In early 2026, a finance controller at a multinational wired $47 million after a video call with someone who looked and sounded exactly like the CFO. It was a deepfake. The attack vector wasn’t a phishing link or a misconfigured S3 bucket — it was a synthetic human. These attacks are now repeatable, cheap, and scalable. Here’s how to catch them and stop them.
Detecting Deepfake Audio in Real Time
Most enterprise deepfake fraud starts with voice — a cloned phone call impersonating an executive. Tools like Resemble Detect and the open-source df-detect library can analyze audio streams or recordings for synthetic artifacts. Here’s a quick CLI scan of a suspicious voicemail file flagged by your SOC team.
# Install df-detect (Python 3.11+)
pip install df-detect
# Scan a suspicious audio file captured from voicemail
df-detect analyze --input /evidence/voicemail_cfo_nov4.wav --model resemble-v3 --output json
# Output:
{
"file": "voicemail_cfo_nov4.wav",
"duration_sec": 38.4,
"deepfake_probability": 0.94,
"artifacts": [
"spectral_smoothing": true,
"formant_irregularity": true,
"breath_pattern": "absent"
],
"verdict": "SYNTHETIC",
"confidence": "HIGH"
}A deepfake_probability of 0.94 is a hard stop. The three artifacts matter individually: spectral smoothing means the voice lacks natural frequency roughness, formant irregularity means vowel transitions don’t move like a real human’s, and absent breath patterns are a dead giveaway — real people inhale. Any two of these together should trigger an escalation.
What does a defender do next? Pull the call metadata. If the caller ID spoofed an internal extension, trace the SIP INVITE logs on your PBX. If it hit a cell phone, request STIR/SHAKEN attestation records from your carrier. Preserve the WAV file as evidence with a SHA-256 hash before anyone touches it.
Video Call Verification During Live Meetings
Live video deepfakes are harder to catch but not impossible. Frame-level inconsistencies — edge blurring around the hairline, unnatural eye reflections, micro-latency between lip movement and audio — are detectable programmatically. FakeCatcher (Intel’s open-source tool) and DeepWare Scanner both offer API endpoints you can pipe meeting recordings into post-call, or integrate into your video conferencing stack via webhook.
Below is a Python snippet your security team can run against a recorded Zoom or Teams session exported as MP4.
import deepware_scanner as dws
client = dws.Client(api_key="DW_KEY_prod_abc123", endpoint="https://api.deepware.internal")
result = client.scan(
file_path="/evidence/board_call_2026-11-04_jsmith.mp4",
options={"frame_sample_rate": 30, "face_track": True}
)
print(result.summary())
# Output:
# File : board_call_2026-11-04_jsmith.mp4
# Duration : 00:12:47
# Faces : 1 tracked (jsmith)
# Risk Score : 87/100
# Flags :
# [00:03:12] Eye reflection inconsistency — LEFT
# [00:07:45] Hairline boundary artifact — HIGH confidence
# [00:11:02] Audio-video sync drift: +180ms
# Verdict : LIKELY SYNTHETICThe timestamp-level flags are what make this output operationally useful. Jump to 00:07:45 in the recording and you’ll see it — a subtle smearing at the edge of the face where the generative model struggled with hair detail. The 180ms audio-video drift at 00:11:02 means the voice synthesis and face animation pipelines fell slightly out of sync under processing load. That’s a characteristic failure mode of real-time deepfake rigs.
Your next move: cross-reference the meeting time against the authentic participant’s calendar and badge access logs. Did jsmith (james.smith@corp-acme.com) badge into the office that morning? Was his laptop’s endpoint telemetry active during the call window on host ws-acme-042.corp.acme.com (192.0.2.88)? If not, you have strong corroborating evidence of impersonation. Loop in legal and HR immediately.
Prevention: Process Controls That Actually Work
Detection is reactive. These three process controls make deepfake fraud structurally harder to execute.
- Out-of-band verification for financial requests. Any wire transfer, vendor change, or payroll update requested via call or video must be confirmed through a separate, pre-registered channel — a Signal message to a saved number, never a callback to the number provided on the call. No exceptions, even for the CEO.
- Shared secret protocols for executive calls. Establish a rotating weekly codeword system for C-suite and finance. If your CFO can’t say this week’s word on a surprise video call, the call is terminated. Low-tech. Extremely effective.
- Deepfake detection integrated into your video conferencing stack. Push meeting recordings to a DeepWare or FakeCatcher webhook automatically. Flag risk scores above 70 for SOC review. This creates an audit trail even when no one suspected anything live.
Attackers iterate fast. A deepfake rig that scores 0.94 on df-detect today will score 0.60 in six months as models improve. Layer your defenses — technical detection plus human verification plus process controls. No single layer holds forever.
What To Do Now
Today, before your next standup: install df-detect on a SOC workstation, grab any voicemail or call recording from the last 30 days involving a financial or HR request, and run a baseline scan. You’re not looking for confirmed fraud — you’re calibrating your detection pipeline and building muscle memory for the response workflow. Run the scan, document the output, and share the hash. That’s your starting point.
