How to Protect Against Deepfake Phishing Scams: 2026 Guide for Small Businesses

The most effective way to protect against deepfake phishing scams in 2026 isn’t learning to spot the fake, it’s verifying every high-stakes request through a second, independent channel. That shift matters because AI-generated voice and video have gotten good enough that a familiar face on a video call, or a familiar voice on the phone, is no longer proof of anything. Small and medium businesses feel this gap most, since most run on informal, trust-based approvals rather than documented verification steps that would catch an impersonation no matter how convincing it looks. 

This guide covers why deepfake scams are accelerating, how they target small and medium businesses, and the verification-first defenses that hold up even when the fake is flawless. 

What Is a Deepfake Phishing Scam?

A deepfake phishing scam uses AI-generated audio, video, or images to impersonate a real, known person, an executive, a vendor contact, or an IT administrator to trick an employee into moving money, sharing credentials, or handing over sensitive data. Unlike a traditional phishing email from a stranger, a deepfake scam borrows the actual voice or face of someone the target already trusts. Attackers build these forgeries from public material: a webinar recording, a LinkedIn video, or a handful of photos is enough to train the underlying model, which is why leadership’s public exposure matters (more on that below).

Why Deepfake Scams Are Surging in 2026

Deepfake scams aren’t a future risk for small and medium businesses; they’re a documented, current one.

The FBI’s 2025 Internet Crime Report tracked AI-related fraud as its own category for the first time in the report’s 25-year history, logging 22,364 complaints and nearly $893 million in reported losses, a figure the FBI says is likely understated, since most victims never realize AI was involved.

Australia tells a similar story. The Australian Signals Directorate’s Annual Cyber Threat Report 2024–25 recorded a 50% jump in the average cost of cybercrime for Australian businesses, with small businesses reporting average losses of roughly AU$56,600, up 14% year-on-year, and specifically flags AI-generated deepfake voices as an emerging vishing tactic.

New Zealand isn’t exempt either. The Financial Markets Authority has an active warning, updated as recently as June 2026, about deepfake videos of NZ business leaders being used to promote fraudulent investment platforms.

What’s driving this: voice-cloning tools now need only a few seconds of clean, public audio, a webinar clip or a LinkedIn video, to produce a usable clone.

How Deepfake Scams Target Small and Medium Businesses

Deepfake fraud shows up in a handful of repeatable patterns. Recognising the pattern matters more than recognising the fake, since the underlying request is usually the same regardless of how convincing the media is.

Executive voice-clone wire fraud

A cloned voice calls or leaves a voicemail authorising an urgent payment or a change to bank details, often timed for end of day when verification is slower.

Deepfake video-call impersonation

A synthetic “executive” joins a live Teams or Zoom call to authorise a transfer in real time. The best-documented case is the Arup incident: a finance employee at the engineering firm’s Hong Kong office made 15 wire transfers totalling roughly US$25 million after joining a video call where every other participant, including the CFO, was AI-generated. Arup confirmed the incident to CNN and reported it to Hong Kong police.

Vendor and business-email-compromise fraud

An email requests updated payment details for a supplier, then a follow-up voice note “from the CEO” makes it feel confirmed, when both channels are compromised.

Deepfake job candidates

A synthetic face and voice pass a remote interview, and the business unknowingly onboards someone who isn’t who they claim to be.

Small and medium businesses are disproportionately exposed to all four patterns for a simple reason: shorter approval chains and more informal, trust-based authorisation than large enterprises.

Why You Can’t Spot a Deepfake by Sight or Sound Alone

Modern deepfakes routinely pass casual visual and audio inspection, which means training staff to look for glitches, flat tone, or lip-sync issues is no longer a reliable primary defence, those tells are disappearing as the technology improves. Dedicated deepfake-detection technology does exist, but it’s imperfect, resource-intensive, and not something most small and medium businesses need to buy or operate directly. The more reliable layer is process and people: verification protocols that work whether or not the media looks and sounds real. This guide focuses on that shift next.

How to Protect Against Deepfake Phishing Scams: 7 Verification Steps

These steps work whether the deepfake is a phone call, a video, or an email, because none of them depends on catching the fake in the act. 

1. Verify Every High-Value Request Through a Second, Independent Channel

This is the core rule behind protecting against deepfake phishing scams: never confirm a payment, credential reset, or data request using the same channel it arrived on. If a request comes by video, call back on a number already on file. If it comes by phone, confirm by email to a known address, not one supplied in the message itself. Businesses that haven’t yet mapped which requests actually need this level of verification often start with a cybersecurity risk assessment to identify where informal approval habits create the most exposure.

2. Set Up a Shared Code Word for Financial Approvals

Agree on a rotating verbal passphrase for unscheduled, high-stakes calls or video requests involving money or access. It costs nothing to implement, and it’s something a cloned voice can’t invent on the spot, even if every other detail of the impersonation is convincing.

3. Require Dual Approval for Wire Transfers and Vendor Changes

No single employee, regardless of seniority or team size, should be able to authorise a wire transfer, add a new payee, or change existing bank details on their own. A second, independent approver closes the gap that a single fooled employee would otherwise leave wide open.

4. Treat Urgency and Secrecy as Red Flags, Not Reasons to Move Faster

Nearly every documented deepfake case, voice clone, video call, or vendor fraud relies on time pressure and confidentiality to short-circuit normal verification. Make “pause and verify” an explicit, protected policy, and make clear that no employee will face blowback for a callback that turns out to be legitimate.

5. Harden Account Access With Phishing-Resistant MFA

A fooled employee shouldn’t automatically mean a compromised system. Hardware security keys and passkeys resist the account-takeover attempts that often follow a voice-clone help-desk or credential-reset scam, in a way SMS-based codes don’t. Pairing strong authentication with ongoing managed detection and response means a single successful deception is far less likely to turn into a full account compromise.

6. Limit Public Voice and Video Exposure for Leadership

Every public webinar clip, recorded sales call, or LinkedIn video is potential training material for a voice or face clone. Review what’s publicly available and trim unnecessary audio or video of senior leadership to narrow what an attacker can use in the first place.

7. Vet Remote Hires and Vendors Independently

For remote roles, verify government ID against a live, prompted video action rather than relying on the interview alone, and only issue system access once that check clears. For new vendors, confirm banking and contact details against independently sourced records, never the details supplied in the application or invoice itself.

Building a Verification Culture Across Your Team

Written policies only work if staff are trained to use them under real pressure, which is why the seven steps above need reinforcement through practice, not a once-a-year slideshow. Ongoing, scenario-based security awareness training is what turns a written policy into an instinct, phishing and deepfake-style simulations build the pause-and-verify habit before a real attacker ever tests it for real. This matters most for the roles attackers target directly: finance staff, HR, and executive assistants, who should receive role-specific scenarios rather than generic annual training.

What to Do If You Suspect a Deepfake Attack

If a request feels off, stop the interaction immediately and don’t proceed with any transfer or data disclosure. Verify independently through a contact method you already had before the call or message arrived, then document what happened, a recording, screenshots, or email headers, for both investigation and any bank recovery attempt. Report internally right away, and if funds have already moved, contact your bank immediately, since faster reporting improves the odds of a reversal. Having a documented security incident response plan in place before an attack happens is what keeps a deepfake scam from becoming a prolonged, costly recovery. Where an incident touches customer or employee data, your security compliance obligations under the Privacy Act may also apply.

Frequently Asked Questions

How to protect from phishing scams? 

Confirm any request for money, credentials, or sensitive data through a second, independent channel before acting, regardless of how the request arrived. Pair that habit with phishing-resistant MFA and regular staff training, since most phishing losses trace back to one unverified action rather than a technical failure.

How to defend against deepfakes? 

Shift from detection to verification: assume a convincing voice or video could be fake and confirm the request through a callback, a pre-agreed code word, or a second approver. Detection tools exist, but aren’t reliable enough to be a small business’s only line of defence.

What is the strongest defense against phishing? 

Mandatory second-channel verification for any high-stakes request is the strongest defence, because it works whether the attack arrives as an email, a phone call, or a deepfake video. The medium changes, but a callback to a known number exposes the fraud either way.

What is out-of-band verification? 

Out-of-band verification means confirming a request through a channel different from the one it arrived on, such as calling a known number back after an urgent email or video request. It works against deepfakes because the attacker doesn’t control that second channel.

How much audio does it take to clone a voice? 

Current voice-cloning tools can produce a usable clone from as little as a few seconds of clean public audio, such as a webinar recording or LinkedIn video, which is why trimming leadership’s public footprint is a practical part of a defence plan.

Can deepfake detection software catch these scams?

Not reliably enough to be your main defense. Detection tools exist, but they’re imperfect and resource-intensive, and most small and medium businesses don’t need to buy or run them directly. Verification protocols work whether the media looks or sounds real, making them the more dependable layer. 

What should I do if I suspect a deepfake attack?

Stop the interaction immediately and don’t proceed with any transfer or data disclosure. Verify independently through a contact method you already had before the request arrived, document everything (recordings, screenshots, email headers), and report internally right away. If funds have already moved, contact your bank immediately, since faster reporting improves the odds of a reversal. 

Verification Is Your Best Defense Against Deepfake Phishing Scams

Deepfake phishing scams succeed by exploiting trust, not technology, which is exactly why the fix doesn’t require an enterprise security budget. The businesses that protect themselves best stop treating “I saw them, I heard them” as proof of anything. Instead, they build a written, practiced verification habit: a second channel for every high-stakes request, a shared code word, dual approval on transfers, and a culture where staff feel safe pausing to check. None of that requires spotting a perfect fake. It just requires making sure the fraudulent request fails, even when the deepfake itself is flawless.

If any of these gaps sound familiar in your own business, a cybersecurity risk assessment is a practical next step; it shows you exactly where informal approval habits could let a deepfake scam through. Book a free consultation to talk through where those gaps might be.