Deepfakes are AI-generated synthetic media — realistic-looking videos, audio, or images of real people saying or doing things they never did. In business contexts, deepfake technology is increasingly used for CEO impersonation in video calls, fraudulent voice-based payment authorisations, and social engineering attacks that bypass traditional identity verification methods.
What Types of Deepfake Attacks Target Businesses?
Deepfake-powered business fraud has evolved beyond simple email phishing into sophisticated, multi-channel attacks:
- CEO fraud via video calls: Attackers create real-time deepfake video of a company executive on a video call, instructing employees to transfer funds or share confidential data.
- Voice cloning for payment authorisation: Using a few seconds of a person’s public speech (from YouTube, podcasts, or social media), attackers clone their voice and call finance teams to authorise wire transfers.
- Fake employee onboarding: Deepfake technology used during remote hiring video interviews to impersonate candidates, gaining access to company systems.
- Reputation attacks: Fabricated videos of company executives making controversial statements, designed to damage brand reputation or manipulate stock prices.
- Fake customer complaints: AI-generated audio or video of “customers” making false complaints on social media to damage a competitor’s reputation.
How to Recognise a Deepfake in Real Time
While deepfake quality is improving rapidly, current technology still leaves detectable artefacts:
- Unnatural eye movements: Deepfakes often struggle with consistent eye contact and natural blinking patterns.
- Lip-sync inconsistencies: Audio and lip movements may be slightly out of sync, especially with complex words.
- Lighting and shadow mismatches: The face may have different lighting than the body or background.
- Audio quality shifts: Cloned voice audio may have subtle background noise differences or tonal inconsistencies compared to the real person.
- Unusual requests: Any video or voice call requesting urgent fund transfers, password sharing, or confidential data access should trigger verification — regardless of who appears to be making the request.
What Verification Protocols Should Businesses Implement?
The most effective defence against deepfake fraud is not technical detection — it is process-based verification:
- Multi-channel verification: If a video or phone call requests a financial transaction, verify through a separate channel. Call the person back on their known phone number, or send a verification message through a pre-agreed secure channel.
- Code word systems: Establish a rotating code word that must be provided during any call authorising transactions above a set amount.
- Dual authorisation: Require two authorised individuals to approve any financial transaction above a threshold — reducing the risk that a single compromised identity leads to loss.
- Transaction delays: Implement mandatory waiting periods for large, unusual, or first-time transactions. Urgency is the primary tool of deepfake fraud.
- Employee training: Regular awareness training that includes examples of deepfake attacks and hands-on exercises in recognising them.
How Can Indian Businesses Prepare for Growing Deepfake Threats?
India is experiencing a rapid increase in deepfake-related fraud, driven by widespread digital adoption and the availability of inexpensive AI tools. Businesses should:
- Include deepfake awareness in mandatory employee cyber security training.
- Review and update payment authorisation workflows to include out-of-band verification.
- Limit the amount of executive audio and video publicly available — reduce unnecessary podcast appearances, public speeches, and social media video content.
- Work with your cyber security team or consultant to assess your organisation’s vulnerability to deepfake-based social engineering.
- Stay informed about India’s evolving regulatory framework around AI-generated content and synthetic media.
Frequently Asked Questions
How common are deepfake attacks on businesses in India?
Deepfake fraud targeting Indian businesses is increasing as AI tools become more accessible. While exact figures are not publicly available, industry reports suggest that voice cloning attacks on financial transactions are the fastest-growing category.
Can deepfake detection software reliably identify fakes?
Detection technology is improving but is not foolproof, especially against the latest generation of deepfakes. Process-based verification (code words, dual authorisation, callback verification) remains more reliable than technical detection alone.
Is creating a deepfake illegal in India?
India does not have a specific deepfake law as of October 2026, but creating and distributing deepfakes can be prosecuted under the IT Act 2000 (sections on impersonation, cheating, and defamation), the Indian Penal Code, and the DPDP Act 2023 for personal data misuse. Regulations are evolving.
What should I do if my company is targeted by a deepfake?
Immediately alert your team not to act on the fraudulent communication, report to local cyber crime authorities, preserve evidence (recordings, screenshots, logs), notify your bank if financial transactions were attempted, and engage a cyber security professional to investigate the attack vector.
