Deepfake

Deepfake technology has advanced to the point where a short sample of a person's voice, sometimes taken from a public interview or social media video, is enough to generate a convincing synthetic voice call. Attackers use this to impersonate a CEO or finance director on a phone call, instructing an employee to urgently transfer funds or share confidential information, a tactic often layered on top of business email compromise. Video deepfakes have been used in fraudulent video calls where an impersonated executive appears to join a meeting and approve a transaction in real time.

Deepfakes matter because they attack one of the last forms of verification people traditionally trusted, hearing or seeing someone directly, and the technology to create them is now inexpensive and widely accessible. Finance and treasury teams are prime targets because a single convincing call can authorize a large wire transfer before anyone questions its legitimacy. As synthetic media becomes harder to distinguish from genuine recordings, reliance on voice or video alone as proof of identity becomes increasingly risky, including in the Indonesian corporate environment where phone-based approvals remain common.

Organizations should require independent, out of band verification for any high value or unusual request, such as calling back a known number rather than trusting the number or video call that initiated the request. Establishing a verbal code word or secondary approval step for wire transfers and sensitive data requests adds a safeguard that synthetic media cannot bypass. Employees should also be trained to recognize subtle deepfake artifacts, such as unnatural blinking, audio latency, or inconsistent lighting, while understanding that detection alone should never replace verification procedures.