Deepfake Fraud in Enterprise: Detection & Prevention

In May 2026, a Hong Kong-based engineering firm wired $4.7 million after a CFO impersonation via deepfake video call — the attacker cloned voice and face from six months of earnings call recordings. This isn’t edge-case anymore. Deepfake fraud is now a repeatable enterprise attack pattern targeting finance, HR, and executive assistants. Here’s how to detect it and stop it.

Detecting Deepfake Audio in Voice Calls and Recordings

Most deepfake voice attacks arrive as MP3 recordings forwarded by a panicked employee: “The CEO called and said wire it now.” Your first move is running the audio through a classifier before anyone picks up the phone to confirm.

Tool: resemblyzer — an open-source speaker verification library that embeds voice into a 256-dimensional vector. You compare the suspicious recording against a known-good baseline from a legitimate source like an earnings call or all-hands recording.

# Install and run a cosine similarity check
pip install resemblyzer

python3 - <<'EOF'
from resemblyzer import VoiceEncoder, preprocess_wav
from pathlib import Path
import numpy as np

encoder = VoiceEncoder()

# Known good CEO voice from Q1 earnings call
baseline = preprocess_wav(Path("ceo_earnings_q1_2026.wav"))
baseline_embed = encoder.embed_utterance(baseline)

# Suspicious "CEO" call received by accounts payable
suspect = preprocess_wav(Path("suspect_wire_request_20260728.wav"))
suspect_embed = encoder.embed_utterance(suspect)

similarity = np.dot(baseline_embed, suspect_embed)
print(f"Voice similarity score: {similarity:.4f}")
EOF

# Output:
# Voice similarity score: 0.6113

A score above 0.85 suggests the same speaker. A score of 0.61 is a red flag — the voice pattern diverges significantly from the baseline even if it sounds convincing to the human ear. In this case you’d immediately escalate, freeze the wire request, and send the file to a forensics team for spectrogram analysis. Deepfake audio often shows abnormal formant transitions around consonants that look wrong on a spectrogram even when they sound right in real time.

What an attacker does next when this layer exists: they switch to real-time voice cloning in live calls. That requires a different control — covered in the prevention section below.

Detecting Deepfake Video in Executive Impersonation Calls

Finance teams are being dragged into “emergency” Zoom calls where a face that looks like the CFO authorizes a transaction. The face swap artifact detection game has gotten harder, but metadata and frame-level analysis still work reliably at enterprise scale.

Tool: FaceForensics++ inference script paired with a captured video frame sequence. You can extract frames from a recorded meeting using ffmpeg and batch-analyze them.

# Step 1: Extract frames from a suspicious recorded call
ffmpeg -i suspicious_call_20260729.mp4 \
  -vf fps=1 \
  /tmp/framecheck/frame_%04d.png

# Step 2: Run FaceForensics++ classifier (assumes model already downloaded)
python3 detect_from_video.py \
  --input_dir /tmp/framecheck/ \
  --model_path weights/xception_face_c23.pth \
  --output_csv /tmp/results_20260729.csv

# Output snippet from results_20260729.csv:
# frame_0001.png, FAKE, confidence=0.9231
# frame_0002.png, FAKE, confidence=0.9187
# frame_0003.png, REAL, confidence=0.5544
# frame_0004.png, FAKE, confidence=0.8902
# ...
# Average FAKE confidence: 0.8821

An average fake confidence above 0.80 across a session is strong evidence of a face-swap attack. Notice frame 0003 dipped — that happens when the subject moves fast or lighting shifts and the GAN model momentarily drops fidelity. Attackers know this and often script calls to minimize head movement. That rigidity itself is a behavioral signal worth documenting.

What you do with this output: preserve the raw MP4 as evidence, notify legal, and use the CSV as part of an incident report. Do not confront the attacker — the call is already over. Focus on whether a transaction was initiated.

Prevention Controls That Actually Work

Detection is reactive. These controls stop the fraud before money moves.

• Out-of-band verification codes: Finance and HR must confirm any wire request or data change via a pre-shared one-time code exchanged through a separate channel — not email, not the same call. This breaks the deepfake loop regardless of how convincing the voice or face is.
• Watermarked reference calls: Record a short baseline video of each executive monthly. Store it air-gapped at sec-vault.corp.internal (192.0.2.45). When a suspicious call comes in, your SOC pulls the baseline and runs a frame-level diff within minutes.
• Meeting platform metadata logging: Force Zoom and Teams to log join IP, device fingerprint, and account age for every call. An attacker joining as cfo.martinez@corp-external-guest.com from 192.0.2.178 — a residential IP — versus the CFO's known corporate endpoint is an instant signal. Build a SIEM alert on this pattern.
• Real-time liveness detection: Deploy a liveness check plugin (AWS Rekognition or Azure Face API both support it) in your video conferencing stack. It challenges participants with micro-expression prompts that current face-swap models fail under latency.

The single biggest control gap in enterprise deepfake fraud isn't technology — it's the cultural assumption that a familiar face or voice on a call equals authorization. That assumption is now weaponized at scale.

What To Do Now

Pull the last 90 days of wire transfer requests over $50,000 from your finance team. For any that were initiated via phone or video call, confirm there is a documented out-of-band verification step in the approval trail. If there isn't one — for even a single transaction — you have an open fraud vector right now. Fix the verification policy today, then schedule a tabletop next week where finance walks through what they'd actually do if the CFO called and said "don't tell anyone, wire it immediately." The answer to that call needs to be hardwired before the attacker makes it.