Deepfake Payment Fraud: How to Protect Your Business

by | Aug 11, 2026 | Cybersecurity

When Seeing Is No Longer Believing: Deepfake Fraud and Your Money

In early 2024, a finance employee at the Hong Kong office of the global engineering firm Arup joined a routine video call. The chief financial officer was on screen, along with several colleagues he recognised. They asked him to process an urgent and confidential transaction, and he followed the instructions: fifteen transfers totalling around USD 25.6 million. Only afterwards, when he checked with head office, did he learn the truth. Not one person on that call had been real. Every face and every voice was an AI generated deepfake, built from video and audio the company had shared publicly. (CNN)

For years, the advice for spotting fraud was simple. Look for the odd email address, the strange phrasing, the request that does not quite feel right. That advice is now dangerously out of date. The threat has learned to wear the face of someone you trust.

This Is Not a Rare Case

The Arup incident made headlines because of its scale, but the pattern behind it is now everywhere. In its most recent Internet Crime Report, the FBI’s Internet Crime Complaint Center recorded USD 2.77 billion in losses from business email compromise in a single year, across more than 21,000 reported cases. (FBI IC3) These are not attacks on technology. They are attacks on people, and on the trust that keeps a business moving.

The 2026 Verizon Data Breach Investigations Report tells the same story from another angle. It found the human element involved in 62 percent of all breaches, and noted that social engineering increasingly arrives through channels beyond email, including phone calls and messaging apps. (Verizon DBIR) The weakest point is no longer the firewall. It is the moment a trusted voice asks for something urgent.

Why Your Instincts No Longer Protect You

Modern voice cloning needs only a few seconds of recorded speech to produce a convincing copy. That audio is easy to find: a conference talk, a webinar, a product video, a short clip on social media. From there, an attacker can generate a live voice, or even a moving face, that sounds and looks like your director, your supplier, or your banker.

For Malaysian businesses that trade across borders, the risk is sharper still. A great deal of trust rests on a familiar voice on the phone and a payment instruction that lands at a busy moment. When that voice can be faked, the usual signals of caller ID, tone, and recognition stop being proof of anything at all.

“The call looked real. The voices were real. The money was real. Only the people were not.”

BigBand Advisory

 

The Real Defence Is a Habit, Not a Gadget

The reassuring part is that the strongest protection is also the simplest, and it does not depend on catching the fake. It depends on refusing to act on a single channel. For any payment above a set value, and for any change to a supplier’s or employee’s bank details, the instruction should be confirmed through a second, independent channel: a callback to a number you already hold on record, never a number or link supplied inside the request itself.

That discipline works because it breaks the one thing every version of this scam relies on, which is urgency inside a single conversation. Around that habit, layered technical controls do the rest. Endpoint protection and advanced threat detection catch the compromised mailbox or device that often sits behind the request, while a next generation firewall filters the phishing message that starts the chain.

 

Four steps to take this week

  • Set a clear payment value above which second channel verification is always required, with no exceptions for senior staff.
  • Keep a trusted contact list of verified phone numbers for your banks, key suppliers, and executives, and call back only on those numbers.
  • Treat any request for secrecy, speed, or a sudden change of bank details as a signal to slow down and verify.
  • Run one honest drill: could a single urgent call convince your finance team to move money today?

Turn awareness into protection

BigBand helps Malaysian businesses close the gap between human trust and technical defence, with Endpoint Security, Advanced Threat Detection, and Next-Generation Firewall built for the way your team actually works.

Speak with our advisory team about a practical review of your payment and verification controls.

 

Talk to BigBand — Get a Free Consultation

SOURCES