Deepfake Fraud Prevention for Small Business: A Practical Checklist

Deepfake fraud prevention for small business starts with one rule that costs nothing to implement: no payment, wire transfer, or change to banking details is approved based on a video call, voice call, or message alone — every request has to be confirmed through a second, pre-agreed channel before money moves. That single control would have stopped the most expensive deepfake fraud case on record, and it's the control most small businesses don't yet have written down anywhere.

Deepfake fraud is the use of AI-generated audio or video — a cloned voice or a synthetic likeness of a real person — to impersonate someone a victim trusts, in order to induce a fraudulent payment, data disclosure, or action. It's a newer variant of business email compromise (BEC), and it's growing precisely because the tools to create a convincing clone have become cheap and fast.

A Real Case: The $25.6 Million Video Call

In early 2024, a finance employee at Arup, the UK-based engineering firm behind the Sydney Opera House's structural design, joined what appeared to be a routine video call with the company's CFO and several colleagues. According to Hong Kong police, as reported by CNN, every other person on that call was a deepfake — AI-generated video and voice built from publicly available footage of real executives. The employee had initially suspected a phishing email referenced in the setup, but seeing and hearing familiar colleagues on a live video call overrode that suspicion. He authorized 15 separate transfers totaling roughly HK$200 million, about $25.6 million, before the fraud was discovered. Arup confirmed the incident and said its internal systems were not compromised — the attack succeeded entirely through impersonation, not a technical breach.

That's the pattern worth internalizing: the fraud didn't exploit a software vulnerability. It exploited the reasonable human instinct to trust a face and voice you recognize, on a call that looked exactly like dozens of legitimate ones before it.

Why Small Businesses Are Exposed

Large enterprises have multi-layer approval chains almost by accident — enough staff that no single person can authorize a large transfer alone. Small businesses often don't have that structural protection. A 10-person company might have one person who can approve a wire, one person who talks directly to the owner or CEO, and a culture built on speed and trust rather than friction. That's a strength for getting things done and a specific vulnerability for this type of fraud, because the entire attack depends on finding the one person who can move money quickly and getting them to skip verification "just this once." Mapping exactly who can approve what, and where the single points of failure sit, is usually a byproduct of a broader systems audit — most small businesses have never written their approval chain down anywhere.

The FBI's 2025 Internet Crime Report included, for the first time, a dedicated category for AI-related fraud: 22,364 complaints and nearly $893 million in reported losses — a strong signal that AI-enabled impersonation has moved from novelty to a mainstream fraud vector that regulators are now tracking separately. Business email compromise overall, the category this fraud sits within, accounted for over $3 billion in reported losses in the same report. Those are complaint-based figures, so they almost certainly understate the real total — many victims never report, especially smaller businesses worried about reputational fallout.

Deepfake Fraud Prevention for Small Business: The Checklist

1. Callback verification on a known number. Any request to move money or change payment details — regardless of how it arrives — gets confirmed by calling the requester back on a phone number you already had on file, not one provided in the request itself.
2. Two-person approval above a set dollar threshold. Pick a number that matters for your business, and require a second person's sign-off above it, in writing, through a separate channel from the original request.
3. A pre-agreed verification phrase for high-risk requests. A simple shared code word or phrase, changed periodically, that a legitimate request-maker can supply and a scammer impersonating them cannot easily guess.
4. Slow down urgency, by policy. Make "this needs to happen right now, don't tell anyone" a documented red flag that triggers extra verification, not an exception to it — real emergencies can tolerate a five-minute callback.
5. Train the specific people who can move money. Not a general security awareness session — a targeted walkthrough of what a deepfake audio or video request might look like, using the Arup case as a concrete example, for the handful of people who actually have payment authority.
6. Document the policy somewhere everyone can find it. A control that exists only as tribal knowledge fails under pressure. Write it down, link it from your onboarding materials, and revisit it when you add a new approver.

What to Do If You Suspect You've Been Targeted

Stop the transaction if it hasn't settled yet, and contact your bank's fraud line immediately — wire transfers can sometimes be recalled within a narrow window. Report the incident to the FBI's Internet Crime Complaint Center (IC3) and, if customer or financial data was involved, review your obligations under applicable state or federal breach notification rules. Preserve the original call recording, email, or message rather than deleting it, since it's the evidence that will help both your bank and law enforcement trace the attempt.

Afterward, treat the incident as a process failure to close, not just a crime to report. Walk through which step in your approval chain the attacker found and exploited, and update the written policy the same week — memory of a near-miss fades fast, and the next attempt may target a different employee with a different pretext.

Common questions

Can small businesses realistically defend against deepfake fraud without an IT security team? Yes — the most effective controls here are procedural, not technical. Callback verification and two-person approval cost nothing to implement and don't require specialized security staff; they require a written policy and the discipline to follow it even when a request feels urgent and legitimate.

Is deepfake fraud only a risk for large companies with video conferencing budgets? No. Voice cloning is actually the more common vector for small businesses, since it requires less setup than a live video deepfake and can be attempted over an ordinary phone call. The same callback-verification control defends against both.

How much audio does someone need to clone a voice convincingly? Public reporting on voice-cloning tools suggests a short clip — in some cases just a few seconds, often pulled from a voicemail greeting, a public video, or a social media post — can be enough to generate a usable clone. Treat any publicly posted audio or video of your leadership team as a potential source an attacker could use.

What's the single highest-leverage control to put in place first? Callback verification on payment and banking-detail changes. It's free, it takes one policy document and one team conversation to implement, and it would have stopped the Arup fraud regardless of how convincing the video or audio was.

Building this kind of control into your approval workflow is a systems problem as much as a security one — it has to fit how your team actually works, or it gets skipped under pressure. If you want help mapping payment approvals that hold up under pressure, start with an audit.