitly state executives will never request urgent transfers outside normal channels, regardless of the apparent circumstances
• Staff training on deepfake fraud that specifically addresses why visual and audio confirmation is no longer sufficient

The code word approach is particularly practical because it is simple to implement, cannot be defeated by a deepfake without prior knowledge of the code, and does not require technical investment. Agreeing a shared verification phrase with key executives takes minutes and provides meaningful resistance to impersonation.

Post-Incident Response and Recovery

Where a deepfake-enabled fraud has resulted in a financial transfer, the immediate priority is bank contact to attempt recall of the funds. Time is critical; the longer the delay, the less likely recovery is. Most Australian banks have fraud response procedures for urgent recall requests, and providing evidence that the authorisation was obtained by fraud strengthens the case. Involving your bank's fraud team and, where appropriate, the Australian Federal Police and AUSTRAC, is part of the response process.

From an internal perspective, the post-incident response should address the verification procedures that failed and implement procedural controls before resuming normal operations. Where the attack suggests the organisation was specifically targeted, understanding how the attackers sourced high-quality voice or video samples of the impersonated individual is also worth investigating. Publicly available video content, conference recordings, and media appearances are frequently the source material for executive impersonation deepfakes.

If your organisation has been targeted by deepfake-enabled fraud or you want to assess your verification procedures and response readiness, contact the Cyberlinx team at info@cyberlinx.com.au.