Deepfakes and Advanced Identity Deception

Business email compromise has been the highest-volume financial cybercrime for five consecutive years. In 2026, it has evolved: threat actors supplement email fraud with AI-generated voice calls and real-time video deepfakes to impersonate executives during finance team interactions.

How synthetic identity attacks are deployed

The most common pattern involves three stages: a phishing email establishing urgency around a confidential payment, a follow-up voice call from a cloned version of an executive's voice, and fraudulent wire instructions. In the most sophisticated cases, a real-time video deepfake replaces the voice call entirely.

Three detection engineering patterns

Pattern one: alert when an email uses a C-suite display name but originates from a non-DMARC-authorised domain. Pattern two: flag high-value wire requests initiated within 48 hours of an email thread containing executive names and urgency language. Pattern three: mandatory dual-authorisation via a pre-registered out-of-band number for transfers above a defined threshold.

• Build an executive display-name watchlist in your SIEM and alert on any external email using those names from non-authorised domains.
• Establish a pre-registered out-of-band verification channel for finance wire authorisation.
• Conduct a finance team tabletop exercise simulating a deepfake CEO call.
• Audit executives' publicly available voice and video content — earnings calls are training data for voice clones.
• Implement a one-time verbal codeword system for high-value transfer authorisation calls.