Defence plan
How to stop deepfake fraud in your organisation
There is no patch for a convincing fake. The defence is a short list of checks, applied to the few processes where money or access can move, that hold even when nobody notices the fake.
Last reviewed against Building, Government Office for Science (UK Government) and The Register. Sources
Principle
Make the process do the work
Training people to spot fakes helps, but it cannot be the only layer. The NCSC makes the same point about phishing: use several layers, and do not rely mainly on user training, because some attacks will get through [8]. The aim here is a process in which a perfect fake still cannot release money on its own.
The order
Where to put effort first
-
1
Choose the processes where a request can release money or change access. -
2
For each, require confirmation through contact details you already hold. -
3
Require more than one person to approve transfers above a limit you set [10]. -
4
Write the rule down and tell staff they will not be blamed for pausing [8]. -
5
Test the rule with a realistic fake request and fix what fails. -
6
Record who to call at the bank and the police if money has gone [4].
Judgement
Where leaders go wrong
Waiting for detection tools to solve it
The government is testing detection tools against impersonation, fraud and non-consensual images, and intends the results to set standards for industry [2]. A commentator quoted by The Register doubted the plan would bring systemic improvements soon [3]. Do not make your control depend on a tool you cannot yet rely on. See can deepfakes be detected.
Using the caller's own number
Report Fraud advises hanging up and calling back on contact details you know are correct, and not trusting caller ID [9]. A number supplied during the call, or one in the message that asked you to ring, defeats the point.
Checking only on the first request
An attacker who is refused may try again through another person or channel. Keep the rule the same across email, phone, messaging and video.
Start here
Take the riskiest payment or reset process, write its second check on one page, then ask a colleague to try to get round it.
To go deeper, read payment approval checks and how to spot a deepfake call.
What to do
Six steps, in order
-
Step 1
Add a second check to payments and bank detail changes[10]
Require confirmation through contact details you already hold before a new payee is set up, bank details change or an urgent transfer is released. Involve more than one person in the approval.
Who: Finance and procurement teams
-
Step 2
Call back on a number you already know[9]
If a call, voice note or video meeting asks for money or access, end it and ring back on contact details you already hold. Do not rely on caller ID or on a number the caller supplies.
Who: All staff, especially finance, HR and the service desk
-
Step 3
Verify important requests by a second type of communication[8]
Treat a request on one channel as unconfirmed until it is checked on another, for example a phone call to someone you know, and make sure staff know how payments normally work so unusual requests stand out.
Who: Managers and security leads
-
Step 4
Make it safe to stop and ask[8]
Tell staff that pausing a request from a senior person is expected, and that nobody is reprimanded for being unable to spot a fake. Fear of blame discourages quick reporting.
Who: Directors and managers
-
Step 5
Rehearse a fake executive request[8]
Run an internal exercise in which someone posing as a senior colleague asks for an urgent payment or reset, and fix the points where staff would have complied. Plan for the fact that some attacks will get through.
Who: Security leads and finance leads
-
Step 6
Know who to call if money has gone[4]
Write down the bank contact for urgent calls and the route for reporting to the police, before you need them. UK Finance advises contacting your bank immediately and reporting to Report Fraud.
Who: Finance leads and incident owners
Keep reading
Read next
Timeline
A dated, sourced timeline of deepfake fraud for UK organisations, from the Arup video call case in 2024 to UK Finance's 2026 fraud figures.
Read the guide
Video call fraud
How a video meeting full of fake colleagues led to HK$200m being sent to criminals, what Arup and police said, and which checks would have intervened.
Read the guide
Voice cloning
How criminals clone a voice to ask for urgent payments, what Report Fraud and Gartner say, and the call-back rules that defeat a convincing voice.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Deepfake fraud is stopped by decisions about who may release money or access and how a request is confirmed. A virtual CISO helps leaders set those rules and have them tested, without a full-time hire.