As deepfakes become more advanced, cyberattacks are becoming more acute, creating new troubles for organizations. What once required sophisticated software and expert skills can now be accomplished with readily available AI tools. Cybercriminals can impersonate company executives, fool security systems, and manipulate employees into handing over money or data. A single convincing video call or audio message can bypass years of carefully constructed security protocols.
How do cybercriminals use deepfakes?
Cybercriminals have weaponized deepfake technology and dramatically enhanced their success rates. One of the most prevalent attacks involves creating convincing audio clips of company executives requesting urgent wire transfers or sensitive information. Phishing schemes have also evolved beyond simple email scams; attackers now create deepfake video calls that appear to show trusted colleagues or business partners requesting access credentials or confidential data. Traditional red flags, such as poor grammar or suspicious email addresses, may no longer be present, making detection much more difficult.
Deepfake-related evidence in discovery
Courts are seeing more deepfakes introduced as evidence, creating unprecedented challenges for the legal system. Evidentiary standards of authentication will need to accelerate to keep pace with this technology, as traditional methods of verifying authenticity become inadequate. Acceptance of expert witnesses in this field will be challenging, as standards and qualifications for deepfake detection remain underdeveloped. Even readily accepted concepts like chain of custody will be revisited when dealing with this type of content, since digital files can be altered without leaving obvious traces. This necessitates forensic analysis and specialized tools to determine authenticity. Digital forensic experts must examine metadata, compression artifacts, lighting inconsistencies, and other technical markers that might reveal manipulation. Advanced tools using AI to detect AI-generated content are emerging, but they face an arms race as deepfake technology continues to improve.
Your employees are still the weak link
The traditional data breach and data theft are evolving with deepfakes and AI-driven impersonations, creating vulnerabilities that even the most security-conscious employees struggle to navigate. Attackers are more believable and can automate many of their tasks, meaning both precision and frequency have increased to levels that overwhelm traditional defenses. In the past two years, major AI companies such as Anthropic, OpenAI and Google have disclosed publicly that cybercriminals are leveraging their AI systems to create breaches and develop malware.
One illustrative case involved a ‘vishing’ (voice phishing) and possible deepfake voicing call made to an employee who thought they were speaking to their company’s external IT provider. The attack targeted a member of the marketing department who was previously having computer trouble, demonstrating how attackers research their targets to make approaches seem legitimate. This scenario outlines the dangers of getting duped and proves that anyone, regardless of technical expertise or position, can fall victim to these convincing schemes.
The incentive to steal data, specifically in Big Tech during an AI arms race, has never been higher. AI companies are desperate to acquire training data, algorithms and strategic insights to get competitive advantages. This, coupled with widespread tech layoffs and destabilization around AI replacement of human jobs, only enhances motives to cause harm. Disgruntled employees may feel they have nothing to lose, making them prime targets for recruitment by cybercriminals or competitors.
The main focus for cybercriminals is financial gain
Attackers look to establish trust and then facilitate exchanges through new wire information or a currency switch to cryptocurrency, which is easier to steal and challenging to trace or recover, leading to complex financial fraud schemes. Nardello & Co. is working on several cases involving significant financial loss, some reaching into the millions of dollars from single incidents. We are also seeing an uptick in theft of code related to AI systems used to hack back-end systems, effectively capturing intranet-stored information related to finances, personal information, and other sensitive data.
FBI warns of executive impersonation schemes
In February 2026, the FBI issued a formal alert about deepfake fraud schemes specifically targeting company executives and financial officers. The alert documented several high-value cases where fraudsters used AI-generated voice and video to impersonate CEOs and other senior leaders, resulting in millions of dollars in losses. In one notable incident from February 2024, a finance employee at a multinational firm joined what appeared to be a legitimate video conference with the company’s CFO and several colleagues. The employee was deceived into transferring $25 million before discovering that all participants on the call were deepfake creations.
The FBI identified several warning signs that organizations should watch for. Suspicious communications often use channels outside normal organizational procedures, such as encrypted messaging applications, third-party email domains or unfamiliar accounts.
The FBI recommends that organizations implement formal validation procedures for all financial transactions, such as a call-back policy, predetermined verification questions or verbal passwords. Security awareness training should specifically address deepfake technology and impersonation tactics, and companies should conduct simulated vishing exercises to test employee readiness. Additionally, organizations should encourage executives to limit their social media presence, particularly photos, videos, and audio recordings that could be used to train deepfake algorithms.
How can organizations protect themselves?
Organizations need to boost their internal awareness of new methods of attack, as well as maintain robust security programs that include up-to-date technology, policies, and processes to detect, protect, and combat against new and emerging threats. This means regular training sessions, verification procedures for financial transactions, and fostering an environment where employees feel comfortable questioning unusual requests, even from apparent authority figures. And if they fall victim to a deepfake attack, companies must act quickly to investigate the mechanism, identify the bad actors, and preserve the evidence.
