In early 2024, an employee at the engineering company Arup in Hong Kong joined a video call with the company’s chief financial officer and several colleagues. Everybody looked and sounded normal. He was asked to make a series of confidential transfers, and he did. Only later did he learn that the other people in the meeting were deepfakes. The company lost around 25 million US dollars. The case shocked many security experts. Until then, a live video call had been seen as fairly reliable proof of who you were talking to.

What a deepfake is

A deepfake is fake audio, video or images made with AI. The software studies how a person looks, moves and talks, then creates new material that appears genuine. A few years ago this needed hours of recordings and expensive computers. These days a short clip from YouTube or an Instagram story can be enough to copy a voice fairly well.

Cloned voices

Fake videos get more headlines, but in daily life fake voices are probably the larger risk. They cost less, take less time to make and are harder to notice, particularly on a poor phone connection.

The UAE has already seen one of the biggest cases. In January 2020, a bank manager in the Emirates took a call from a company director whose voice he knew from earlier conversations. The director said his company was about to make an acquisition and needed several transfers approved. Emails from a lawyer seemed to confirm the story. The voice had been cloned, and about 35 million US dollars were moved to accounts in different countries.

Ordinary families are at risk as well. In a typical family emergency scam, criminals phone elderly people and pretend to be a grandchild or another relative who urgently needs money. With voice cloning, the caller can now sound almost exactly like the real grandson, which makes the trick much harder to see through.

Getting past identity checks

Many banks and online services ask new customers for a selfie or a short video. This process is called KYC, short for “Know Your Customer.” Fraudsters now use face-swap software to pass these checks. They open accounts under another person’s name, and sometimes under the name of someone who has never existed. These synthetic identities mix real and invented data. They can be used for loans, money laundering or other fraud for months before anyone becomes suspicious.

Ways to protect yourself

Software won’t fix this problem by itself, but some simple habits make a big difference:

• Choose a code word with your family or your team for emergencies. A deepfake can imitate a voice, but it can’t guess a secret word.
• Ring back. When someone asks for money or private data, end the call and contact them on a number you already know.
• Take your time. Deepfake scams nearly always push you to act immediately, and a genuine emergency can usually wait five minutes.
• In companies, large payments should need approval from at least two people, whoever makes the request.
• Identity checks should include liveness detection, which tests whether a real person is in front of the camera instead of a recording.

Lawmakers are reacting too. The UAE’s cybercrime law from 2021 doesn’t use the word “deepfake”, but it does punish people who edit someone’s photos or recordings to harm them, and it also covers spreading false information online. The EU AI Act, which matters for any company working with European partners, requires AI-generated content such as deepfakes to be clearly labelled. Criminals obviously won’t respect these rules, but they give legal users clearer standards.

For most of history, people relied on what they saw and heard. If we recognised a face or a voice, we accepted that the person was real. Deepfakes have weakened that trust. We don’t need to be suspicious of every phone call. Still, our checks should be based on things that are difficult to copy, such as callbacks, code words and fixed approval rules. A familiar face or voice on its own should no longer be enough.

Contributed by GuestPosts.biz