If it has happened
If your organisation has sent money to a deepfake fraudster
Contact your bank first and report to the police. What follows is practical groundwork, so that the response is calm and the loss is not repeated.
Last reviewed against Building, Government Office for Science (UK Government) and The Register. Sources
First steps
In the first hour
UK Finance's advice is to contact your bank immediately if you think you have been scammed, and to report the fraud to the police through Report Fraud at reportfraud.police.uk or on 0300 123 2040 [4]. Ask to speak to someone who can act on a payment that has already left, such as the bank's fraud team.
-
1
Phone your bank using the number you already hold, and say it is a payment fraud. -
2
Give the payment details: amount, date, time, the account it went to and who approved it. -
3
Report to Report Fraud [4]. -
4
Tell your own security lead or incident owner, and any cyber insurer you have. -
5
Keep everything: call logs, recordings, messages, meeting invitations and the payment record.
Afterwards
What to establish
Ask what happened, not who to blame. Arup said that none of its internal systems were compromised in its fraud [1], and a deepfake case can look the same: the failure was in the process, not the network. Even so, confirm that no accounts were taken over before you rule it out.
Check the channel
Find out how the request arrived and whether any account, mailbox or phone number was involved.
Check other payments
Review recent payee changes and payments for the same account or the same requester.
Check who else was contacted
Impersonators often approach more than one person. Warn finance, HR and the service desk.
Learning
Closing the gap
UK Finance reported that banks reimbursed £354.3 million, or 61%, of authorised push payment losses in 2025 [4]. That is a figure for all victims, so do not assume your loss will be recovered.
Use the incident to rebuild the control. See payment approval checks and how to stop deepfake fraud.
Keep reading
Read next
What is it?
What deepfake fraud is, how it differs from ordinary phishing and invoice fraud, and the forms it takes against UK organisations.
Read the guide
How common?
How common deepfake fraud is: the government estimate of deepfakes shared, a Gartner survey, UK Finance totals and what none of them can tell you.
Read the guide
Detection
Whether deepfakes can be reliably detected, what the UK government is testing, what experts doubt and why process controls matter more than tools.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Deepfake fraud is stopped by decisions about who may release money or access and how a request is confirmed. A virtual CISO helps leaders set those rules and have them tested, without a full-time hire.