What is a deepfake?
A deepfake is a piece of synthetic media, most often a voice recording, video, or photograph, in which generative AI makes a real person appear to say or do something that never happened. The name combines “deep learning” and “fake.” Early deepfakes were built with generative adversarial networks that swapped one face onto another. Current tools can clone a voice from a few seconds of recorded speech, animate a still photograph to match a script, or generate a live video feed that follows an impersonator’s movements in real time.
The quality that matters is plausibility in the moment. A cloned voice on a noisy phone line, delivered under time pressure, deceives most listeners.
Why deepfakes matter
For a business the primary risk is fraud and social engineering. Attackers impersonate an executive to authorize a wire transfer, impersonate a supplier to change payment details, or impersonate an employee to get a help desk to reset a password. The second risk is reputational, because fabricated video of a company leader can circulate faster than a correction. The third is evidentiary: recordings used in disputes, claims, and investigations can no longer be taken at face value. Deepfakes also fall under the transparency obligations of the EU AI Act, which require that AI-generated or manipulated media be labeled as such.
Deepfake in practice
The finance team of a mid-sized manufacturer receives a video call from someone who looks and sounds like the chief financial officer, asking for an urgent payment to a new vendor before a deadline. The request is a deepfake. The company’s defense is procedural rather than technical. Any change to payment instructions, and any payment above a set amount, requires a callback to a known number and a second approver, no matter who asked. The same control defeats email fraud and a cloned voice alike. Detection tools and content provenance checks add a second layer, but the procedure is what holds when detection fails.
What to watch for
- Write payment and credential-reset procedures that assume voice and video can be faked, and train staff to follow them even when the caller is senior and impatient.
- Deepfake detectors give probabilities and lag behind the newest generation methods, so treat them as one signal among several.
- Decide in advance how the company will respond publicly if a fabricated recording of a leader appears.
- Limit how much clean audio and video of executives is public, since the training material for a clone is often the company’s own marketing content.