What Exactly Is a Deepfake?

A deepfake is digitally manipulated content generated using artificial intelligence that is designed to imitate a real person's appearance, voice or behaviour.

 

Unlike traditional photo editing or voice impersonation, deepfake technology uses machine learning algorithms that analyse existing videos, audio recordings and photographs to recreate an individual's facial expressions, speech patterns, tone of voice and mannerisms.

 

The more publicly available information exists about a person, the easier it becomes for artificial intelligence to build an increasingly convincing digital replica.

·         Corporate websites

·         LinkedIn videos

·         Conference presentations

·         Television interviews

·         Podcasts

·         Webinars

·         Social media content

 

Every interview, webinar, podcast or conference presentation contributes to an increasingly accurate digital profile that criminals can exploit to create convincing impersonations.

 

Why Executives Have Become Prime Targets

Senior executives have become some of the most attractive targets for cybercriminals. Modern organisations actively encourage executive visibility to strengthen stakeholder confidence and enhance brand recognition. CEOs, Managing Directors and senior executives regularly appear in promotional videos, interviews, webinars and public speaking engagements. Unfortunately, this visibility also provides criminals with exactly what they need.

 

Every public appearance helps artificial intelligence learn:

·         Facial movements

·         Speech patterns

·         Voice characteristics

·         Gestures

·         Expressions

·         Body language

 

The irony is difficult to ignore. The more successful and visible an executive becomes, the easier it becomes for criminals to impersonate them.

 

Executive Impersonation Has Entered a New Era

For years, organisations have been targeted through Business Email Compromise (BEC), where criminals impersonated executives by sending convincing emails requesting urgent payments or confidential information. Artificial intelligence has fundamentally changed this threat.

 

Today, criminals have demonstrated the ability to exploit artificial intelligence across multiple communication channels, including:

·         AI-generated Microsoft Teams or other virtual meetings

·         AI-generated or cloned WhatsApp voice messages

·         Deepfake video messages impersonating executives

·         AI-generated videos falsely depicting trusted public figures or business leaders endorsing products or investments (The Guardian, 2024)

 

Although the technology has evolved dramatically, the objective has not. Criminals continue to exploit three fundamental weaknesses:

·         Trust

·         Urgency

·         Human behaviour

 

Artificial intelligence has simply made the deception more convincing than ever before.

 

 

South Africa Is Not Immune

While highly sophisticated live deepfake video attacks remain relatively uncommon in South Africa, the technologies that enable them are already being exploited by cybercriminals. AI-generated investment scams, cloned voices, fraudulent WhatsApp messages and executive impersonation attempts are becoming increasingly prevalent, demonstrating that deepfake-enabled fraud is no longer a theoretical concern (FANews, 2026).

 

The Financial Sector Conduct Authority (FSCA) has warned the public about fraudulent investment advertisements that used AI-generated videos falsely depicting respected financial journalists Maya Fisher-French and Bruce Whitfield endorsing investment opportunities they had never supported. These convincing deepfakes were specifically designed to exploit public trust and persuade victims to invest in fraudulent schemes (FANews, 2026).

 

Similarly, the South African Banking Risk Information Centre (SABRIC) has cautioned that criminals are increasingly using artificial intelligence to create cloned voices, impersonate banking representatives and produce highly convincing digital communications aimed at stealing money and sensitive information. Collectively, these incidents demonstrate that AI-enabled deception has evolved from an emerging cyber threat into a tangible operational and governance risk that organisations can no longer afford to ignore (FANews, 2026).

 

For many South African organisations, the first deepfake attack is unlikely to involve a sophisticated video conference. It is far more likely to begin with something familiar—a WhatsApp voice note from the "Managing Director", an urgent telephone call from a trusted executive, a convincing email requesting an immediate payment, or a video message instructing an employee to bypass established approval processes. By the time the deception is discovered, the financial loss, reputational damage and erosion of trust may already have occurred.

 

Case Study: When AI Cost a Company US@25 Million

One of the most widely reported deepfake fraud cases occurred in Hong Kong during 2024. An employee of the engineering firm Arup received what appeared to be a legitimate request from the company's Chief Financial Officer regarding a confidential transaction.

 

Initially suspicious, the employee joined a video conference where several familiar colleagues—including the CFO—appeared to participate.

 

The meeting looked genuine.

 

The voices sounded authentic.

 

The faces were familiar.

 

Believing the request was legitimate, the employee authorised approximately US$25 million in transfers before discovering that every participant in the meeting had been an AI-generated impersonation.

 

The organisation's internal systems had not been hacked.

 

Its employees had (Financial Times, 2024).

 

The incident demonstrated that even vigilant employees can become victims when familiar faces and trusted authority figures appear to validate fraudulent instructions.

 

The Real Threat is Not Technology - It's Trust

Deepfake attacks succeed because they exploit something far more valuable than software.

They exploit trust.

Employees naturally trust:

·         familiar faces;

·         recognised voices;

·         respected leaders;

·         established relationships;

·         organisational hierarchy.

 

Artificial intelligence simply weaponises that trust. The challenge facing organisations today is no longer identifying suspicious emails filled with spelling mistakes. It is determining whether the person appearing on the screen is actually who they claim to be.

 

Warning Signs Every Organisation Should Recognise

Although deepfake technology continues to improve, organisations should remain alert to unusual behaviour. Potential warning signs include:

·         Requests to bypass normal approval procedures.

·         Sudden pressure to process urgent payments.

·         Instructions to maintain secrecy.

·         Requests to change supplier banking details.

·         Unexpected WhatsApp voice notes requesting financial transactions.

·         Executive requests received outside normal communication channels.

·         Calls encouraging employees to ignore established controls.

 

Rather than attempting to detect whether a voice or face is genuine, organisations should focus on verifying the instruction itself.

 

Why Internal Controls Matter More Than Ever

Technology alone cannot eliminate deepfake fraud.

Strong governance remains the most effective defence.

Every organisation should implement:

·         Dual approval for high-value payments.

·         Independent verification of banking detail changes.

·         Call-back verification using trusted contact information.

·         Segregation of duties.

·         Employee awareness training.

·         Executive fraud awareness programmes.

·         Incident response procedures for AI-enabled fraud.

 

Employees should never feel pressured to bypass internal controls simply because the request appears to come from a senior executive. A robust control environment protects both the organisation and its leadership.

 

The Boardroom Must Treat AI as a Governance Risk

Artificial intelligence is no longer simply an IT issue. It is a governance issue. Boards should ensure that AI-enabled fraud is incorporated into:

·         Enterprise Risk Management frameworks.

·         Fraud Risk Assessments.

·         Cybersecurity Strategies.

·         Business Continuity Plans.

·         Internal Audit programmes.

·         Executive awareness initiatives.

 

The organisations that adapt first will be far better positioned to manage this emerging threat.

 

Final Thoughts

For generations, people have relied on one simple assumption. Seeing is believing. Artificial intelligence has fundamentally changed that assumption.

 

Deepfake-enabled fraud is not simply a cybersecurity issue. It is a governance, fraud risk and internal control challenge that requires collaboration between Boards, executive management, risk functions, internal audit, compliance and information security. Organisations that respond through technology alone are likely to overlook the broader governance failures that allow these attacks to succeed.

 

For South African organisations, the message is clear.

❌ Do not assume that a familiar face guarantees authenticity.

❌ Do not assume that a recognisable voice guarantees legitimacy.
✅ Trust your governance framework.
✅ Trust your internal controls.
✅ Trust your verification procedures.

 

In the age of artificial intelligence, the strongest defense against deception is not better eyesight—it is better governance.

 

D-finitive Insight

Artificial intelligence is reshaping both business and cybercrime. As criminals adopt increasingly sophisticated methods to exploit trust, organisations must evolve just as quickly. Effective governance, strong internal controls, cyber resilience and informed employees are no longer optional—they are essential safeguards against emerging threats.

 

Through governance, risk management, digital forensics, forensic investigations and financial crime advisory services, D-finitive Advisory helps organisations identify emerging threats, strengthen governance frameworks, enhance fraud resilience and protect what matters most.

 

Delivering Clarity. Protecting Integrity. Driving Accountability.