Check your exposure
Check whether deepfake fraud could work against you
Any organisation where a call or video meeting can lead to money moving or access changing is exposed. The question is how many checks stand between a convincing fake and the action.
Last reviewed against Building, Government Office for Science (UK Government) and The Register. Sources
Money
Where a request can release funds
List every route by which a person can ask for money to move: new payees, changed supplier bank details, urgent transfers, payroll changes and refunds. Report Fraud's advice on payment diversion is to use a verification process involving more than one person before any funds transfer [10]. If one person can act alone on a phone call or a video meeting, that route is exposed.
Check these as well:
- Whether a bank detail change needs confirmation on a different channel from the one it arrived on
- Whether a request that says "do not tell anyone yet" would be questioned
- Whether finance staff can reach an executive quickly by a known number to confirm
- Whether out-of-hours approvals have the same checks as daytime ones
Access
Where identity is taken on trust
Service desks, HR teams and executive assistants often act on a voice or a face. The NCSC advises that important requests are verified using a second type of communication, such as a phone call, a text or logging into an account [8]. If a password reset or payroll change could proceed after one call, an impersonator needs only to sound right.
Voices
What an attacker can copy
Report Fraud says fraudsters use fake audio clips imitating the voice of someone you know or trust [9]. Look at what your senior staff have published: talks, webinars, podcasts and recorded town halls. You cannot take these down, and you do not need to, but you should assume a voice is not proof of identity.
A quick test
Ask one finance colleague what they would do if the managing director called, sounded stressed and asked for a payment to a new account today. If the answer is "pay it", the process has a gap.
Evidence
How common the exposure is
In the 2025/2026 government survey, 12% of businesses reported impersonation breaches or attacks, down from 17% in 2023 [6]. Phishing was the most common attack, reaching 38% of businesses [6]. The survey does not say how much of either involved synthetic media, so use it as a measure of how often people try to impersonate others, not of deepfakes in particular [6].
Next: how to stop deepfake fraud turns each gap into an action.
Am I affected?
Answer a few questions
Check if you are affected
Answer three questions about how money and access move in your organisation. Nothing you answer leaves this page.
Could a payment, or a change to a payee's bank details, go ahead on the strength of a phone call, voice note or video meeting alone?
What is affected
The software and products in scope
Staff who approve or release payments[1]
In the Arup case an employee sent money after a video call with people posing as senior officers.
Finance teams that change supplier or payee bank details[10]
Report Fraud advises a verification process involving more than one person before any funds transfer.
Service desks and HR teams that act on a phone request[8]
The NCSC advises confirming important requests through a second type of communication.
Anyone whose voice is easy to find online[9]
Report Fraud describes fraudsters generating fake audio clips that imitate a voice the victim trusts.
Organisations whose staff take calls from people claiming to be executives[7]
Gartner's survey found deepfake audio calls were the most commonly reported of the attacks it asked about.
Keep reading
Read next
How to stop it
An ordered plan to stop deepfake fraud: second-channel checks, call-backs, blame-free reporting, rehearsals and a ready response if money has moved.
Read the guide
Timeline
A dated, sourced timeline of deepfake fraud for UK organisations, from the Arup video call case in 2024 to UK Finance's 2026 fraud figures.
Read the guide
Video call fraud
How a video meeting full of fake colleagues led to HK$200m being sent to criminals, what Arup and police said, and which checks would have intervened.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Deepfake fraud is stopped by decisions about who may release money or access and how a request is confirmed. A virtual CISO helps leaders set those rules and have them tested, without a full-time hire.