Skip to content
Akademia
Book a demo

Deepfake: what it is, how to spot one and how a company should verify instructions

What is a deepfake? Real business cases: a fake CFO on a video call, voice cloning, a ghost job candidate. Plus a procedure for verifying payment instructions.

ZeroLayer Team 13 min read

A dark navy office at night, a monitor showing a video call with a man in a suit whose face is gently breaking up into turquoise pixels

A deepfake is an image, voice recording or video generated or altered by artificial intelligence that imitates a real person and could be taken as genuine. For a business, this means a very specific risk: a video call with a "CFO" who never joined, a voice message from the "CEO" or a job candidate wearing someone else's face. In this guide you will learn how a deepfake is made, how to spot one and why a simple procedure for verifying instructions matters more than spotting fakes.

Deepfake: what it is and where the name comes from

The name combines two English words: "deep learning" (a type of machine learning based on neural networks) and "fake". A deepfake can take three forms:

  • video, in which someone says or does things they never said or did,
  • voice, that is the cloned speech of a specific person, used in phone calls and voice messages,
  • image, for example a profile photo, a scanned document or a photo "from the scene".

The EU Artificial Intelligence Act (AI Act) describes a deepfake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would "falsely appear to a person to be authentic or truthful". It is a good definition for a company policy because it focuses on the effect: someone is meant to believe they are talking to a real person.

HK$200m
transferred in 15 transactions after a video call with a fake CFO (Arup, Hong Kong)
Hong Kong Free Press / AFP, 5 February 2024
139+
public figures whose likeness was used in fake ads on Meta platforms
CERT Polska, November 2024
A few seconds
of recorded voice is enough for cloning with text-to-speech technology
NASK, May 2024

How a deepfake is made

We will not give instructions here, but it is worth understanding what a fraudster relies on. They need source material: video and voice recordings of the person they want to impersonate. For CEOs, directors and mayors this is usually no problem, because conference talks, interviews and webinars are publicly available on YouTube or LinkedIn.

Ewelina Bartuzi-Trokielewicz from the NASK team that analyses deepfakes explained that with text-to-speech technology, fraudsters need "just a few seconds of recorded voice". With speech-to-speech technology, which better captures intonation and emotion, about a minute of original material is needed. The conclusion for your company is simple: the voice of anyone who has ever spoken in public can be faked.

An important detail from real attacks: a deepfake does not have to be interactive. In the Hong Kong case, the police said the videos of the fake meeting participants had been recorded in advance and did not hold a conversation with the victim. So the fraudster does not need perfect technology. A few minutes of convincing footage and strong pressure are enough.

Deepfakes in business: examples from recent years

When you look for deepfake examples, it is easy to come across videos of politicians and celebrities. For a company, the more dangerous scenarios are those where the target is a transfer, data or access to systems.

Arup: a video call with a fake CFO

In January 2024, a finance employee at the Hong Kong office of the British engineering firm Arup received a message about a "confidential transaction" from someone claiming to be the chief financial officer in the UK. At first he suspected phishing. A video call dispelled his doubts: on screen he saw the CFO and several colleagues who looked and sounded like people he knew.

According to the Hong Kong police, all the participants apart from the victim were fake, and the fraudsters used publicly available recordings from YouTube. The employee made 15 transfers to five accounts, totalling around HK$200 million (about US$26 million). The fraud came to light only when he contacted head office. Arup confirmed that "fake voices and images were used" and that its internal systems had not been compromised.

This case shows something important: no technical safeguard was broken here. All it took was a process in which one person could make large transfers on the basis of an online meeting.

WPP: a cloned voice and YouTube footage

In May 2024, the media reported an attempted fraud targeting the advertising group WPP. The fraudsters set up a WhatsApp account using a public photo of CEO Mark Read and used it to arrange a Microsoft Teams meeting. During the meeting they used the cloned voice of one of the executives and video material from YouTube. The aim was to persuade the head of one of the agencies to set up a new business and, along the way, to extract money and personal details.

The attack failed. The company highlighted its employees' vigilance, and Read warned senior staff to watch out for techniques that go beyond email and exploit video meetings, AI and deepfakes.

A fake candidate in a job interview

Deepfakes are reaching HR departments too. As early as 2022, the FBI warned about candidates who used deepfakes and stolen personal data in remote job interviews. These were mainly IT and programming roles with access to customer data, financial data or company databases. The FBI pointed to two signs: lip movements did not match the audio, and coughing or sneezing did not line up with the video.

For a company, what is at stake is not one salary but the access to systems that the "new employee" receives on day one.

A fake supplier

The same mechanism works with suppliers. The scenario is easy to imagine: the accounts team receives an email about a new bank account number, and when they want to confirm it, they get a call from an "account manager" with a familiar voice. If the procedure only says "confirm by phone" rather than "call back on the number in the contract", a cloned voice will get through. You can read more about CEO fraud and fake invoices in the article on spear phishing and whaling.

Poland: well-known faces in fake ads

In Poland, deepfakes are most often seen in ads for fake investments. CERT Polska has described, among other things, a fake "review" of an investment platform using the likeness and voice of entrepreneur Rafał Brzoska, as well as research showing that the likenesses of more than 139 public figures were used in ads on Meta platforms. In September 2026, CERT Polska warned about another campaign in which fraudsters combine the likenesses of well-known people, company logos and AI-generated videos. After the click, the victim is taken over by an "adviser" who urges them to pay in money, and later sometimes asks them to install remote desktop software.

This is not purely a private problem. An employee who installs such software on a work laptop at the request of an "adviser" opens the way into the company network.

How to spot a deepfake video and voice

Before we get to the list, a fair caveat: spotting fakes "by eye" works less and less well. In its warning of May 2025, the FBI stated plainly that cloned voices can sound almost identical to real people. Treat the signs below as a reason to stop and verify, not as a test that a deepfake must fail.

Signs in the image

NASK and the FBI list similar signs:

  • a blurred or distorted mouth area, poorly rendered teeth,
  • changing face geometry, unnatural head movements and facial expressions,
  • lip movements and gestures that do not match the words,
  • strange shadows, distorted hands,
  • added noise and blotches that may mask generation errors.

Signs in the voice

  • robotic or unusual intonation, changes in accent, tone or pitch during speech,
  • mispronounced numbers, dates, amounts and proper names,
  • unusual word choices or delays in the conversation.

A simple trick: ask a question the recording is not prepared for, or ask for something unexpected, for example switching to a matter only the two of you know about. Remember that in Hong Kong the videos were recorded in advance and did not interact.

Signs in the request itself

These are the most reliable, because they do not depend on the quality of the technology:

  • urgency and time pressure ("it has to go out today by 3 pm"),
  • confidentiality ("don't tell anyone, this is a secret transaction"),
  • a request to bypass the usual approval path,
  • a change of communication channel, for example moving to a private messenger,
  • a request for money, personal data, codes or installing software.

"Urgent and confidential" together is a red flag, however convincing the face on the screen looks.

Why a verification procedure matters more than detection

The technology will keep getting better, and your employees will not become image analysis experts. So instead of teaching the team to recognise every fake, agree on a few rules that work regardless of how good the deepfake is:

  1. Call back on a known number. You confirm every unusual instruction involving money or data by calling the number in the company directory or the contract yourself. Never the number given in the same message. The FBI advises the same: contact via a number you find independently.
  2. A check question or code word. The FBI recommends agreeing a secret word or phrase with family members. In a company, the same idea works for the management board and finance, as long as the code word is not circulated by email.
  3. The two-person rule. A transfer above an agreed amount, a change to a supplier's account number or a new payee requires approval from a second person. In the Arup case, one person was able to make 15 transfers.
  4. No "video only" instructions. A video call, voice message or chat is not a basis for making a transfer. The instruction has to go through the normal document workflow.
  5. The right to refuse. Employees must know that nobody will punish them for refusing to carry out an urgent instruction without verification, even if the "CEO" turns out to be real.

A detailed comparison of caller verification methods, with how well each resists impersonation, can be found in our analysis of vishing as the number one threat. The manipulation mechanism behind each of these attacks is described in the article on social engineering.

ScenarioRed flagFirst step
Video call with a "director" about a transferconfidential transaction, rushend the call, call back on the number in the company directory
Voice message from the "CEO" on a messaging appnew number or new channelconfirm via a known channel, ask for the code word
Candidate in a remote interviewvideo does not match audioin-person meeting or document check by HR
Supplier's "account manager" changes the bank account numberrequest for a quick updatecall back on the number in the contract, a second person approves

Deepfakes and the AI Act

On the legal side, one provision is worth knowing. Article 50(4) of the AI Act requires deployers of AI systems that generate or manipulate image, audio or video content constituting a deepfake to disclose that the content has been artificially generated or manipulated. Under Article 113, the regulation applies, as a general rule, from 2 August 2026. Of course this provision will not stop a fraudster, but if your company itself creates material with a synthetic voice or likeness, such as marketing or training videos, it must label it. We write about the rules for using AI tools at work in the article on safe AI use.

How to practise this as a team

A procedure nobody has practised will not work under stress. A few formats you can introduce straight away:

  • A role-play for finance (15 minutes). Someone from the team plays the "CEO" calling with a request for an urgent, confidential transfer. The participant practises ending the call and calling back. The hardest part usually turns out to be simply saying "I'll call you back".
  • A deepfake demo at a meeting. A short, lawfully prepared example, ideally featuring a member of the management board who agrees to the use of their likeness. The team sees that this is not just a problem for "celebrities".
  • Agreeing a code word for the management board and finance, with a rule that it is changed, for example, once a quarter.
  • A checklist for HR for remote recruitment into roles with access to data: document verification, contacting the previous employer via a number you find yourself, and an in-person meeting if in doubt.
  • A reporting channel. You report every suspicious call or video call internally. In Poland, a deepfake online using the likeness of a well-known person can be reported to CERT Polska via incydent.cert.pl or by text message to 8080.

If your company still uses password-only sign-in, start with the basics: a compromised email account gives the fraudster a credible channel from which to send the "urgent request" before the deepfake call. The articles on two-step verification and the general rules in the article on cyber hygiene at work will help with this.

How it works in ZeroLayer Academy

ZeroLayer Academy combines video micro-lessons, games and quizzes with phishing simulations, and automatic reminders make sure learning does not end after a single session. We build awareness of video deepfakes in the form of a team workshop rather than a simulation. You will find the full list of topics in the training topics section.

If you want to test your team's resilience in practice, the "Academy + Tests" option includes social engineering tests with deepfakes and vishing. The manager's dashboard shows departments' progress and generates training reports, employees receive numbered certificates, and the onboarding path covers new starters from day one. Role-based paths let you tailor the material to finance, HR or the management board. You will find the available options, starting with a free 30-day pilot for one department, in the Options section.

FAQ

What is a deepfake in simple terms?

A deepfake is a fake video, voice recording or photo generated by artificial intelligence to look like a real person. The name comes from the English words "deep learning" and "fake". In companies, deepfakes are most often used to impersonate managers and suppliers in order to obtain a transfer or data.

How do you spot a deepfake?

In the image, look for a blurred mouth area, poorly rendered teeth, unnatural facial expressions and lip movements that do not match the sound. In the voice, listen for robotic intonation and mispronounced numbers and names. The most reliable sign, however, is the content: an urgent, confidential request for money or data. Because the technology is improving quickly, verify every such instruction by calling back on a known number.

What is voice cloning?

Voice cloning is the use of AI to create synthetic speech that sounds like a specific person. According to NASK, a few seconds of recording are enough with text-to-speech technology, and about a minute with the more advanced speech-to-speech technology. Fraudsters use a cloned voice in phone calls and voice messages, impersonating managers, suppliers or family members.

Is a video call enough to confirm a payment instruction?

No. The Arup case showed that an entire video call with several participants can be faked. Confirm a payment instruction through a different channel: call back on the number in the company directory or the contract, and for larger amounts require approval from a second person.

Where can I report a deepfake?

In Poland, online fraud, including a fake ad using the likeness of a well-known person, can be reported to CERT Polska through the form at incydent.cert.pl or by text message to 8080. Also report it to the administrator of the platform where you saw it. Report an attempted fraud targeting your company internally first, to the IT or security department, and if money has been lost, to your bank and the police without delay.

Sources

Read next