You will have been hearing the term “deepfakes” a lot recently. And understandably you might think it’s just media hype. But unfortunately it’s not. Deepfake fraud is increasing at pace, with millions of synthetic media files now in circulation and attacks rising sharply worldwide.
What’s changed is accessibility. Tools that once required specialist knowledge are now widely available, lowering the barrier for cybercriminals to exploit them. Most organisations understand that deepfakes are a risk. Fewer understand how they actually work or how easily they can be used against them.
What are deepfakes?
Well, put simply, it’s AI-generated media (video, audio, or images) designed to convincingly imitate a real person. Rather than simply editing existing content, it creates entirely new material that closely matches someone’s appearance or voice. The end result is content that looks and sounds authentic, even though it’s completely fabricated.
How do deepfakes work?
At the core of deepfakes is machine learning. AI models are trained using real-world data (images, recordings, or video footage). Over time, the system learns the patterns that make a person recognisable, such as facial movements or vocal tone. Once trained, the model can generate new content that follows those same patterns. Very little data is now needed. In some cases, just a few seconds of audio is enough to produce a convincing voice clone.
Types of deepfakes
Deepfakes show up in multiple formats, depending on the attacker’s goal:
- Voice cloning – phone calls or voicemails that sound like someone you trust
Video deepfakes – manipulated recordings or entirely synthetic video calls
- Image manipulation – altered or generated photos used for fraud or impersonation
Voice-based attacks are currently among the fastest growing, largely because they rely on human instinct rather than technical vulnerabilities.
How deepfakes impact business
Deepfakes don’t need to bypass firewalls as they target people directly. That creates several risks including financial loss through fraudulent transactions, exposure of sensitive information, reputational damage from fabricated content, and reduced trust in internal and external communications. Many organisations are still building their response. A relatively small proportion report being well prepared for AI-driven fraud.
How deepfakes affect individuals
The same techniques are now being used against individuals as well. Attackers can impersonate family members, colleagues, or trusted contacts to request money or information. Deepfakes are also being used to bypass identity verification systems and create convincing fake identities. More broadly, they challenge something fundamental – our ability to trust what we see and hear online.
6 steps to protecting yourself from deepfakes
Defending against deepfakes requires both technical and behavioural changes.
Introduce verification protocols – Sensitive requests should always be confirmed through a second, independent channel.
Train everyone to pause and question – Unusual urgency or out-of-character requests should trigger verification, not action.
- Limit publicly available exposure – Executive interviews, videos, and audio can be used to train AI models.
- Strengthen security foundations – Deepfake attacks often sit alongside phishing or account compromise.
- Build a “trust but verify” culture – Familiarity can no longer be treated as proof of authenticity.
- Protect yourself and your family – A simple but highly effective safeguard is to agree offline on a family “safe word.” Choose a word or phrase only your immediate family knows and use it to verify urgent or unusual requests (especially involving money or personal information). For example:“Of course I can help – just confirm our family safe word first.” If it is ever used in a real scenario, agree to change it afterward.
The trust problem
Deepfakes represent a shift in how cyber attacks work. Rather than targeting systems alone, they target human perception. That means resilience isn’t just about better tools, it’s about better processes. Organisations that recognise this early will be far better positioned to respond as these attacks continue to evolve. If you’re concerned about your business resilience, our cyber security experts are only too happy to help. Don’t hesitate to contact us for more information.
