Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Fight Deepfake Social Engineering Threats
Transcript
- Lucas: In the second quarter of 2024, a multinational financial services firm received a phone call that sounded exactly like their CEO. The voice authorized a wire transfer of twenty-five million dollars. It was a deepfake. By the time anyone realized, the money was gone. Luna: That's the kind of scenario that keeps CISOs up at night. How common are these attacks now, especially as we're sitting here in late July 2026? Lucas: They're accelerating fast. The Identity Theft Resource Center reported deepfake-related fraud attempts increased three hundred percent year-over-year in 2025. And the technology has only gotten cheaper. You can clone a voice with three seconds of audio from a YouTube clip or a LinkedIn video. Luna: So what are enterprises doing about it? You can't just tell employees to trust their ears anymore. Lucas: Right. The first line of defense is establishing identity verification protocols for any sensitive request, especially financial ones. Many firms now require a callback to a known number, a challenge question, or a pre-agreed code phrase. Some are using biometric voice verification systems that analyze not just what is said but how the vocal tract produces sound. Luna: But deepfake voice models are getting so good they can match tone, pitch, even breathing patterns. Do those detection systems actually work? Lucas: They're improving, but it's an arms race. A company called Pindrop, which does voice biometrics for call centers, claims their system detects synthetic speech with over ninety-nine percent accuracy in controlled tests. But in the wild, with background noise and compression, it's lower. That's why there's growing interest in video-based liveness detection and challenge-response tests that change the expected response in real time. Luna: What's an example of a challenge-response like that? Something the employee on the receiving end can do quickly? Lucas: One approach is to ask the caller to repeat a random phrase generated by a system, then analyze the audio for synthetic artifacts. Another is to require a live video feed and have the person turn their head or blink — those movements are still hard for deepfakes to replicate consistently. Some companies are even integrating these checks into collaboration tools like Zoom or Teams. Luna: It's interesting that older methods like callbacks are making a comeback. But isn't that also vulnerable if the attacker can spoof caller ID or route the callback? Lucas: Absolutely, which is why the callback can't just be to the number that shows up. It has to be to a trusted number the employee already knows — like looking up the vendor's number from an internal directory, not from the email signature. And combined with a pre-shared code, it becomes much harder to break. Luna: So there's a process layer and a technology layer. Where does the biggest failure happen — the detection tool or the person? Lucas: The person, almost every time. Deepfake attacks exploit trust in relationships. That's why training is crucial — not just awareness that deepfakes exist, but specific drills. For example, one global bank I spoke with runs monthly phishing simulations that now include a deepfake voice call asking for account access. If the employee doesn't follow the verification protocol, they get immediate feedback. Luna: That sounds like the kind of program that actually changes behavior. But I imagine a lot of companies are still relying on a single email warning and hoping for the best. Lucas: Exactly. And the cost of inaction is rising. The FBI's Internet Crime Complaint Center reported that deepfake-related losses exceeded one billion dollars globally in 2025. That's not just financial — it includes reputational damage, regulatory fines, and loss of customer trust. Luna: We should talk about the detection arms race. Are we seeing any serious efforts from the big security vendors? Lucas: Yes. Most major cybersecurity vendors now have deepfake detection modules in their email security and collaboration suites. Microsoft, for instance, launched a deepfake detection API for its Azure AI Content Safety service. And there are startups like Veriff and Onfido that focus specifically on liveness detection for identity verification. But the challenge is that deepfake generation tools are also getting better — models like Voicebox from Meta and other open-source voice cloning tools make it easy for attackers to iterate. Luna: So it's a cat and mouse game. What about regulation? Are governments stepping in? Lucas: Slowly. The EU's AI Act includes requirements for labeling synthetic content, but that's more about transparency than blocking harm. In the U.S., the Federal Trade Commission has warned about voice cloning fraud and some states are considering laws that require consent for use of biometric voice data. But enforcement is tricky — these attacks cross borders easily. Luna: And by the way, if you're finding these kinds of analysis useful for whatever you're building or running, we keep this show free from commercials. If you want to support that choice, the link is buy me a coffee dot com slash fexingo. Lucas: Yeah, it's a small way to keep us independent and focused on what matters. No interruptions, just the topic at hand. Luna: So beyond detection, there's also the policy side. Are we seeing CISOs update their incident response plans specifically for deepfakes? Lucas: Definitely. The SEC disclosure rules that came into effect in 2024 put pressure on companies to have clear procedures for determining a material cyber incident. A deepfake fraud that results in significant financial loss fits squarely into that. So boards are now asking: 'If a deepfake call is made to our CFO, what's our response? How do we confirm it happened? How do we notify the board?' Luna: And that leads to some interesting technical solutions — like digital signatures for internal communications, or mandatory multi-factor authentication for any request above a threshold. Lucas: Exactly. One concept gaining traction is the 'call-based zero trust' approach. Every request for sensitive action must be independently verified through a separate channel — not just the voice or video that initiated it. So if the CEO calls and asks for a wire, the finance team sends an approval request via an internal secure chat that must be confirmed with a hardware token. Luna: That eliminates the single point of failure from the voice channel. But it does require a cultural shift — and a willingness to question authority. Lucas: Right, and that's the hardest part. Deepfake attacks exploit the human tendency to defer to bosses. So the training has to empower employees to push back. Some security teams even run 'deepfake drills' where the CEO's voice is used without their knowledge to test if the finance team follows protocol. If someone resists, they get recognized. Luna: Let's talk about the tools CISOs are actually buying. What categories are hot right now? Lucas: A few categories are booming. First, voice biometrics platforms — like Pindrop and Nuance — that are being integrated into call centers and UCaaS. Second, video liveness detection, especially in identity verification for remote onboarding. Third, ai powered email and messaging security that can detect deepfake attachments or manipulated audio in voicemail. And fourth, training platforms that simulate deepfake calls. Luna: Any standout numbers on adoption? I know this is an area where the market is moving fast. Lucas: Gartner predicts that by 2027, thirty percent of enterprises will have deployed deepfake detection tools, up from less than five percent in 2024. And spending on anti-deepfake technology is expected to exceed two billion dollars by 2027. That's a compound annual growth rate of nearly fifty percent. Luna: It's a lot of money, but compared to the potential losses, it makes sense. One question I keep hearing from listeners: is there any single 'silver bullet' that every company should implement first? Lucas: No silver bullet, but the single highest-impact action is to implement a strict financial authorization policy that requires dual approval and out-of-band verification for any transfer over a threshold — say, ten thousand dollars. Pair that with annual deepfake awareness training, and you reduce the risk by an order of magnitude. Everything else — detection tools, biometrics — are layered improvements. Luna: So the old advice still applies: trust but verify. But now 'verify' means something much more technical. Lucas: Exactly. And as the technology evolves, the verification methods will too. I think we're heading toward a world where every high-stakes communication includes a cryptographic signature attached to the voice or video stream — essentially a digital watermark that proves it came from a legitimate source. Until then, humans and processes remain the weakest and strongest link. Luna: Well said. Thanks for walking through this — it's a topic that's only going to become more urgent. Lucas: Absolutely. And if you want to stay on top of how security teams are adapting, we've got more episodes coming. I'm Lucas. Luna: And I'm Luna. Thanks for listening.