{"id":29409,"date":"2026-08-11T01:00:47","date_gmt":"2026-08-10T17:00:47","guid":{"rendered":"https:\/\/bigband.net.my\/?p=29409"},"modified":"2026-08-10T10:48:36","modified_gmt":"2026-08-10T02:48:36","slug":"deepfake-payment-fraud-2026","status":"publish","type":"post","link":"https:\/\/bigband.net.my\/index.php\/2026\/08\/11\/deepfake-payment-fraud-2026\/","title":{"rendered":"Deepfake Payment Fraud: How to Protect Your Business"},"content":{"rendered":"\n[et_pb_section fb_built=”1″ _builder_version=”4.27.6″ _module_preset=”default” custom_padding=”0px||||false|false” global_colors_info=”{}”][et_pb_row _builder_version=”4.27.6″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.6″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.7″ _module_preset=”default” text_font_size=”18px” header_text_color=”#0060ae” header_2_font=”|700|||||||” header_2_text_align=”left” header_2_text_color=”#0060ae” custom_margin=”0px|0px|0px|0px|false|false” custom_margin_last_edited=”off|desktop” hover_enabled=”0″ text_font_size_tablet=”18px” text_font_size_phone=”18px” text_font_size_last_edited=”on|phone” global_colors_info=”{}” sticky_enabled=”0″]

When Seeing Is No Longer Believing: Deepfake Fraud and Your Money<\/span><\/b><\/em><\/h1>\n

In early 2024, a finance employee at the Hong Kong office of the global engineering firm Arup joined a routine video call. The chief financial officer was on screen, along with several colleagues he recognised. They asked him to process an urgent and confidential transaction, and he followed the instructions: fifteen transfers totalling around USD 25.6 million. Only afterwards, when he checked with head office, did he learn the truth. Not one person on that call had been real. Every face and every voice was an AI generated deepfake, built from video and audio the company had shared publicly. (CNN<\/a>)<\/p>\n

For years, the advice for spotting fraud was simple. Look for the odd email address, the strange phrasing, the request that does not quite feel right. That advice is now dangerously out of date. The threat has learned to wear the face of someone you trust.<\/span><\/p>\n

<\/span><\/p>\n

This Is Not a Rare Case<\/span><\/b><\/h2>\n

The Arup incident made headlines because of its scale, but the pattern behind it is now everywhere. In its most recent Internet Crime Report, the FBI’s Internet Crime Complaint Center recorded USD 2.77 billion in losses from business email compromise in a single year, across more than 21,000 reported cases. (FBI IC3<\/a>) These are not attacks on technology. They are attacks on people, and on the trust that keeps a business moving.<\/p>\n

The 2026 Verizon Data Breach Investigations Report tells the same story from another angle. It found the human element involved in 62 percent of all breaches, and noted that social engineering increasingly arrives through channels beyond email, including phone calls and messaging apps. (Verizon DBIR<\/a>) The weakest point is no longer the firewall. It is the moment a trusted voice asks for something urgent.<\/span><\/span><\/p>\n

<\/span><\/p>\n

Why Your Instincts No Longer Protect You<\/span><\/b><\/h2>\n

Modern voice cloning needs only a few seconds of recorded speech to produce a convincing copy. That audio is easy to find: a conference talk, a webinar, a product video, a short clip on social media. From there, an attacker can generate a live voice, or even a moving face, that sounds and looks like your director, your supplier, or your banker.<\/p>\n

For Malaysian businesses that trade across borders, the risk is sharper still. A great deal of trust rests on a familiar voice on the phone and a payment instruction that lands at a busy moment. When that voice can be faked, the usual signals of caller ID, tone, and recognition stop being proof of anything at all.<\/span><\/p>\n

<\/span><\/p>\n

\n

\u201c<\/em><\/strong>The call looked real. The voices were real. The money was real. Only the people were not.<\/span><\/i><\/b><\/em><\/strong>\u201d<\/em><\/strong><\/h3>\n
\n
BigBand Advisory<\/span><\/div>\n<\/div>\n<\/blockquote>\n

\u00a0<\/h2>\n

The Real Defence Is a Habit, Not a Gadget<\/span><\/b><\/h2>\n

The reassuring part is that the strongest protection is also the simplest, and it does not depend on catching the fake. It depends on refusing to act on a single channel. For any payment above a set value, and for any change to a supplier’s or employee’s bank details, the instruction should be confirmed through a second, independent channel: a callback to a number you already hold on record, never a number or link supplied inside the request itself.<\/p>\n

That discipline works because it breaks the one thing every version of this scam relies on, which is urgency inside a single conversation. Around that habit, layered technical controls do the rest. Endpoint protection and advanced threat detection catch the compromised mailbox or device that often sits behind the request, while a next generation firewall filters the phishing message that starts the chain.<\/span><\/p>\n

\u00a0<\/span><\/p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.6″ _module_preset=”default” background_color=”#eaeaea” custom_padding=”40px|40px|40px|40px|false|false” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.6″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.7″ _module_preset=”default” text_font_size=”18px” header_text_color=”#0060ae” header_2_font=”|700|||||||” header_2_text_align=”left” header_2_text_color=”#0060ae” custom_margin=”0px|0px|0px|0px|false|false” custom_margin_last_edited=”off|desktop” hover_enabled=”0″ text_font_size_tablet=”18px” text_font_size_phone=”18px” text_font_size_last_edited=”on|phone” global_colors_info=”{}” sticky_enabled=”0″]

Four steps to take this week<\/span><\/b><\/h2>\n