A deepfake is audio, video or imagery generated by artificial intelligence to impersonate a real person — their face, their voice, their mannerisms — convincingly enough to deceive. For Australian businesses the dominant risk in 2026 is voice: cloned executives calling finance staff to approve urgent payments, and fake video calls that walk an employee through a transfer or a data handover. The barrier to entry has collapsed — consumer tools clone a convincing voice from seconds of recorded audio — and the attack aims squarely at the two roles every business has: people who move money, and people who hold data.
TL;DR
- A deepfake is AI-generated audio, video or imagery that impersonates a real person.
- Voice clones are the threat that matters most: urgent payment requests delivered in a familiar voice.
- In one widely reported 2024 case, a finance employee at engineering firm Arup transferred roughly HK$200 million after a video call with deepfaked colleagues.
- Detection tools lag behind the fakes; the reliable defence is process — verify every unusual request through a second channel you already hold.
- Monthly training rehearses the cloned-voice scenario until the verification reflex beats the fake.
What is a deepfake?
Deepfakes are synthetic media produced by machine-learning models trained on real recordings. Three forms matter to businesses:
- Voice cloning. A model trained on seconds to minutes of a person's speech generates new speech in their voice, including tone and urgency. Podcasts, webinars, LinkedIn videos and conference talks supply all the training data an attacker needs.
- Video deepfakes. Face-swap and lip-sync models put one person's face on another's video, or animate a still photo to speak. Live video deepfakes — a fake face moving in real time on a video call — now run on consumer hardware.
- Image and document fakes. Synthetic ID photos, invoices and profile pictures used to pass manual verification checks.
A deepfake is an impersonation technique, not a separate crime. It plugs into the scams that already cost Australian businesses the most: business email compromise and payment redirection.
How a deepfake attack on a business works
- Collect the target's voice. Public material is usually enough — an executive's conference talk, a webinar recording, a social media video.
- Build the scenario. The attacker picks a pretext with a deadline: an urgent supplier payment, a payroll change, a confidential acquisition “nobody can know about yet”.
- Deliver it in the target's voice. A phone call, a voice note, or a video call with deepfaked faces of colleagues the employee recognises.
- Isolate and pressure. Secrecy plus urgency closes the verification loop: “don't tell anyone, this leaks tomorrow”.
The case that made boards pay attention: in early 2024, a finance employee at engineering firm Arup joined a video call in Hong Kong in which every other participant — including the company's chief financial officer — was a deepfake. Believing the call, the employee made a series of transfers totalling roughly HK$200 million, about AU$40 million. The lesson is not “AI is scary”; it is that a payment instruction arriving through a screen or a speaker is not identity.
Deepfake vs phishing vs business email compromise
| Deepfake | Phishing | BEC | |
|---|---|---|---|
| Impersonates | A person's voice or face | A trusted brand | A trusted email identity |
| Channel | Phone call, voice note, video call | Email, SMS, chat | Email thread |
| Technical tell in the moment | Often none | Lookalike domains, links | Lookalike sender domains |
| What it needs | A recording of the target | A lure | A compromised or spoofed mailbox |
| Best defence | Out-of-band verification | Trained reporting reflex | Verification and payment controls |
The defences that actually hold
- Out-of-band verification is the whole game. Any request to move money or data gets confirmed through a channel you already hold — a number on file, a walk to the person's desk — never through contact details the request itself supplies. This is the same rule that stops pretexting, because deepfakes are a pretexting tool.
- Dual approval for payments. One voice, however convincing, is not a payment authorisation. Two people approve every transfer above your threshold.
- Agreed challenge questions. Set a code word or verification question for genuine urgent executive requests. A cloned voice cannot answer a question it did not know was coming.
- Treat caller ID and voice familiarity as zero evidence. Numbers can be spoofed; voices can be cloned. Neither proves identity.
- Train the reflex. Cyber Aware's security awareness training runs monthly, story-driven modules, and the deepfake voice scam guide drills the verify-by-second-channel habit until it is automatic.
Why training is the control
Detection software exists, but it plays catch-up: generation models improve faster than detectors, and a live call gives no one time to run analysis. The control that survives a perfect fake is human process — callback rules, dual approval, and a workforce that treats “familiar voice plus urgent payment” as a mandatory verification trigger, not a reason to act. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 shows payment redirection and business email compromise among the costliest attack types Australian businesses report; deepfakes supercharge exactly those attacks, which is why the verification habit is worth rehearsing monthly rather than mentioning once a year.
FAQ
What is a deepfake in simple terms? Fake audio, video or imagery generated by AI to look and sound like a real person. In 2026 the business risk is mostly cloned voices used to push urgent payment or data requests.
How are deepfakes used to scam businesses? An attacker clones an executive's voice from public recordings, then calls or video-calls staff with an urgent payment instruction, using urgency and secrecy to stop anyone verifying. The Arup case — roughly HK$200 million lost to a deepfaked video call — is the template.
Can you detect a deepfake voice call? Often not in the moment. Detection tools exist but lag behind generation quality. Assume a convincing voice or face is no evidence of identity, and verify through a second channel instead.
What is the best defence against deepfake scams? Out-of-band verification backed by dual approval for payments. No AI defence beats a rule that says every unusual payment instruction gets a callback to a number already on file.
Are deepfake scams common in Australia? Voice-clone scams are rising with the global trend, and Scamwatch data consistently places impersonation among the highest-loss scam categories. The pattern Australian businesses report most — payment redirection and executive impersonation — is exactly what deepfakes enhance.
One last thing
Set one rule this week: no payment instruction received by phone call, voice note or video call is acted on without a callback to a number already on file. It costs two minutes per payment and defeats the entire attack class — including every future improvement in the fakes themselves.