Deepfake Fraud in Enterprise: Detection & Prevention

In early 2025, a finance executive at a multinational firm wired $25 million after joining a video call with deepfaked versions of the CFO and three colleagues — none of whom had actually sent the invite. The attack succeeded not because the technology was flawless, but because no detection layer existed between the meeting and the wire transfer. That gap is the exact problem this guide addresses.

Detecting Deepfake Video and Audio in Real Time

The first line of defense is passive artifact detection on video streams. Tools like FaceForensics++ and the open-source DeepFake-o-meter can analyze frames for compression artifacts, inconsistent eye blinking, and lighting mismatches that betray synthetic faces. For audio, Resemblyzer compares voice embeddings against enrolled speaker profiles.

Here is a practical Resemblyzer check you can run against a recorded call segment from a suspicious meeting:

# Install: pip install resemblyzer
from resemblyzer import VoiceEncoder, preprocess_wav
from pathlib import Path
import numpy as np

encoder = VoiceEncoder()

# Enrolled voiceprint for CFO jharrison@corp-internal.lan
known_wav = preprocess_wav(Path("jharrison_enrolled.wav"))
known_embed = encoder.embed_utterance(known_wav)

# Audio ripped from the suspicious call recording
suspect_wav = preprocess_wav(Path("call_20260914_jharrison.wav"))
suspect_embed = encoder.embed_utterance(suspect_wav)

similarity = np.dot(known_embed, suspect_embed)
print(f"Cosine similarity: {similarity:.4f}")

# Output:
# Cosine similarity: 0.6112

A genuine match between the same speaker typically scores above 0.85. A score of 0.61 is a hard red flag — the voice in that call is not jharrison. Your next step: pull the meeting invite metadata, check the originating IP, and freeze any financial actions that were authorized during that call. Do not tip off the requestor yet; treat it as an active incident.

Hunting Deepfake Artifacts at the Network and Identity Layer

Audio-visual analysis alone is not enough. Sophisticated attackers layer the deepfake on top of a compromised or spoofed communication channel. You need to correlate the synthetic media alert with identity and network signals. Start by querying your SIEM for the source IP of the meeting invite and cross-referencing it against your IAM logs.

# Splunk query — correlate suspicious meeting invite source with auth events
index=o365_audit sourcetype="o365:management:activity"
  Operation="MeetingInviteSent"
  UserId="jharrison@corp-internal.lan"
| table _time, ClientIP, UserId, AttendeeList, MeetingSubject
| join ClientIP
    [search index=azure_ad sourcetype="azure:aad:signin"
     UserPrincipalName="jharrison@corp-internal.lan"
    | table ClientIP, Location, RiskLevel, _time]
| where RiskLevel="high" OR cidrmatch("192.0.2.0/24", ClientIP)

# Sample output:
# _time                  ClientIP       Location     RiskLevel  MeetingSubject
# 2026-09-14 09:03:11    192.0.2.47     Unknown VPN  high       Q3 Wire Approval
# 2026-09-14 09:04:02    192.0.2.47     Unknown VPN  high       Q3 Wire Approval

Both events originate from 192.0.2.47, a VPN exit node with no prior history for this user, flagged as high-risk by Azure AD. The meeting invite and the sign-in happened within 51 seconds of each other — a bot-speed pattern. An attacker compromised jharrison’s credentials, sent the invite, and then hosted a deepfake video call from that same infrastructure. Now you have two correlated signals: voice similarity failure plus anomalous identity activity. Escalate to incident response immediately and revoke jharrison’s session tokens.

Prevention Controls That Actually Stop Deepfake Fraud

Detection without prevention is just expensive forensics. Build these controls before the next call happens.

1. Out-of-Band Verbal Codewords for High-Value Requests

Establish rotating weekly codewords for any financial or credential-related request made over video. If the caller cannot confirm the word, the call is invalid — full stop. This kills deepfake fraud even when detection tools fail. Distribute codewords through a separate channel such as an encrypted SMS to personal devices, never through email or the same collaboration platform.

2. Enroll Voice Biometrics for All Finance and Executive Staff

Use Resemblyzer or a commercial equivalent like Nuance Gatekeeper to create baseline voice embeddings for every person authorized to approve transactions. Run every recorded call through the pipeline automatically. Flag any similarity score below 0.82 for human review before approving actions taken in that meeting.

3. DMARC, DKIM, and Meeting Platform Lockdown

Deepfake calls still need an entry point. Enforce strict DMARC (p=reject) on all corporate domains. Restrict external meeting invites in Microsoft Teams or Zoom so that externally-originated invites require explicit approval from IT before reaching executive calendars. Most deepfake fraud chains begin with a spoofed calendar invite — cut the chain there.

4. Mandatory Delay on Wire Transfers

Institute a minimum 4-hour hold on any wire transfer over $10,000 that was requested verbally or via video. Use that window to run the call recording through your voice verification pipeline and correlate the meeting metadata with your SIEM. Friction is your friend here.

What To Do Right Now

Pull the last 30 days of meeting invites sent in the name of your CFO, CEO, or any finance-authorized executive. Run the query above against your SIEM and look for invites originating from IPs that do not match those executives’ normal sign-in locations. If you find a mismatch, cross-check whether any financial transaction was requested or completed in the 24 hours following that meeting. That single query, run today, has caught active fraud campaigns at three organizations I know of directly. Start there.